using System Center 2012 Configuration Manager – Part 14. Using Compliance Settings

In Part 1 of this series we created our new LAB, we got the System Center 2012 Configuration Manager ISO and extracted it, then copied it to our Active Directory server. We then created the System Management container in AD, delegated permissions to the container, extended the Schema for Configuration Manager. We then opened TCP ports 1433 and 4022 for SQL replication between sites, installed some prerequisites like .NET Framework 4.0, added some features and then downloaded and installed SQL Server 2008 R2 SP1 CU6. We then configured SQL Server using SQL Server Management Studio for security and memory configurations prior to running the Configuration Manager 2012 setup to assess server readiness. Finally we installed a central administration site (CAS).  In Part 2 we setup our Primary server with SQL Server 2008 R2 SP1 CU6. We then installed Configuration Manager 2012 on our primary server (P01) and verified that it was replicating to our central administration site (CAS) server. Then we configured Discovery methods for our Hierarchy and then configure Boundaries and Boundary Groups.

 

In Part 3 we configured Discovery methods and configured boundaries and created a boundary group, we then configured them for Automatic Site Assignment and Content Location. In Part 4 we added the Application Catalog roles to our Hierarchy. We then configured Custom Client Device Settings and then deployed those settings to the All Systems collection on site P01. After that we created Custom Client User Settings and deployed them to the All Users collection in order to allow users to define their own User and Device affinity settings. In Part 5 we installed the WSUS server role (it is required for the Software Update Point role). We then installed the Software Update Point role on our CAS and Primary servers and we configured the SUP to support ConfigMgr Client Agent deployment which is a recommended Best Practice method of deploying the Configuration Manager Client Agent.

 

In Part 6 we prepared our server for the Endpoint Protection Point role, and installed that role before configuring custom client device settings and custom antimalware policies. We then deployed those custom client device settings and custom antimalware policies to our newly created Endpoint Protection collections. In Part 7 we added operating system deployment ability to our hierarchy by adding Windows 7 X64. We used the Build and Capture process to capture a WIM image which we can later deploy to targeted computers using network boot (PXE). PXE boot requires specific settings on our distribution points and the boot images used to deliver the operating system WIM images were therefore also enabled for PXE support.

In Part 8 we added Applications to our Software Library and configured the requirements in the Deployment Type to add new abilities to the application delivery process. We monitored the approval process of our applications and saw how requirements can influence whether an application is installed or not and we noted the difference between deploying to Users versus Devices. Now we will take a look at how Automatic Deployment Rules can be used to automate the deployment of windows updates on Patch Tuesday using a recurring schedule to patch your infrastructure using Software Updates.

In Part 9 we created some folders and collections using a PowerShell script to make targeting of Windows Updates easier, we then performed a full synchronization of our Software Update Point before creating an Automatic Deployment Rule (ADR) for Windows 7 monthly updates for Patch Tuesday.  In Part 10 we monitored our previously created ADR and monitored the downloading and deployment of those updates both to the distribution points and finally to our Windows 7 client computers. We reviewed the process in fine detail in order to understand the sequence of events when an ADR is run on a schedule.

 

In Part 11 we upgraded our Hierarchy to System Center 2012 Configuration Manager Service Pack 1. In Part 12 we used the new Build and Capture process in Configuration Manager 2012 Service Pack 1, to capture a master image of Windows 8 Enterprise with the .NET 3.5 feature pre-installed, in addition we did most of it using Powershell cmdlet’s which are now part of Configuration Manager. In Part 13 we customized the Windows 8 start screen to suit our needs on our previously captured image, we learned the steps required to successfully deploy that customized image and we did most of the work using PowerShell Cmdlets (where available).

 

Now we will use Compliance Settings to take control of certain settings on our clients and to make sure that they are compliant with our baselines by remediating when necessary.

 

Introduction

Many organizations today use some form of compliance to enforce standards (via Group Policy or other methods), and that’s a good thing as having standards means that you can keep things the same across many computers which in turn means they are easier to manage and support. If the computers you manage are compliant with your organizations policies then all is good, if the computers are not compliant then we can report on this non-compliance and/or enforce compliance via remeditation (fix the problem by enforcing the standard).

 

In this guide I’ll show you how to do most of the actions using Powershell (where possible, not all actions have been converted 100% to powershell, it’s still in development) but also via the configuration manager console. The reason that I’m showing you how to do it in both ways is to make your job easier in terms of automating certain tasks. Once you see how the cmdlets work you’ll be more inclined to include them in a script.

 

Configuration Manager 2012 Service Pack 1 has Compliance Settings built in (however there are no included configuration baselines or configuration items, you can of course create your own or import ready made baselines) and has the ability to not only monitor but to remediate. Compliance Settings was referred to as Desired Configuration Management (DCM) in Configuration Manager 2007. The Compliance Settings feature is found in the Assets and Compliance  node and is comprised of the following three components:

  • Configuration Items
  • Configuration Baselines
  • User data and Profiles

Configuration Items are rules that govern what should be done. Configuration Baselines are groups of one or more Configuration Items and these baselines are deployed to Collections, clients (users or devices) in collections evaluate their compliance state and submit that data to the site server. You can create your own Configuration Baselines or Import them from elsewhere. Imported baselines always include their associated Configuration Items.

 

Compliance Settings in Configuration Manager 2012 SP1.png

 

Step 1. Verify compliance settings and schedule in Client Settings

Perform the following on the CAS server as SMSadmin

 

Before we can use Compliance Settings we need to enable the ability via client settings. You can configure this site wide (it’s enabled by default) or on a collection by collection basis using custom client device settings. In Part 4 of this series we created Custom Client Device Settings, so let’s go ahead and open up those client settings.

 

Method #1 – Verify the Custom Client Device Settings in Powershell

 

In a Configuration Manager PowerShell console issue the following command

Get-CMClientSetting -Name "Custom Client Device Settings" -Setting 3

It should output something like the below if any valid Client setting is found

 

get-cmclientsetting.png

 

Tip: You can change the -Setting value to an array of values between 0-18 to match the relative Agent type. For example the 3rd agent type is Compliance Settings and the 4th agent type is Computer Agent. You can specify them in any order you want them outputted in, from 0 to 18, like 0,3,2,4,5,7,10,18

Get-CMClientSetting -Name "Custom Client Device Settings" -Setting 3,4

get-cmclientsetting with an array.png

 

Method #2 – Verify the Custom Client Device Settings in the Configuration Manager console

 

In the Administration workspace, select our Custom Client Device Settings, right click and choose Properties.

 

Custom Client Device Settings.png

 

From the list that appears place a checkmark in Compliance Settings

 

add compliance settings.png

 

and set both options to Yes as per the screenshot below.

 

Note: Enabling the Compliance Settings client settings makes it possible for Configuration Manager clients that are assigned to this site to evaluate compliance with assigned configuration baselines. This client setting is enabled by default via the Default Client Settings, but the client will not evaluate its compliance until it downloads one or more configuration baselines and evaluates them at the configured schedule. Disabling the Compliance Settings client settings prevents Configuration Manager clients that are assigned to this site from evaluating compliance with deployed configuration baselines.

 

compliance settings set to Yes.png

 

Note: The option Enable User Data and Profiles is for Configuration Manager 2012 SP1 only and applies to Windows 8 computers in your hierarchy.

 

If you want to change the schedule of when compliance is evaluated then you’ll need to edit the Default Client Settings, and open the corresponding compliance settings  option listed below, for the purpose of this guide let’s change it to every 1 day (by default it’s every 7 days).

 

change compliance settings schedule.png

 

Tip: you can always manually check for compliance on a client computer by reviewing the actions available in the Configurations tab of the Configuration Manager client agent.

 

 

Step 2. Create a baseline to set the homepage for All Users using Windows 8

Perform the following on the CAS server as SMSadmin

 

Now we will create our first baseline called Set Home Page. I’ll show you how to do it in two ways, you can decide which way to do it. One method will be with powershell cmdlets built into Configuration Manager and the other method is with screenshots of the steps required in the Configuration Manager console.

 

Method #1 – Create the Baseline in Powershell

 

To create the Configuration Baseline in PowerShell we will use the New-CMBaseline cmdlet. In the Configuration Manager console (or using a console that has the configuration manager module imported), open a Powershell console and use the following command to create the new Configuration Baseline:-

New-CMBaseline -Name "Set Home Page" -Description "Sets the homepage in Internet Explorer to http://www.windows-noob.com for All Users using Windows 8" -Category -- Client

Method #2 – Create the Baseline in the Configuration Manager console

 

To create the Configuration Baseline using the Configuration Manager console, in Assets and Compliance right click on Configuration Baselines in Compliance Settings, and choose Create Baseline.

 

create configuration baseline.png

 

enter the following info, give it a name, description and select the Client category (or create a new one if you wish), at this point we won’t select any configuration item.

 

set home page.png

 

save your settings and your baseline appears in the console.

 

baseline created.png

 

 

Step 3. Create a Configuration Item to set a registry key

Perform the following on the CAS server as SMSadmin

 

A baseline is pretty useless without one or more configuration items to ‘tell’ it what to do or what to check for, so let’s go ahead and create a new configuration item which checks the value of a registry key and set’s it to the value that we desire (by remediating the value). The registry key we are checking for is a current user registry key so this can only be checked when a user is logged on. Once again i’ll show you two methods of doing this, one using powershell, one using the Configuration Manager console.

 

Method #1 – Create the Configuration Item in Powershell

 

To create the Configuration Item in PowerShell we will use the New-CMConfigurationItem cmdlet. Use the following command to create the new Configuration Item:-

New-CMConfigurationItem -Name "Set home page via a registry key" -Description "Sets the homepage to http://www.windows-noob.com" -CreationType "WindowsOS" -Category "Client"

Note: The New-CMConfigurationItem cmdlet is not fully fledged yet so you’ll have to go and edit the Configuration Item (CI) in the console manually to add the remaining bits, see below for what to add.

 

Method #2 – Create the Configuration Item in the Configuration Manager console

 

To create the Configuration Item using the Configuration Manager console, in Assets and Compliance right click on Configuration Item in Compliance Settings, and choose Create Configuration Item.

 

create configuration item.png

 

fill in the name, and a good description, select Windows as the OS and Client as the category

 

create configuration item details.png

 

next for supported platforms deselect All and place a checkmark in Windows 8 (this will mean that the CI is only supported on Windows 8 systems)

 

Supported Platforms - Windows 8.png

 

and on the Settings page click on New to create a new setting

 

Settings - New.png

 

on the Create Setting page, fill in details about the setting you are creating, when creating settings you can select the following types of setting type

  • Active Directory Query
  • Assembly
  • File System
  • IIS metabase
  • Registry key
  • Registry Value
  • Script
  • SQL query
  • WQL query
  • XPath query

we are going to set a registry key in the Current User Hive, so select the following:-

  • Hive Name: HKEY_CURRENT_USER\
  • Key Name: Software\Microsoft\Internet Explorer\Main
  • Value Name: Start Page

 

Create Setting.png

 

Next, click on the Compliance Rules Tab and click on New

 

New compliance rule.png

 

On the Create Rule page, fill in the following details:-

  • Name=Verify and Remediate start page
  • Description=Verify the Internet Explorer start Page value and set to http://www.windows-noob.com if not compliant
  • Selected Setting=Set home page via a registry key \ set home…
  • Rule Type=Value
  • Remediate noncompliant rules when supported=True
  • Report noncompliance if this setting instance is not found=True

Create rule.png

 

Apply your settings and click next to continue at the compliance rules page

 

Compliance Rules.png

 

continue through the wizard until the Create Configuration Item wizard is complete

 

Create Configuration Item complete.png

 

Step 4. Add the Configuration Item to the Configuration Baseline

Perform the following on the CAS server as SMSadmin

 

Now that our Configuration Item is created we need to add it to our baseline the baseline won’t have anything to do.

 

Method #1 – Add the Configuration Item to the Configuration Baseline in Powershell

 

This functionality is not available yet.

 

Method #2 – Add the Configuration Item to the Configuration Baseline in the Configuration Manager console

 

Select the Set Home Page baseline in Configuration Baselines and right click, choose Properties.

 

Properties of Configuration Baseline.png

 

click on the Evaluation Conditions tab and in the drop down  Add menu select  Configuration Items

 

Add configuration items.png

 

select our newly created Configuration Item, click Add then click OK

 

add configuration items 123.png

 

Once done click on Apply then OK.

 

apply then ok.png

 

Step 5. Deploy the Baseline

Perform the following on the CAS server as SMSadmin

 

Now that our Configuration Item is created and added to our Configuration Baseline, we want to Deploy the baseline to a collection. As we are targeting to the Windows 8 computers collection (I’ve created that device collection in advance using a query to check for Windows 8 as the operating system), all computers in this collection will get this Baseline when they next poll for policy and they’ll be checked for compliance. Carefully targeting your collections will mean that the compliance data returned will be more meaningful.

 

Method #1 – Deploy the Configuration Baseline in Powershell

 

We will use the powershell cmdlet Start-CmBaselineDeployment to deploy our configuration baseline.

Start-CmBaselineDeployment  -Name "Set Home Page" -CollectionName "Windows 8 Computers" -EnableEnforcement $True -OverrideServiceWindow $True -GenerateAlert $True -ParameterValue 90

Method #2 – Deploy the Configuration Baseline in the Configuration Manager console

 

Right click on our Configuration Baseline and choose Deploy, fill in the values as you see in the screenshot below.

 

deploy configuration baseline in the configuration manager console.png

 

Step 6. Verify compliance on a client computer

Perform the following on a Windows 8 computer as a testuser

 

Logon to a Windows 8 client and start up Internet Explorer, set the homepage to a value such as http://www.niallbrady.com

 

home page set to niallbrady dot com.png

 

Apply the settings and open the Configuration Manager Client. Browse to the Actions tab and initiate a Machine policy retrieval.

 

Machine Policy retrieval and Evaluation cycle.png

 

Once done, select the Configurations Tab and click on refresh, our Baseline should appear and if it has not run yet the compliance level will be unknown.

 

set home page baseline not run yet.png

 

select our baseline and click on Evaluate to check our compliance

 

evaluate.png

 

After it has run (it is quick) you’ll see that we are compliant.

 

compliant.png

 

go ahead and click on View Report to see a report of what it has just done

 

compliance report.png

 

and scroll down to see more details of what the previous value was and what it was remediated to

 

previous value and remediated value.png

 

and of course you can browse to the homepage in Internet Explorer to see that our Configuration Baseline is working, it is ! Job Done !.

 

job done.png

 

 

Troubleshooting

 

You can review the following log files on the client to troubleshoot configuration baseline application and remediation issues.

  • CIAgent.log Records details about the process of remediation and compliance for compliance settings, software updates, and application management.
  • CITaskManager.log Records information about configuration item task scheduling
  • DCMAgent.log Records high-level information about the evaluation, conflict reporting, and remediation of configuration items and applications
  • DCMReporting.log Records information about reporting policy platform results into state messages for configuration items
  • DcmWmiProvider.log Records information about reading configuration item synclets from Windows Management Instrumentation (WMI).

 

You can also review built in Compliance and Settings Management reports to get details of compliance levels in your organization

 

Compliance and settings management reports.png

 

You can drill down into those reports once the state messages have been processed

 

List of unknown assets for a configuration baseline.png

 

Or you can check the compliance level from the Deployments node in Monitoring, or via the Configuration Baseline itself by selecting the Deployments tab, you will see the compliance level, you can run a summarization to get up to date results or click on View status to get more information about the deployment

 

view status of Compliance.png

 

and check the Error, Non-Compliant or Unknown tabs for details of why they are not compliant

 

Unknown status.png

 

that’s all for now folks so until next time,

cheers

niall.

 

Summary

 

Compliance Settings in Configuration Manager 2012 SP1 gives you power to enforce standards across your organization, all via the configuration manager client. In addition you can report on that compliance on the client computer itself, on your Configuration Manager reporting services servers or in the Configuration Manager console itself. With Configuraiton Manager 2012 SP1 you now have additional powershell cmdlets to do most of the actions required to successfully create, manage and deploy your baselines, so what are you waiting for, get compliant !

 

Recommended reading

 

Compliance Settings in Configuration Manager – http://technet.micro…y/gg681958.aspx

Security Compliance Manager 3.0 – http://www.microsoft…s.aspx?id=16776

 

Posted in Compliance Settings, Compliance Settings, ConfigMgr 2012, Custom Client Device Settings, PowerShell, Security Compliance Manager, Windows 8, windows-noob | Leave a comment

First looks at “Windows Server 2012 Hyper V Installation and configuration Guide” a book by Aidan Finn, Patrick Lownds, Michel Luescher and Damian Flynn.

Introduction

I got this new book about Installing and Configuring Hyper-V written by some cool authors indeed, one of whom is Aidan Finn. I have met Aidan Finn several times and I can tell you he’s one sharp cookie with a very deep ‘writers streak’. If he’s not blogging about it then it’s probably not important in the System Center IT-centric world we live in today, and when he’s not blogging he’s writing books.

I use Hyper-V daily as all my virtual machines in my Configuration Manager 2012 labs  are  running on Hyper-V hosts. I  manage several virtual machines on these hosts and they are running on Server 2008 R2, Server 2012 and even in Windows 8 so you could say that I’m already familiar with normal day to day usage of Hyper-V.

I’m not a power user of Hyper-V though, I’m not doing any of the cool stuff like Hyper-V replica or VDI and I don’t have my VM’s in a cloud, however by reading this book I hope to get a better understanding of those elements that I have yet to touch upon and I intend to refer to this book when those Hyper-V challenges ahead need answers and suggested solutions from the experts.

What is the book about ?

This book is all about Hyper-V in Windows Server 2012 !

Well to be more precise this book is aimed at professionals seeking to understand and use all or some of the new virtualization and cloud features of Windows Server 2012.

We now know that Microsoft took an entire year after the release of Windows Server 2008R2 to talk to customers, gather requirements and desires, and plan the new release

This book is intended to be a reference for all things Windows Server 2012 Hyper-V and here’s a quick glance at what lies within those 571 pages.

  • Chapter 1. Introducing Windows Server 2012 Hyper-V
  • Chapter 2. Deploying Hyper-V Hosts
  • Chapter 3. Managing Virtual Machines
  • Chapter 4. Networking
  • Chapter 5. Cloud Computing
  • Chapter 6. Microsoft iSCSI Software Target
  • Chapter 7. Using File Servers
  • Chapter 8. Building Hyper-V Clusters
  • Chapter 9. Virtual SAN Storage and Guest Clustering
  • Chapter 10. Backup and Recovery
  • Chapter 11. Disaster Recovery
  • Chapter 12. Hyper-V replica
  • Chapter 13. Using Hyper-V for Virtual Desktop Infrastructure

What about Powershell in Hyper-V ?

The book contains several examples of Powershell when it comes to configuring or deploying Hyper-V virtual machines or setting up your host. You can rapidly deploy changes to lots of virtual machines with a powershell line or script it to automate tasks.

For example the powershell command:

Get-Command -Module Hyper-V

will list the new Hyper-V cmdlets (even works in Windows 8, try it !).

Basic and Advanced Networking

The book goes into plenty of detail explaining the differences between basic and advanced networking in Hyper-V.  If you need to configure NIC teaming, it’s covered. You want Single Root I/O virtualization, look no further and there are well designed diagrams conveniently placed in the book to help you to visualize the topic being covered.

Get off my cloud

If you want to get Off-Premise (and into the Cloud) with your virtual machines then chapter 5 is for you. The chapter does get pretty complex, pretty quickly so you’ll need to digest the content slowly unless of ourse you are already familiar with Proxy ARP and Promiscuous mode or PVLANS.

Real world solutions – challenges and solutions.

Each chapter ends with Real world solutions containing Challenges followed by solutions, this is a great way of understanding how to deal with Real world scenarios such as how you could use Windows XP as a client operating system (not optimal) in VDI environments. The authors are experts in the field of Virtualization, they know the challenges that are being faced day in day out and they are very well poised to recommend the solutions. This feature of the book is a winner.

Summary

To sum up, if you intend deploying a Hyper-V environment in your organization any time soon, you’ll most likely want to do that using Windows Server 2012, and to help you get up to speed I’d highly recommend you get this book.

Aidan and team have done a wonderful job filling this book with so much content (including Powershell scripts and cmdlets), using real challenges and real solutions, it’s not only worth reading, it’s worth keeping it on your desk as a reference.

Windows Server 2012 Hyper-V Installation and Configuration Guide

cheers !

niall

Posted in book, Hyper-V, Server 2012 | Leave a comment

After selecting a task sequence in Configuration Manager 2012 SP1 you receive “ThreadToResolveAndExecuteTaskSequence failed. Code(0x8007000E)” in SMSTS.LOG

Introduction

I recently encountered this problem, after PXE booting a new virtual machine I selected a task sequence from the list of task sequences available and after some delays processing policy the task sequence failed with an error “Failed to run Task Sequence. An error occurred while starting the task sequence (0x8007000E).

failed to run task sequence

Pressing F8 and examining the SMSTS.log file revealed an error which stated the following:

“ThreadToResolveAndExecuteTaskSequence failed. Code(0x8007000E)”

Problem

You may have several Software Update Groups containing many software updates deployed to a collection (or collections) that the computer is a member of, each deployment is referenced by a Policy and when PXE booting this policy must be processed by the client and saved in the Task Sequence Environment, below is a sample Policy being processed by the client and saved into the Task Sequence environment, this log snippet is from the SMSTS.log file

<![LOG[CLibSMSMessageWinHttpTransport::Send: URL: SCCM.server2008r2.lab.local:80  GET /SMS_MP/.sms_pol?ScopeId_6018FCB4-5D22-4CF7-8309-5B1E7E79C657/AuthList_b3571cfa-e19e-44e6-9feb-b62895c33409/VI.SHA256:9B58FAE13D775572FFC29B4CC6DCF35AF740331A2769B83D2FAF69DDE0AC51BF]LOG]!><time=”10:11:25.581-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”1″ thread=”1084″ file=”libsmsmessaging.cpp:8422″>
<![LOG[Request was succesful.]LOG]!><time=”10:11:25.597-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”libsmsmessaging.cpp:8758″>
<![LOG[::DecompressBuffer(65536)]LOG]!><time=”10:11:25.597-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”ccmzlib.cpp:736″>
<![LOG[Decompression (zlib) succeeded: original size 5692, uncompressed size 41914.]LOG]!><time=”10:11:25.597-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”ccmzlib.cpp:647″>
<![LOG[Hash computed from CSP: Microsoft Enhanced RSA and AES Cryptographic Provider, AlgID: 32780, HashSize: 32 ]LOG]!><time=”10:11:25.597-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”libcrypt.cpp:481″>
<![LOG[Expected Hash size: 32, Computed Hash size: 32 ]LOG]!><time=”10:11:25.597-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”libcrypt.cpp:528″>
<![LOG[Request location: HTTP://<MP>/SMS_MP/.SMS_POL?SCOPEID_6018FCB4-5D22-4CF7-8309-5B1E7E79C657/AUTHLIST_B3571CFA-E19E-44E6-9FEB-B62895C33409/VI.SHA256:9B58FAE13D775572FFC29B4CC6DCF35AF740331A2769B83D2FAF69DDE0AC51BF]LOG]!><time=”10:11:25.597-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”1″ thread=”1084″ file=”libsmsmessaging.cpp:4806″>
<![LOG[Response ID: SCOPEID_6018FCB4-5D22-4CF7-8309-5B1E7E79C657/AUTHLIST_B3571CFA-E19E-44E6-9FEB-B62895C33409/VI]LOG]!><time=”10:11:25.597-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”1″ thread=”1084″ file=”libsmsmessaging.cpp:4807″>
<![LOG[Reading Policy Body.]LOG]!><time=”10:11:25.613-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”tspolicy.cpp:2023″>
<![LOG[Parsing Policy Body.]LOG]!><time=”10:11:25.613-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”tspolicy.cpp:2030″>
<![LOG[Downloading policy body ScopeId_6018FCB4-5D22-4CF7-8309-5B1E7E79C657/AuthList_9ec5f064-8ab2-474a-84c4-383c95425a94/VI.]LOG]!><time=”10:11:25.613-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”1″ thread=”1084″ file=”tspolicy.cpp:1992″>
<![LOG[Preparing Policy Body Request.]LOG]!><time=”10:11:25.613-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”tspolicy.cpp:1995″>
<![LOG[    Setting transport.]LOG]!><time=”10:11:25.613-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”tspolicy.cpp:1996″>
<![LOG[    Setting policy location = http://<mp>/SMS_MP/.sms_pol?ScopeId_6018FCB4-5D22-4CF7-8309-5B1E7E79C657/AuthList_9ec5f064-8ab2-474a-84c4-383c95425a94/VI.SHA256:7F558FDF821B09FEB1E0F78FF7D4BB42BBC8720B80240FCF42F0B1AF02B03E5E.]LOG]!><time=”10:11:25.613-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”tspolicy.cpp:1998″>
<![LOG[Executing Policy Body Request.]LOG]!><time=”10:11:25.613-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”tspolicy.cpp:2015″>

And below is what happens when the Task Sequence environment runs out of space..

<![LOG[CLibSMSMessageWinHttpTransport::Send: URL: SCCM.server2008r2.lab.local:80  GET /SMS_MP/.sms_pol?ScopeId_6018FCB4-5D22-4CF7-8309-5B1E7E79C657/AuthList_51631236-80d5-4b53-a270-92b0e24c090e/VI.SHA256:B15A1F8969E8DF2EA29784A9E6DCAB3C9AD60C3F7283453B73200C216EF4D539]LOG]!><time=”10:11:25.769-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”1″ thread=”1084″ file=”libsmsmessaging.cpp:8422″><![LOG[Request was succesful.]LOG]!><time=”10:11:25.769-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”libsmsmessaging.cpp:8758″><![LOG[::DecompressBuffer(65536)]LOG]!><time=”10:11:26.829-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”ccmzlib.cpp:736″><![LOG[Decompression (zlib) succeeded: original size 777343, uncompressed size 6459734.]LOG]!><time=”10:11:27.110-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”ccmzlib.cpp:647″><![LOG[Hash computed from CSP: Microsoft Enhanced RSA and AES Cryptographic Provider, AlgID: 32780, HashSize: 32 ]LOG]!><time=”10:11:27.157-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”libcrypt.cpp:481″><![LOG[Expected Hash size: 32, Computed Hash size: 32 ]LOG]!><time=”10:11:27.157-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”libcrypt.cpp:528″><![LOG[Request location: HTTP://<MP>/SMS_MP/.SMS_POL?SCOPEID_6018FCB4-5D22-4CF7-8309-5B1E7E79C657/AUTHLIST_51631236-80D5-4B53-A270-92B0E24C090E/VI.SHA256:B15A1F8969E8DF2EA29784A9E6DCAB3C9AD60C3F7283453B73200C216EF4D539]LOG]!><time=”10:11:27.656-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”1″ thread=”1084″ file=”libsmsmessaging.cpp:4806″><![LOG[Response ID: SCOPEID_6018FCB4-5D22-4CF7-8309-5B1E7E79C657/AUTHLIST_51631236-80D5-4B53-A270-92B0E24C090E/VI]LOG]!><time=”10:11:27.656-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”1″ thread=”1084″ file=”libsmsmessaging.cpp:4807″><![LOG[Reading Policy Body.]LOG]!><time=”10:11:28.343-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”tspolicy.cpp:2023″><![LOG[Parsing Policy Body.]LOG]!><time=”10:11:28.358-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”tspolicy.cpp:2030″><![LOG[::CompressBuffer(65536,-1)]LOG]!><time=”10:11:29.310-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”ccmzlib.cpp:696″><![LOG[Compression (zlib) succeeded: original size 42856010, compressed size 4996942.]LOG]!><time=”10:11:32.679-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”ccmzlib.cpp:485″><![LOG[((p.Header->UsedBytes + nNameBytes + nNewValueBytes) < 0xA00000) != 0, HRESULT=8007000e (e:\nts_sccm_release\sms\framework\tscore\environmentscope.cpp,430)]LOG]!><time=”10:11:34.723-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”environmentscope.cpp:430″><![LOG[m_pGlobalScope->setValue (pszName, c_szBinaryType + sEncodedValue), HRESULT=8007000e (e:\nts_sccm_release\sms\framework\tscore\environmentlib.cpp,524)]LOG]!><time=”10:11:34.723-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”environmentlib.cpp:524″><![LOG[TS::Environment::SharedEnvironment.setValue( TS::EnvironmentVar::CIVersionInfoPolicy, (const BYTE*)sPolicyXML.c_str(), (sPolicyXML.length()+1)*sizeof(WCHAR) ), HRESULT=8007000e (e:\nts_sccm_release\sms\client\tasksequence\tsmbootstrap\tsmediawizardcontrol.cpp,1887)]LOG]!><time=”10:11:34.723-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”tsmediawizardcontrol.cpp:1887″><![LOG[Command line for extension .exe is "%1" %*]LOG]!><time=”10:11:34.739-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”commandline.cpp:228″><![LOG[Set command line: "X:\sms\bin\x64\TsProgressUI.exe" /Unregister]LOG]!><time=”10:11:34.739-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”commandline.cpp:705″><![LOG[Executing command line: "X:\sms\bin\x64\TsProgressUI.exe" /Unregister]LOG]!><time=”10:11:34.739-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”1″ thread=”1084″ file=”commandline.cpp:801″><![LOG[==========[ TsProgressUI started in process 1116 ]==========]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TsProgressUI” context=”" type=”1″ thread=”1120″ file=”winmain.cpp:329″><![LOG[Command line: "X:\sms\bin\x64\TsProgressUI.exe" /Unregister]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TsProgressUI” context=”" type=”0″ thread=”1120″ file=”winmain.cpp:332″><![LOG[Unregistering COM classes]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TsProgressUI” context=”" type=”1″ thread=”1120″ file=”winmain.cpp:204″><![LOG[Unregistering class objects]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TsProgressUI” context=”" type=”1″ thread=”1120″ file=”winmain.cpp:495″><![LOG[Shutdown complete.]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TsProgressUI” context=”" type=”1″ thread=”1120″ file=”winmain.cpp:512″><![LOG[Process completed with exit code 0]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”1″ thread=”1084″ file=”commandline.cpp:1098″><![LOG[Successfully unregistered TS Progress UI.]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”1″ thread=”1084″ file=”utils.cpp:2075″><![LOG[ExecuteSelectedTaskSequence(fpCallbackProc,pv,hCancelEvent), HRESULT=8007000e (e:\nts_sccm_release\sms\client\tasksequence\tsmbootstrap\tsmediawizardcontrol.cpp,1484)]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”tsmediawizardcontrol.cpp:1484″><![LOG[hrReturn, HRESULT=8007000e (e:\nts_sccm_release\sms\client\tasksequence\tsmbootstrap\tsmediaresolveprogresspage.cpp,408)]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”1084″ file=”tsmediaresolveprogresspage.cpp:408″><![LOG[ThreadToResolveAndExecuteTaskSequence failed. Code(0x8007000E)]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”3″ thread=”1084″ file=”tsmediaresolveprogresspage.cpp:408″><![LOG[ThreadToResolveAndExecuteTaskSequence returned code 0x8007000E]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”1″ thread=”840″ file=”tsmediaresolveprogresspage.cpp:221″><![LOG[Setting wizard error: An error occurred while starting the task sequence (0x8007000E). For more information, contact your system administrator or helpdesk operator.]LOG]!><time=”10:11:34.754-60″ date=”05-16-2013″ component=”TSPxe” context=”" type=”0″ thread=”840″ file=”tsmediawizardcontrol.cpp:1504″>

ThreadToResolveAndExecuteTaskSequenceFailed

The error above, (0x8007000e) “Not enough storage is available to complete this operation.” means that there is not enough ram (memory) to complete the operation, in other words the  allocated space in ram for the Task Sequence environment has run out of space (not necessarily that that RAM memory is out of space). The reason it has run out of space could be due to four possibilities:-

  • too many applications
  • too many Windows updates
  • too many Task Sequence steps
  • too many referenced Packages.

If we look further at the SMSTS.log file the computer actually read 367 policy assignments and it will attempt to load each policy into the task sequence Environment Space, eventually running out of space. I counted the number of Response ID’s that were listed in my SMSTS.log and it was 182 including the last failed one, if that number is a hard limit I don’t know but that’s where it ran out of environment space.

You can also clearly see the ScopeID in the SMSTS.log referred to in RAM by using a hex editor such as the one linked to in the bottom of this post.scopeid mirrored in RAM

Solution

To reduce the number of policies being processed by the computer, you can move the computer in question to a collection that is not targeted with all these Windows Updates (assuming that is your problem). Doing so will mean that the number of Policies will reduce, however you’ll have to consider another method of applying needed updates such as offline servicing or one big Software Update Group with the required updates.

Alternatively you can delete old software update groups that are targeted to a collection that the computer is a member of. The solution that worked for me was to delete a whole bunch of old Software Update Groups that had been targeted (deployed) to the All Systems collection, this is a lab after all.  Be aware that this might not be your best option, as it does increase server load during the deletion process. The other possible workaround is listed below.

delete unused software update groupsAfter doing the above I could PXE boot once more without any failure to process policy, and you can see that there were a lot less policies being processed by the computer, 130 less in fact.

237 policy assignments

well that’s it, if you encounter this problem please tell me how many Response ID’s you had in the SMSTS.log file.

until next time, adios !

niall

Recommended reading

The following Technet forum post discusses the issue I’ve mentioned above.

And this is the tool I used to browse memory (works in WinPE)  – HxD

 

Posted in Uncategorized | Leave a comment

using System Center 2012 Configuration Manager – Part 13. Deploying Windows 8 X64 with custom Start screen

In Part 1 of this series we created our new LAB, we got the System Center 2012 Configuration Manager ISO and extracted it, then copied it to our Active Directory server. We then created the System Management container in AD, delegated permissions to the container, extended the Schema for Configuration Manager. We then opened TCP ports 1433 and 4022 for SQL replication between sites, installed some prerequisites like .NET Framework 4.0, added some features and then downloaded and installed SQL Server 2008 R2 SP1 CU6. We then configured SQL Server using SQL Server Management Studio for security and memory configurations prior to running the Configuration Manager 2012 setup to assess server readiness. Finally we installed a central administration site (CAS).  In Part 2 we setup our Primary server with SQL Server 2008 R2 SP1 CU6. We then installed Configuration Manager 2012 on our primary server (P01) and verified that it was replicating to our central administration site (CAS) server. Then we configured Discovery methods for our Hierarchy and then configure Boundaries and Boundary Groups.

 

In Part 3 we configured Discovery methods and configured boundaries and created a boundary group, we then configured them for Automatic Site Assignment and Content Location. In Part 4 we added the Application Catalog roles to our Hierarchy. We then configured Custom Client Device Settings and then deployed those settings to the All Systems collection on site P01. After that we created Custom Client User Settings and deployed them to the All Users collection in order to allow users to define their own User and Device affinity settings. In Part 5 we installed the WSUS server role (it is required for the Software Update Point role). We then installed the Software Update Point role on our CAS and Primary servers and we configured the SUP to support ConfigMgr Client Agent deployment which is a recommended Best Practice method of deploying the Configuration Manager Client Agent.

 

In Part 6 we prepared our server for the Endpoint Protection Point role, and installed that role before configuring custom client device settings and custom antimalware policies. We then deployed those custom client device settings and custom antimalware policies to our newly created Endpoint Protection collections. In Part 7 we added operating system deployment ability to our hierarchy by adding Windows 7 X64. We used the Build and Capture process to capture a WIM image which we can later deploy to targeted computers using network boot (PXE). PXE boot requires specific settings on our distribution points and the boot images used to deliver the operating system WIM images were therefore also enabled for PXE support.

In Part 8 we added Applications to our Software Library and configured the requirements in the Deployment Type to add new abilities to the application delivery process. We monitored the approval process of our applications and saw how requirements can influence whether an application is installed or not and we noted the difference between deploying to Users versus Devices. Now we will take a look at how Automatic Deployment Rules can be used to automate the deployment of windows updates on Patch Tuesday using a recurring schedule to patch your infrastructure using Software Updates.

In Part 9 we created some folders and collections using a PowerShell script to make targeting of Windows Updates easier, we then performed a full synchronization of our Software Update Point before creating an Automatic Deployment Rule (ADR) for Windows 7 monthly updates for Patch Tuesday.  In Part 10 we monitored our previously created ADR and monitored the downloading and deployment of those updates both to the distribution points and finally to our Windows 7 client computers. We reviewed the process in fine detail in order to understand the sequence of events when an ADR is run on a schedule.

 

In Part 11 we upgraded our Hierarchy to System Center 2012 Configuration Manager Service Pack 1. In Part 12 we used the new Build and Capture process in Configuration Manager 2012 Service Pack 1, to capture a master image of Windows 8 Enterprise with the .NET 3.5 feature pre-installed, in addition we did most of it using Powershell cmdlet’s which are now part of Configuration Manager, now we will deploy that captured image.

 

Tip: This is a long post, give yourself plenty of time to go through it all, it’s worth it.

 

Introduction

 

Having a captured image (master image with FAT applications such as Microsoft Office 2013, this image would typically be captured with as many Windows updates that are available at that time) is essential for this part of the series. We use that captured image to save time in Deploying new computers with Windows 8, the end result is quicker deployments (less time waiting for Office to install, less time waiting for Windows updates to install), and a predictable, automated, professional, Enterprise ready experience for end users as they will have a clean Start screen with only the ‘approved’ applications for your organization present.

 

Step 1. Design your Windows 8 Start Screen [Optional]

Perform the following on the W81 virtual machine as Administrator

 

At the end of Part 12, we were left with a newly installed virtual machine with Windows 8 Enterprise joined to a workgroup, this installation had some windows updates installed, some applications and of course .NET 3.5 installed, we can still use that virtual machine to create a special file used later in our deploy process, however this involves some manual steps.

 

Login to our Build and Capture machine (W81) as administrator,

 

start screen before customization.png

 

using your preferences, remove tiles that you don’t want to appear in your corporate image by right clicking and choosing the appropriate action, for example you can remove games by choosing Unpin from start to remove it from the Start Screen or Uninstall to uninstall it altogether.

 

choose uninstall.png

 

Once you’ve unpinned (or uninstalled) some applications, your start screen will look something like this

 

unpinned apps.png

 

Now you want to add your Enterprise apps, if they don’t appear as tiles already, choose right click and select All Apps

 

all apps.png

 

all your apps appear, select the ones you want to appear by right clicking the tile and choose Pin to start

 

pin to start.png

 

keep on doing this until you’ve added the apps you want in your start screen

 

newly designed Windows 8 start screen.png

 

Next we need to sysprep this image in order to generate the AppsFolderLayout.bin file that we need for the deploy task sequence, open a command prompt and browse to C:\Windows\System32\Sysprep and run sysprep.exe, choose Enter System Out-Of-Box Experience (OOBE), enable Generalize like in the screenshot and select Shutdown.

 

sysprep options.png

 

once sysprep has run it will power off the computer.

 

vm powered off.png

 

Next we will PXE boot this virtual machine to the PXE password prompt, we do this as we are not interested in reinstalling or recapturing this image, in fact we only want one file from the computer, this file will get overwritten (and be removed) if we let the computer boot into sysprep (with the Generalize option), so booting to the network (PXE) will allow us to get to the file. PXE boot the computer and when the PXE password prompt appears press F8 to open a command prompt, then browse to the drive letter that holds windows (probably D:\) and to the following path:-

 

D:\Users\Administrator\Appdata\Local\Microsoft\Windows

 

in there you should see a file called appsFolderLayout.bin

 

AppsFolderLayout bin.png

 

copy that file somewhere safe like to a network share or USB key, I use the command below to connect to my CAS server’s default D:\ drive admin share

 

net use h: \\cas\d$

it may prompt for credentials, enter credentials that have the adequate permissions and then copy the file to the share

 

copy the file to your CAS or some other network share.png

 

Step 2. Create the AppsFolderLayout package and distribute it

Perform the following on the CAS server as SMSadmin

 

Once you have a copy of the AppsFolderLayout.bin file from Step 1, create a new folder in your OS sources called appsfolderlayout and copy the appsfolderlayout.bin file to that folder. We will create a new package in powershell pointing to that source eg: \\cas\sources\os\appsfolderlayout

 

New-CMPackage –Name "AppsFolderLayout" –Version "X64" –Description "Windows 8 Start Screen customizations, © windows-noob.com April 2013." –Language "English" –Manufacturer "Microsoft" –Path "\\cas\sources\os\appsfolderlayout"

 

appsfolderlayout bin package creation in powershell.png

 

Ok now that we’ve created the package using PowerShell, the next job is to distribute it to our distribution point P01, so issue the following command

 

Start-CMContentDistribution –PackageName "AppsfolderLayout" –DistributionPointName "P01.server2008r2.lab.local"

start-cmcontentdistribution for appsfolderlayout package.png

 

Step 3. Distribute the User State Migration Tool for Windows 8 package

Perform the following on the CAS server as SMSadmin

 

Tip: When you upgraded to Service Pack 1, part of the installation used the Windows ADK source files to create a User State Migration Tool package called User State Migration Tool for Windows 8. That mouthful could be easily abbreviated to USMT 5, but either way, the package (which is added as part of the upgrade) is not distributed to any distribution points and that means any task sequence that references it will fail.

 

To resolve this we need to distribute our package by right clicking and choose Distribute Content and continuing through the wizard, or be cool and do it with powershell.

 

The PowerShell cmdlet (Start-CMContentDistribution) is as follows, replace the DistributionPointName with your own distribution point FQDN.

 

 

Start-CMContentDistribution -PackageName "User State Migration Tool for Windows 8" –DistributionPointName "P01.server2008r2.lab.local"

 

start-cmcontentdistribution.png

 

you can once again monitor the distribution using CMTrace by opening the distmgr.log

 

distmgr log.png

 

and verify in the console if you are a traditionalist

 

content is installed.png

 

Step 4. Add the previously captured Operating System Image

Perform the following on the CAS server as SMSadmin

 

In the previous guide we captured our Windows 8 master image and now we need to add that captured image to Configuration Manager and then distribute it to the distribution points.

 

Note: There are hundreds of PowerShell CMDlets which help us automate every day tasks in Configuration Manager, and the Add an Operating System Image step has  a CMDlet for that too, called New-CMOperatingSystemImage. However, it’s not working correctly at present (it creates the image but you will not be able to distribute the image after creation) therefore until further notice, please add the operating system image manually in the console. The Powershell cmdlet is listed below for your reference, but I repeat it is not working at present (you will get the following error when you try to distribute the image via powershell “Warning there is no object that can distribute content”) therefore please add the Operating System image manually.

 

add operating system image.png

 

continue through that wizard, I mark the version info as (Captured) to make things clearer later on…

 

add operating system image completed.png

 

Tip: Here is the corresponding way of doing it using PowerShell *remember, this cmdlet doesn’t work at present*. Issue the following command New-CMOperatingSystemImage as shown below:-

 

New-CMOperatingSystemImage -Name "Windows 8 Enterprise X64" -Path "\\cas\sources\os\captures\windows8x64.wim" -Version "(Captured)"

 

 

Step 5. Distribute the Operating System Image

Perform the following on the CAS server as SMSadmin

 

After you’ve added the operating system image,  we want to distribute the image, we’ll do that with the Start-CMContentDistribution powershell cmdlet.

 

 

Start-CMContentDistribution –OperatingSystemImageName "Windows 8 Enterprise X64" –DistributionPointName "P01.server2008r2.lab.local"

review the distribution of the image to your distribution point via distmgr.log or  via the Configuration Manager console or via PowerShell using the following command, replace the PackageID listed below with the ImageID in your Configuration Manager console or

 

Get-WmiObject –NameSpace Root\SMS\Site_CAS –Class SMS_PackageStatusRootSummarizer –Filter "PackageID='CAS0002b'"

Check for Installed=1 and Targeted=1 in the output, this means that the package is distributed successfully.

 

verify package distribution via powershell.png

 

 

Step 6. Create the Deploy Windows 8 Task Sequence

Perform the following on the CAS server as SMSadmin

 

Now it’s time to create a Deploy Task Sequence, this task sequence will be used to deploy our previously captured image. This task sequence can be as flexible, simple or complex as you want (here is an example of a complex Deploy Windows 8 task sequence using MDT 2012 Update 1 integrated with Configuration Manager).

 

In the Operating System node, select Task Sequences, expand our Windows 8 folder and select the Deploy folder, right click and choose Create Task Sequence.

 

create task sequence.png

 

choose Install an Existing image package

 

Install an Existing image package.png

 

give the task sequence a suitable name and description, choose the X86 boot image

 

Task Sequence Information.png

 

for the Install Windows step, browse to our captured image,

 

captured wim.png

 

you’ll see the Captured wim clearly if you gave it an appropriate name earlier…enter an Administrator password if you want, and select any additional options such as BitLocker

 

install windows.png

 

for the Configure Network step, select join a domain and enter the domain join user account credentials, make sure to Verify the credentials as shown in the screenshot below

 

Configure Network.png

 

continue with the wizard through to completion (next next next, add any additional applications if you wish)

 

Deploy Task Sequence completed.png

 

Step 7. Edit the Task Sequence

Perform the following on the CAS server as SMSadmin

 

In the Configuration Manager console, right click on the Deploy Windows 8 task sequence and choose edit

 

Edit task sequence.png

 

Locate the Partition Disk 0 step, if the primary partition (for the Operating System) is set to a fixed size as in the screenshot below then  you’ll need to change it (otherwise the task sequence will fail on any computer that has a disc smaller than 29GB in size)

 

Here’s the step before the change

 

primary size is 30368MB.png

 

change it to Use a percentage of remaining free space instead (100%)

 

use a percentage of remaining free space.png

 

so that the Format and Partition Disk step now looks like this

 

Format and Partition Disk.png

 

Once done apply your changes and then locate the Apply data image step and disable it in the options tab (it is not needed for our purposes)

 

disable this step.png

 

create a new Run Command Line step after the Apply Operating System image step, rename it to xcopy AppsFolderLayout.bin locally

 

in the run command line step use the following xcopy command to copy our previously saved appsfolderlyout.bin file to the default users profile, this will force our start screen changes on all users that login to this computer

 

 

xcopy ".\*.*" "D:\Users\Default\AppData\Local\Microsoft\Windows" /D /E /C /I /Q /H /R /Y /S

beneath this, select our previously created AppsFolderLayout package as shown in the screenshot below

 

xcopy command.png

 

change the options on this step to only run if D:\Windows exists as per the screenshot below

 

windows on d.png

 

copy the entire step, and then replace all references to D:\ to C:\ in that copied step both on the run command line and options tab (we could use variables to do this in one step by using a checkdriveletter.wsf script but that is beyond the scope of this post)

 

if c windows exists.png

 

Basically what the above two steps do is verify which drive (C: or D: has Windows on it, and copies the appsfolderlayout.bin file to the respective drive letter default users profile

 

 

Next edit the built in Enable BitLocker step and add the following wmi query for root\cimv2 so that it won’t run on Virtual Machines otherwise the task sequence will bomb out on hyperV virtual machines…

 

select * from Win32_ComputerSystem where Model <> "Virtual Machine"

 

 

if All the conditions are true.png

 

Tip: if you want to Add drivers for different hardware based on WMI queries then see Step 2 in the following guide.

 

Step 8. Deploy the Task Sequence

Perform the following on the CAS server as SMSadmin

 

Next we want to deploy our Deploy Windows 8 X64  task sequence to our Deploy Windows 8 collection (if you have not yet created that collection do so now, it should be a device collection with no members).

 

We will use the following PowerShell CMDLet: Start-CMTaskSequenceDeployment

 

 

Start-CMTaskSequenceDeployment –Name "Deploy Windows 8 X64" –CollectionName "Deploy Windows 8" –Comment "© windows-noob.com April 2013" –Deploypurpose "Available"

start-cmtasksequencedeployment.png

 

Next, manually edit the deployment so that it points to Media and PXE clients as per the screenshot below (this is necessary otherwise you won’t see the deployment via PXE boot)

 

edit deployment settings.png

 

or use the modified cmdlet in Cumulative Update 1 which does allow for that switch

 

 

Start-CMTaskSequenceDeployment –TaskSequencePackageId "CAS0002F" –CollectionName "Deploy Windows 8" –Comment "© windows-noob.com April 2013" –Deploypurpose "Available" –MakeAvailableTo "ClientsMediaAndPXE"

 

 

Next, add some computers to the Deploy Windows 8 collection using Queries or Direct Membership either manually or using PowerShell via the following cmdlet (Note: SP1 CU1 or later)

 

 

Import-CMComputerInformation –ComputerName = "W82" –MacAddress= "00:11:22:33:44:55" –CollectionName= "Deploy Windows 8"

 

 

Step 9. Deploy Windows 8 to a computer via PXE

Perform the following on a new computer

 

Now everything is in place to allow us to start Deploying Windows 8, so PXE boot a new computer press F12 when prompted

 

PXE boot new computer.png

 

and select the Deploy Windows 8 X64 task sequence

 

Deploy Windows 8 X64.png

 

off it goes… it will download and then apply the previously captured Windows 8 Operating System

 

Applying operating system.png

 

and Windows gets ready

 

getting ready.png

 

before finalizing settings

 

Finalizing your settings.png

 

After that it will Install Updates (if any are targeted towards that collection) and Install your Applications

 

install your applications.png

and the process is complete, login as a testuser and you will see the Start screen customizations which you did in Step 1. have been applied correctly, cool huh ?

job done.png

and any applications you installed in the Deploy Windows 8 X64 task sequence will also be installed

new application installed on desktop.png

That’s it ! until next time, adios !

cheers, niall.

 

Summary

In this part of the series, you’ve learned how to customize the Windows 8 start screen to suit your organizations needs on a  previously captured image, you’ve learned the  steps required to successfully deploy that customized  image and finally you’ve done most of the work using PowerShell Cmdlets (where available). Congratulations !

Recommended Reading:

Posted in ConfigMgr 2012, PowerShell, SP1, Start screen, Step by Step Guide, USMT 5, Windows 8, windows-noob | 2 Comments

When creating a new Task Sequence in Configuration Manager 2012 SP1 the Partition disk step might be hardcoded to 30368MB in size if using a captured image

Introduction

Sometimes things don’t go as planned, when creating a new task sequence to deploy Windows 8 on a New Computer with no partitions I got a catastrophic failure after selecting the Task Sequence. The reason was simple but I wanted to document it.

Problem

In  Configuration Manager 2012 SP1, I created a new Task Sequence to Deploy Windows 8 and it failed on a new computer immediately with the following error logged in SMSTS.log

Partition 1 larger than remaining disk space. Requested partition size: <X>, remaining size: <Value_smaller_than_X> OSDDiskPart
LoadPartitionConfiguration( i, oDisk, cbDiskSize, cbContainerPartitionSize, pCurPartition), HRESULT=8000ffff (e:\nts_sms_fre\sms\client\osdeployment\osddiskpart\main.cpp,751) OSDDiskPart
LoadDiskConfiguration(oDisk), HRESULT=8000ffff (e:\nts_sms_fre\sms\client\osdeployment\osddiskpart\main.cpp,1412) OSDDiskPart
Invalid configuration specified.  Please ensure that the task sequence is properly configured. OSDDiskPart
OSDDiskPart.exe failed: 0x8000ffff OSDDiskPart
Process completed with exit code 2147549183 TSManager
!——————————————————————————————–! TSManager
Failed to run the action: Partition Disk.
Catastrophic failure (Error: 8000FFFF; Source: Windows) TSManager
The execution of the group (Install Operating System) has failed and the execution has been aborted. An action failed.
Operation aborted (Error: 80004004; Source: Windows) TSManager
Failed to run the last action: Partition Disk. Execution of task sequence failed.
Catastrophic failure (Error: 8000FFFF; Source: Windows) TSManager

Long story short, the Primary partition (for the OS) was hard coded to 30368MB in size, see screenshot below and the hard disc in my new computer (a virtual machine) was set to 27GB, and that figure was smaller than the hard coded figure hence the failure !

Solution

To fix this, edit the task sequence and double click on the primary partition that is hard coded to 30368MB. Change that step to use all of the remaining space and apply your changes. Reboot the computer you are trying to image and all should be ok.

Summary

This problem seems to occur only when you use an image with more than one index and you select “All Images” in the Install Windows part of the Task Sequence creation wizard

I believe the source of this 30368MB quoted in the title of this blog post is the expanded size of the captured image being deployed in the task sequence,  as a result the hard coded figure you might see could be a smaller or bigger fixed size in your task sequence, (confirmed from another user)

I hope this helps !

cheers

niall

 

 

Posted in ConfigMgr 2012, Windows 8 | 1 Comment