MSMUG

For this meeting we had Sherry Kissinger come in with a presentation and demo of SRS reporting in Configuration Manager.

We reviewed setup and configuration of SRS, Creating a variety of reports as well as making them visually pleasing. Sherry was able to take audience request and create reports on the fly for us to demonstrate the power of using SRS.

Sherry was kind enough to share her presentation, example reports, and some extra goodies with the group.

We have uploaded a zip file containing all the files.

Download the Zip File here

Our September meeting topic was Patch Management.

We focused on best practices for patch management utilizing System Center Configuration Manager 2012.

The bottom line with Patch Management is that with Configuration Manager 2012 the entire process is MUCH EASIER. There are many new tools and techniques to automate and make patch management more reliable.

We ran through a quick overview and demo of the software updates section of Configuration manager 2012. There is quite of bit of information here and making notes of it here wouldn’t be the most efficient use of space. The following resources should have just about everything you need to get started with patch management using SCCM 2012.

Server and Cloud Blog: Managing Software Updates in Configuration Manager 2012: http://blogs.technet.com/b/server-cloud/archive/2012/02/20/managing-software-updates-in-configuration-manager-2012.aspx

TechNet: Software Updates in Configuration Manager: http://technet.microsoft.com/en-us/library/gg682068.aspx

Book: System Center 2012 Configuration Manager: Mastering the Fundamentals - Agerlund, Kent: Kent Agerlund has a great Configuration Manager book that also has a couple great step by step examples configuring ADR.  http://www.amazon.com/gp/product/B008ZSD8QM  – The Kindle eBook version of this book is only 9.99!

Automatic Deployment Rules (ADR)
One of the best new features in CM 2012 in regards to patch management are the Automatic Deployment Rules (ADR)

This allows you to automate the entire process for selecting,  downloading, applying updates, essentially anything you can do in the console relating to updates you can automate with an ADR.

One examples for an ADR is to have separate rules setup for both your pilot group and deployment patch group. This will allow you to do “One Click” patch deployments.

Probably the best use for ADR is for managing Endpoint Protection Definitions. It was our experience that you should always use an ADR for endpoint protection definitions.  Using an ADR will allow you to keep you endpoint definitions up to date quickly.

Another great trick when configuring an ADR is to use custom severity to easily filter and exclude updates you don’t want.

Alerts
The alerts in CM 2012 are much more useful than some of the “alerts” that were present in CM 07, you can configure alerts on deployments, compliance thresholds, ADR actions, and much more. Take a look at the following links for more info on Alerts:

Technet: Configuring Alerts:  http://technet.microsoft.com/en-us/library/hh427334.aspx

Technet: Operations and Maintenance for Software Updates in Configuration Manager:  http://technet.microsoft.com/en-us/library/gg712304.aspx

Collection Naming
We did have a question about best practices when naming your collections. Because of the new search capabilities in CM 12, when naming collections it is beneficial to use a prefix or suffix. EX: “SU” for Software Updates. This allows you to quickly and easily find your collections using the search function.

Note for using “Folders” in SCCM 2012
Folders in SCCM 2012 are security agnostic so the folders themselves (not the objects within) do not have security rules applied to them. If you have lots of users in the console you may not want to use folders.

New SCCM 2012 OSD feature relating to updates:
One of the new features in CM 2012 relating to patch management and OSD is the ability to inject new patches into your images easily from the console. This should allow you to easily update your reference image with the latest windows updates.

MMS 2013
We talked also abit about what was going on for MMS 2013, since the meeting it was officialily annouced that MMS is coming back to Vegas in April. Be Sure to check out the myITforum website for the MMS2013 guide: http://myitforum.com/myitforumwp/microsoft-management-summit/

This month we had two demos from MSMUG members and had a long open discussion on numerous Microsoft System Center related topics.

Mike Gouldthorp - Avecto Demo

Mike did an overview and demo of Avecto Privilege management.

Notable mentions from the presentation:

• Mike decided to pick the Avecto product because the interface and management capabilities were better than any of the other similar products.
• Good way to research Software usage, as the console will log software activity.  This is a useful supplement to Software Metering.
• It was reported that after 8 months of using the Avecto product, Sub Zero only needed to allow a single user Full Admin rights to his workstation.
• Chris Nackers commented that the only clients I he has seen that that have successfully taken away local admin rights have used the Avecto or Beyondtrust products.

Lee Berg – OSD Demo
Lee discussed some of the front end development required to complete some tricky OSD challenges. Examples included automation of Bios Configuration Settings, Asset Tag Information, Using  a web service to interact with Active Directory during a task sequence, and methods to help enable user self service ScanState and LoadState.

System Center Configuration Manager 2012 Service Pack 1
Chris spent some talk talking about some of the new features coming in Config Manager 2012 SP1. Some of the most notable points we discussed were:

• MAC OSX support (Any intel64 bit)
• Windows 8 Support
• SQL 2012 support
• OSD Improvements
• Provisioning time improved
• TS PXE only mode
• Ability to add CAS at to an existing site
• Powershell Provider
• Windows 8 Metro App Support

The Great CAS debate
We ended up having a conversation about the nessecity of CAS servers.

I made a snarky comment on twitter and actually got a great response from Rod Trent.

Rod linked a MyITForum post from Brian Mason about CAS server considerations. This is defiantly worth checking out, as it sums up most of points of discussion we had regarding CAS servers.  http://myitforum.com/myitforumwp/2012/04/22/cas-considerations-for-cm12/

Coming Up
For our next meeting we will be talking about the best ways to manage Software Updates / Patches. We will have a post and newsletter going out soon with all the details!