Just a quick-test of a TFTP server – just to validate if it is responsive…
These commands be run from any client (screenshots are from Win7)
Install the TFTP Client
Run the command in a folder where you have permissions to write in
tftp -1 <servername> GET \boot\x86\wdsnbp.com
If the TFTP-client is not installed the below error message will be received
If it is successfull, you will have downloaded a small file
As a continuation of the previous post on howto setup the Parallels Software Update Point (introduced in Parallels Mac Management for SCCM 4.5) – here comes a minor hack howto enable WSUS for selfsigned certificates and leverage this within Parallels SUP
Enable Selfsigned certificates for WSUS
Set the following registry key
HKLM\Software\Microsoft\Update Services\Server\Setup DWORD: EnableSelfSignedCertificates – 1
Open certmgr.msc where WSUS is installed and export the WSUS selfsigned certificate
Export the WSUS Publishers Self-signed certificate from Trusted publishers to a file. Remember to choose to export the private key…
…and all the extended properties…
… and set a password…
Run some code provided by Parallels to set the certificate you just exported as the signing certificate. Replace CERTFILE and CERTPW
[Reflection.Assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")
$updateServer = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer()
$config = $updateServer.GetConfiguration()
$config.SetSigningCertificate("CERTFILE", "CERTPW")
$config.Save()
Complete the setup wizard. As you already followed all the previous steps.
Regardless of what version of the ConfigMgr agent (2012 –> 1602) you get – there still seems to be a possibility to have left-overs from ConfigMgr 2007.
within the SCClient log-file the following error would be bitcoin casino rtg generated;
Exception Microsoft.SoftwareCenter.Client.Data.WmiException: Provider load failure (Microsoft.SoftwareCenter.Client.SingleInstanceApplication at OnGetException)The following is presented to the user when starting Software Center
Software Center can not be loaded. There is a problem loading the required components for Software Center.
It seems that this is due to a reference no longer in use – the dcmsdk.dll, located under SysWOW64 (on 32-bit systems). Sample output using reg query:
HKEY_LOCAL_MACHINE\Software\Wow6432node\classes\CLSID\{555B0C3E-41BB-4B8A-A8AE-8A9BEE761BDF} (Default) REG_SZ Configmgr Desired Configuration WMI Provider HKEY_LOCAL_MACHINE\Software\Wow6432node\classes\CLSID\{555B0C3E-41BB-4B8A-A8AE-8A9BEE761BDF}\InProcServer32 (Default) REG_SZ C:\WINDOWS\SysWOW64\CCM\dcmsdk.dll End of search: 2 match(es) found.Fix? Delete the registry key – sample command line;
reg delete HKLM\Software\Wow6432node\classes\CLSID\{555B0C3E-41BB-4B8A-A8AE-8A9BEE761BDF} /f
As of Parallels Mac Management 4.5 there are great new features – such as the new role Software Update Point.
The addition of this role is to enable managed updates for the OSX-devices within your environment and it acts as a bridge between the Apple Software Update Server (or the able service) and the Configuration Manager environment which PMM integrates into. All of these products will now integrate in a (sort of) seamless way and PMM can now enable its new role (PMM SUP) to inject updates into Microsoft WSUS, which ConfigMgr then uses to publish content. The Apple SUS is optional and if one is setup you can leverage this to further control updates.
Most of this knowledge is based on the Parallels Mac Management for SCCM (bad acronym right there..) Admin guide
To start using the PMM for SCCM Software Update Point it is required to have a Microsoft WSUS server installed and leveraged for the ConfigMgr environment. Most likely this is already in place if you are already managing updates for Windows-devices.
It is required to configure clients to trust locally published content from WSUS. Complete instructions are available from Microsoft, however a quick way to verify if this is setup is to check the following registry key.
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
AcceptTrustedPublisherCerts – 1
In addition the signing certificate setup for WSUS needs to be trusted by the client.
The PMM for SCCM SUP should be installed on server that has WSUS installed (top server in a hierarchy). Before completing that installation a few things needs to be verified. A service account has to be used and configured for the SUP-role, and this has to be a member of the local administrator-group on the server. In addition the service account has to be a member of the local group WSUS Administrators.
There are three options when choosing what type of source the Apple Updates should be retrieved from. Basis are:
My personal preference is the Apple Software Updates, but incase you want to avoid WAN traffic and potentially more control of updates for your devices the option is a local Apple Software Update Server (or – Local Update Server as stated above). The Apple Software Update Server is part of OSX Server (which can be purchased from Apple Store). Like all other things – this role can be enabled and setup pretty easily. However, it does require an OSX-instance that is running as a server in your environment.
Once the Apple Software Update Server is setup the PMM for SCCM SUP needs to be configured to direct all requests to this server. A simply registry key edit will finalize the configuration.
These items are only requried to change if you want to use the Apple SUS.
Node: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pmm_sup_service\Pa rameters
Server Address: SusCatalogBaseUrl
Port: HttpServerPort.
Server settings update interval: InfoUpdateIntervalSeconds
Catalog check: CatalogRefreshIntervalSeconds
The log-file for any activity is generated in the following log-file;
%Windir%\Logs\pmm\pmm_sup_service.log
ConfigMgr needs to be configured to synchronize the new Apple Updates. First, update Classifications on the synchronizations properties of the ConfigMgr Software Update Point.
In addition the Apple product needs to be selected.
If one is using the public Apple Software Updates there isn’t a need to configure the PMM for SCCM agent as the agent is set to use this source by default. There are three options that can be configured in the following options file:
/Library/Preferences/com.parallels.pma.agent.plist
This matches the previous suggested routes;
0 — Apple Software Update server (default).
1 — Local update server.
2 — Local update server with selected updates.
Set the option :SuCatalogMode to the desired choice in case you need to update it. PMM has realized that their provided Configuration Items are sub-par so in the admin-guide there are script examples (page 134-135) that you can use to create your own Configuration Items.
Within an environment that already has ConfigMgr, WSUS and PMM setup – the addition of PMM for SCCM SUP isn’t a lot of extra work to enable management of OSX Updates.
Despite the Microsoft recommendation, primarily due to additional workload that it causes, to not leverage IP-Ranges we have noticed a far greater significant accuracy of where clients retrieve content from based on our IP-ranges. So yes, we have our boundaries, with few exceptions, setup using IP-ranges.
We also have clients spread around the globe, new networks beeing spun-up, networks that aren’t supposed to be used for servers and clients and much more to actually be used for these type of things. The issue at hand is to understand where clients are actually connecting from, and what locations we know about.
To get some type of insight of where ConfigMgr clients are actually connecting from we started polling our database. In the end – this turned into two SQL-queries that would get all the IP-range boundaries, and a summary of how many clients we support on each network. As lazy as one can be – this ended up gathering enough information to present to other teams to present where clients are connecting from, how many there are and that we don’t previously didn’t know about this location.
To list how many clients you have per a /24-subnet. This may of course not necessarily be the exact size of a subnet, but it allows for an easy count-up of clients.
select SUBSTRING(ip.IPAddress0, 1,
LEN(ip.IPAddress0) - CHARINDEX('.',REVERSE(ip.IPAddress0))) + ".1" As IP,
COUNT(*) as Devices
from v_Network_DATA_Serialized as ip
where ip.IPAddress0 IS NOT NULL and ip.IPSubnet0 != "64"
and ip.DNSDomain0 like "%yourdomain.com"
and ip.TimeStamp > DATEADD(day, -10, GETDATE())
GROUP BY SUBSTRING(ip.IPAddress0, 1, LEN(ip.IPAddress0) - CHARINDEX('.',REVERSE(ip.IPAddress0)))
ORDER BY Devices DESC
A list of all boundaries where we split the start and end IP-address of a specific range
select bound.DisplayName,
SUBSTRING(bound.value,1,CHARINDEX('-',bound.value) -1) AS LEFTHALF,
SUBSTRING(bound.value,CHARINDEX('-',bound.value) +1 ,100) AS RIGHTHALF
from vSMS_Boundary as bound
where bound.BoundaryType = "3"
and bound.DisplayName != "some boundary to exclude"
Information about the clients within a specific range that we do not know about
select DNSHostName0, DNSDomain0, IPAddress0, IPSubnet0, DefaultIPGateway0, DHCPServer0 from v_Network_DATA_Serialized as ip where ip.IPAddress0 IS NOT NULL and ip.IPSubnet0 != '64' and ip.DNSDomain0 like '%yourdomain.com' and ip.TimeStamp > DATEADD(day, -10, GETDATE()) and ip.IPaddress0 like 'XXX.YYY.ZZZ.%'
To join all of this information together some basic, crude, logic was built in powershell to match up networks that clients are in and that we know about. The function to perform the actual IP-range lookup is from stackoverflow-reply. Sample output first:
function IsIpAddressInRange {
param(
[string] $ipAddress,
[string] $fromAddress,
[string] $toAddress
)
$ip = [system.net.ipaddress]::Parse($ipAddress).GetAddressBytes()
[array]::Reverse($ip)
$ip = [system.BitConverter]::ToUInt32($ip, 0)
$from = [system.net.ipaddress]::Parse($fromAddress).GetAddressBytes()
[array]::Reverse($from)
$from = [system.BitConverter]::ToUInt32($from, 0)
$to = [system.net.ipaddress]::Parse($toAddress).GetAddressBytes()
[array]::Reverse($to)
$to = [system.BitConverter]::ToUInt32($to, 0)
$from -le $ip -and $ip -le $to
}
$ErrorActionPreference = "silentlycontinue"
$database = "ConfigMgrServer"
$datasource = "ConfigMgrDB"
$netquery = "select SUBSTRING(ip.IPAddress0, 1, LEN(ip.IPAddress0) - CHARINDEX('.',REVERSE(ip.IPAddress0))) + '.1' As IP, COUNT(*) as Devices from v_Network_DATA_Serialized as ip where ip.IPAddress0 IS NOT NULL and ip.IPSubnet0 != '64' and ip.DNSDomain0 like '%yourdomain.com' and ip.TimeStamp > DATEADD(day, -10, GETDATE()) GROUP BY SUBSTRING(ip.IPAddress0, 1, LEN(ip.IPAddress0) - CHARINDEX('.',REVERSE(ip.IPAddress0))) ORDER BY Devices DESC"
$networks= Invoke-Sqlcmd -Query $netquery -server $datasource -Database $database
$query = "select bound.DisplayName, SUBSTRING(bound.value,1,CHARINDEX('-',bound.value) -1) AS LEFTHALF,SUBSTRING(bound.value,CHARINDEX('-',bound.value) +1 ,100) AS RIGHTHALF from vSMS_Boundary as bound where bound.BoundaryType = '3' and bound.DisplayName != 'exclusion boundary'"
$iprange = Invoke-Sqlcmd -Query $query -server $datasource -Database $database
foreach ($net in $networks) {
if (!($net.ip -eq '192.168.1.1')) {
$i = 0
$J = $iprange.count
$boundaryfound = $false
do {
if (IsIpAddressInRange $net.ip $iprange[$i].LEFTHALF $iprange[$i].RIGHTHALF)
{
$boundaryfound = $true
}
$i++
} until ($i -gt $j)
if ($boundaryfound -eq $false)
{
write-host "Network: $($net.ip) - Devices: $($net.Devices)"
#$($($net.ip) -replace ".$")
$devquery = "select DNSHostName0,DNSDomain0,IPAddress0,IPSubnet0,DefaultIPGateway0,DHCPServer0 from v_Network_DATA_Serialized as ip
where ip.IPAddress0 IS NOT NULL
and ip.IPSubnet0 != '64'
and ip.DNSDomain0 like '%yourdomain.com'
and ip.TimeStamp > DATEADD(day, -10, GETDATE())
and ip.IPaddress0 like '$($($net.ip) -replace ".$")%'"
$devices= Invoke-Sqlcmd -Query $devquery -server $datasource -Database $database
$devices
}
}
}
ConfigMgr offers limited support to manage an OSX-device, however you can extend the capabilities using third-party tooling such as Parallels Mac Management for SCCM.
Parallels Mac Management for SCCM primarily offers something similar to Software Center – namely an interface called Parallels Application Portal that will allow available applications (not the classic package) to be installed or removed through a user interface. Unlike the Windows-applications and their respective deployment types for an application the ability to configure the deployment is rather peculiar.
You will need access to an instance of OSX where you can generate the package. As previously described on howto deploy Symantec Endpoint Protection there is a small tool to generate a ConfigMgr compatible package from various different formats available for OSX to install applications.
Once the package is generated it will contain the binary pieces of the application, aswell as a basic command-line to install the application and (optional, but enabled by default) a detection method to verify that the application is installed.
Most likely the command-line will look something like this
/usr/sbin/installer -pkg "Parallels Desktop.pkg" -target "/" –verboseR
As Parallels Mac Management for SCCM has the ability to also uninstall applications there is a need to specify the command-line for actually removing the application. Using the “:” you can provide the two commands on the same command-line.
Uninstall command-line (more about rm on Mac Developer Library)
rm -rf "/Applications/Parallels Desktop.app"
Combined command-line (notice the : at the start, the middle and the end of the command-line):
:/usr/sbin/installer -pkg "Parallels Desktop.pkg" -target "/" -verboseR:rm -rf "/Applications/Parallels Desktop.app":
Detection Method will be determined by default (you will need to specify the –c option to avoid having it generated within the ConfigMgr package) when a package is created.
The Package ID can be reviewed within OSX using the pkgutil.
Sample command-line to review if a package is installed or not within OSX
$ pkgutil --pkg-info com.parallels.package
Sample output
$ pkgutil --pkg-info com.apple.pkg.BaseSystem package-id: com.apple.pkg.BaseSystem version: 10.6.0.1.1.1249367152 volume: / location: / install-time: 1306707387 groups: com.apple.snowleopard-repair-permissions.pkg-group com.apple.FindSystemFiles.pkg-group $ date -r 1306707387 Sun May 29 15:16:27 PDT 2011
As you can see we request information if a specific package is installed. To list all packages on a volume you can use the following command
$ pkgutil --packages –volume /
During the uninstall command we technically only remove the application, however the information which we base the detection on is left behind. To remove the package information the following command-line can be used
$ pkgutil --forget com.parallels.package
Using && (and) we can combine our multiple commands for uninstall – both removing the Parallels Desktop.app and the package information.
:/usr/sbin/installer -pkg "Parallels Desktop.pkg" -target "/" -verboseR:rm -rf "/Applications/Parallels Desktop.app" && pkgutil --forget com.parallels.package:
Unlike the Windows-applications where the install / uninstall scenario are split into two separate command-lines there is a single-command line to handle for OSX. One needs to be familiar with OSX tools to manage applications and the terminal capabilities to successfully manage a successful installation and uninstall of an application.
After going down a rabbit hole attempting to understand the process of why ConfigMgr clients fail. Fail to install, fail to keep themselves running, failure to repair themselves – there has been a realization that a lot of people have spent an insane amount of time doing the same thing. Oddly enough, very few people seem to understand the implications of doing things one way or another.
Hopefully this can be a summary post that will detail the implications of choosing different paths when installing the ConfigMgr client.
There is an extensive documentation of what the technical requirements are of the platform you intend to install the ConfigMgr client on. Most likely this will not be any major issue as the majority of these will be fulfilled on any supported platform and if they are not available prerequisite will be installed as part of the very stable CCMSetup.exe.
ConfigMgr setup (called ccmsetup.exe) is a wrapper executable that will leverage the contents of ccmsetup.cab. The .CAB-file contains a XML file that will detail all prerequisite checks that should be performed on a client and attempt to verify that they are installed, and if not download them (from a source-repository defined in many ways – if none is specified the folder which ccmsetup is started from will be the source) and install them.
Can this cause issues? Yes. If the folder where ccmsetup.exe is called from does not contain the prerequisites specified in ccmsetup.cab so they actually can’t be downloaded or the alternative source-folders specified doesn’t contain them the installation will fail. Or worse, if the requirements are invalid this will also cause issues. An invalid hash for SCEPInstall.exe was the culprit of an update released by Microsoft or the publically acknowledged MicrosoftPolicyPlatformSetup.msi invalid signature has also been the cause of headaches.
So lets clarify;
Don’t remove things from the ConfigMgr client source-folder.
When ccmsetup.exe is started it is a non-interactive process which only allows anyone to review the progress by reading log-files. For the impatient that hopes to have a progress-bar running – there is none. (log files located in c:\windows\ccmsetup\logs)
CCMSetup.exe has some intelligence to avoid have someone firing of the non-interactive process and fail to properly install the ConfigMgr client. It uses the Active Directory (in multiple ways) to identify most of the settings that are required, however of course there are many optional and beneficial options.
There is a small rule when it comes to passing parameters to ccmsetup.exe
Parameters that start with a / is dedicated for the ccmsetup.exe-wrapper itself, whereas the parameters without (and usually written in capital letters) are dedicated for the MSI and used by the installation process. Parameters meant for the ccmsetup.exe (with /) should be written first and before all parameters meant for the client MSI.
So, the client will do the following to identify how it should be installed:
Parse commandline
Ccmsetup command line: "C:\WINDOWS\ccmsetup\ccmsetup.exe" /runservice "SMSCONFIGSOURCE=P" "smssitecode=P01"
Command line parameters for ccmsetup have been specified. No registry lookup for command line parameters is required.
Query Active Directory
Performing AD query: '(&(ObjectCategory=mSSMSManagementPoint)(mSSMSDefaultMP=TRUE)(mSSMSSiteCode=P01))'
Parameters published within Active Directory is defined from the ConfigMgr environment when modifying the Site-settings
So, as long as you have a fairly uncomplex environment of ConfigMgr the installation of the ConfigMgr client will be simple and you can pass the installation files to anyone without a lot of instructions. Just double-click this file (ccmsetup.exe) and the settings will be retrieved from Active Directory, at minimum.
If there are multiple offices and perhaps even some limited bandwidth scenarios with high-latency a quick question comes to mind – how can we optimize this?
As previously noted the most common scenario is that the client itself and the prerequisites will download themselves from the folder they were started into a local-cache folder named ccmsetup. Technically, the ccmsetup will just perform enough actions to get this download started and then handover to the local process that will continue to download the of remaining prerequisites and client-files as illustrated by the log-file.
Once the local file exists (along with ccmsetup.cab) the real (now local) installation-process will continue the installation. This will continue to download the remaining bits and pieces from either the source-folder or an alternative source-folder:
There can be multiple source-folders specified and before it attempts to use one the ccmsetup.exe will verify that the source-folder can be reached – if not it will invalidate it.
Technically, the commandline can look like this
ccmsetup.exe /source:\\validfileshare\client<em> </em>/source:<em>\\invalidfileshare\client </em>/source:<em>\\validfileshare2\client
The folder used will be based on availability (must be reachable) and the order in which they were listed. There is no intelligence that calculates latency or bandwidth, the only check performed is if the files are reachable. However, if you want that to be used you can leverage the ConfigMgr infrastructure using the property /mp.
/mp:<em><Computer>
MP stands for Management Point and this specific property will only define what Management Point CCMSETUP will contact to retrieve the client source-files. The property will not be used by the ConfigMgr client itself (you can use a different property for this). The Management Point will leverage the ConfigMgr package created during its setup (called Configuration Manager Client Package) and all of the ConfigMgr infrastructure. Based on the boundaries defined and what Distribution Point will serve those boundaries it will download the package from the best local (read Fast boundary) Distribution Point, and if none are available it will fallback to a remote one (read slow).
Sample review of the earlier stages of an CCMSetup running where it is contacting the Management Point for content download.
The download from a Distribution Point will leverage BITS and the priority of that download can be specified using the BITS priority property.
/BITSPriority:<em><Priority>
ConfigMgr is a living product and therefore there are lots of released updates for it. ConfigMgr 2007 had a set of specific solutions (hotfixes) released that included updates to the client and every once in a while these were gathered up in a Service Pack or Release Pack (SP or R) which provided a brand new MSI-file.ConfigMgr 2012 still has the concept of Service Pack and Release Pack, however very few hotfixes have been released in between these releases and instead they are release in cumulative packs that will provide a new MSP-file with all the fixes from backwards.
Great improvement that ConfigMgr 2012 has a single Microsoft Patch to be installed. Of course there is a desire to ensure that the clients receives these fixes as soon as possible and if possible to ensure that at installation-time the patch is applied. This is especially important during Operating System Deployment as the fixes may resolve issues during the Operating System Deployment process.
Patches introduces the first challenge when it comes to ensuring that a client will install properly.
Microsoft has recommended the approach of using the generic Windows Installer-property PATCH. This has been around as a recommended method since SMS 2003, and continue to be the official recommended way forward.
There are a few caveats to using the PATCH property and that is namely the limitation of referencing any type of file there.
File path has to be an absolute path and no variables can be used when the command-line is parsed by Windows Installer. If the file referenced does not have the extension MSP it will be ignored. In essence: You have to write the specific path where the file is located in plain old english (or.. well..)
Microsoft has therefore provided great blog-articles (no technet-article as the property is a generic Windows Installer property) on howto leverage this for the published Client Installer Properties and multiple ways of using this property during the Operating System Deployment process.
Applying a ConfigMgr Hotfix During the Client Installation of an OS Deployment
Patch ConfigMgr 2012 x86 and x64 clients during a task sequence using the PATCH property
There is one key take away that is worth noting and that is the fact that using the PATCH property will install all the bits of the new patch during the initial installation of the client and once the installation is completed the client will be at the latest build of the client. If applying the patch post-installation it is required to restart the ConfigMgr client (we want to release any locks to a file) before we have actually applied the update.
Primary concept here are based into a few parts that will provide us with a few different ways of populating the PATCH property depending on when and how we install the MSP.
When using the published installer properties (used for client push scenarios, manually triggered installs without any overriding options) we will reference the patch using a UNC-path. The UNC-path can reference any file-share that the computer account has access to. Sample PATCH-property
PATCH=\\Siteserver\SMS_CNT\client\x64\hotfix\KB2905002\Configmgr2012ac-r2-kb2905002-x64.msp
Using a UNC-path of course is a hard-coded reference to a specific file-share (and using DFS you can of course offer some abstraction here), however there is a concern to be raised with this method.
Referencing a UNC-path would of course require that the client has access to the MSP-file on the occasion that a future repair would happen or during the installation. If the file would not be reachable (move, network disconnect, permissions improperly configured) the installer with exit with the generic exit code of 1635. Even worse though is the complete failure of the installation due to a high-latency / low bandwidth scenario where the file-copy operation just fails. Sample error code in such a scenario:
MSI: Action 1:44:18: InstallFiles. Copying new files ccmsetup 2015-08-02 01:44:18 8560 (0x2170) MSI: Internal Error 2902. ixfAssemblyCopy ccmsetup 2015-08-02 01:44:20 8560 (0x2170) MSI: Action 1:44:21: Rollback. Rolling back action: ccmsetup 2015-08-02 01:44:21 8560 (0x2170)
During OSD there seems to be two ways to reference the patches. The previous (circa 2007 and a bit of the life-span of 2012 in) way was to reference the patches in their respective packages when downloaded by ConfigMgr during the OSD-process. A sample path has been expressed in the first article. The PATCH would reference a folder, temporarily, created by a specific package and could install the patch with local access.
PATCH="C:\_SMSTaskSequence\OSD\XXX00002\x64\hotfix\KB2905002\Configmgr2012ac-r2-kb2905002-x64.msp"
During later articles there is a new recommended method of running a pre-step to copy the file into a local-folder (c:\windows\temp anyone?) and then referencing this folder instead
PATCH=C:\windows\temp\SCCMHotfix\configmgr2012ac-r2-kb2910552.msp
Briefly looking over these methods we have a few things worth noting;
1. We do not have the ability to leverage a single way of referencing these patches if we were to follow Microsoft practices. UNC-paths for one method and a local-copy for a different method?
2. We can not leverage the ConfigMgr infrastructure when downloading patches since we are forced to reference them using a hardcoded path during a manual install / push-scenario
3. Patch installation from a UNC-path may be high-risk as any loss of network connectivity or if the connection is less than perfect may result in a complete failure of the client install. Preferred method (which is most likely this is the new recommended approach for OSD) would be to download a copy to the local harddrive on the client.
4. There is no dynamic way of placing the patches in a single location and have the ConfigMgr client automatically apply them. We have a hardcoded reference to the patch location, and in addition we also have a hardcoded reference to what patch we are deploying.
Now, remember all these cons as more will be remarked later.
Since SMS 2003 there has been some legacy code that will allow the CCMSetup to detect a specific folder, download any patches located in this folder and then post installation also install the patches.
The folder is called ClientPatch (surprise!) and should be created in each architecture directory.
Once the installation is started and detects that this folder is located in the source-folder it is currently using it will download the file
After the installation of client.msi is completed it will continue to install any downloaded MSP-files.
This method is unsupported and there is no testing performed by the ConfigMgr team if any changes they make will potentially cause any future issues. There is a lot of public ‘it works without issues’ and some people saying ‘we have identified issues’.
People outside of Microsoft claims that it´operates without issues.
SCCM 2012 Client Push – Including hotfixes / CU patches in Client Push
ClientPatch folder method for including client updates – supported?
Change in how to apply Patch with SCCM Client push
Issues that have been identified relate to specific properties not beeing parsed properly is using this approach as the installation order is to setup the client, and then after the client is installed it will automatically install the patch. As the patch installation must stop all services (think ConfigMgr agent, but also the Task Sequence service) to release any locks to files that it wants to update the loss of properties seems harmless (and yet also a logical side-effect) in comparison.
As you might guess; Stopping the Task Sequence service during Operating System Deployment is a high-risk undertaking.
Configuration Manager has introduced several mechanisms to ensure a ConfigMgr client stays healthy. One part of this, which has been remarked early on, is the CCMEval scheduled task.
The CCMEval performs two tasks namely to identify (task one) and remediate (task two) unhealthy clients. The name is a give-away. There is an option to configure it to only perform the first (either through a property at install-time or as a post-configuration task) which of course will only notify you as an administrator through the ConfigMgr console. And by notify we mean that you have to actively dig out the information under Monitoring –> Client Status.
CCMEval’s doings (or undoings) can be identified through the log-file named ccmsetup-ccmeval.log located in C:\Windows\ccmsetup\Logs.
Lets run through its doings when performing a health check to identify a unhealthy client
First we can see that it triggers the ccmsetup with the parameter /evaluate and focusing only on prerequisites. Most likely this will identify that all necessary prerequisites are installed, available for installation if they are missing and if not it should trigger an installation of the missing prerequisites.
As you can see it remembers the command-line we used for installing the client. A validation will also happen (just like it does during install-time) that source-folders are validated.
The previously used command-line for installation is saved away in the registry. As far as the investigation goes this little vital component is saved in the below registry-key.
Once it has validated the source the client knows about (remember; working folder, /source and /mp are valid options to specify this during the initial installation) it will start to digest the information that it knowns about the prerequisites. Just as the initial installation it will extract the XML-file (now using the local-copy) from ccmsetup.cab and then proceed to ensure what prerequisites are applicable, available and installed.
Once the prerequisites had their run there is an secondary run that will validate the client itself
The result of this (and what checks are performed to ensure that a healthy ConfigMgr client is on the machine) is logged in a secondary file located in C:\Windows\CCM\Logs and its named (surprise!) ccmeval.log
The above portion will only identify the current state of a client and if configured as such – the CCMeval will stop at the above part and inform (notify) the ConfigMgr hierarchy that this is the case. By default it is also enabled to remediate a client which is considered unhealthy.
One of the more harmless remediation is to just start the CCMExec-service. Fairly easy right? Serivce not running? Start it.
One of the more challenging remediation is to reinstall either the prerequisites or even the client in itself.
Wait. What? why would this be a challenge? Lets play out two potential scenarios that are very likely to happen if following some articles that have been posted above.
You followed the suggestion to ensure that the ConfigMgr 2012 hotfixes are installed during the Task Sequence that deploy the operating system using the package that contains the ConfigMgr Client. A sample PATCH-property would be seen like this:
PATCH="C:\_SMSTaskSequence\OSD\XXX00002\x64\hotfix\KB2905002\Configmgr2012ac-r2-kb2905002-x64.msp"
As this is a temporary location for storing packages only during the Task Sequence execution once a Task Sequence has completed the folder is removed.
If the client were to become faulty due to <insert any reason> a repair would be attempted using the initial command-line as found in the registry (HKLM\Software\Microsoft\CCMSetup) such as this
"/runservice" "/source:\\fileshare\validsource" "SMSCONFIGSOURCE=P" "smssitecode=P01" "FSP=fsp.domain.com" "PATCH="C:\_SMSTaskSequence\OSD\XXX00002\x64\hotfix\KB2905002\Configmgr2012ac-r2-kb2905002-x64.msp" "
However, this installation will fail with a generic error code of 1635 due to the installer being unable to locate the previously temporary folder. The patch is no longer in the above location.
During a client push scenario we have published the UNC-path where our patch-files are located on a file-share within our environment. This could be on the site-server, a DFS-root or somewhere else.
Sample property
PATCH=\\Siteserver\SMS_CNT\client\x64\hotfix\KB2905002\Configmgr2012ac-r2-kb2905002-x64.msp
There are two potential concerns that may cause harm here if a repair ever were to be triggered. If an admin was haggled to cleanup, save disk space or perform any similar action a year later a scenario will arise where the patch is not available. Perhaps some a new way of distributing the hotfix was discovered and it was decided to cleanup old file-shares. Well, if the above patch was no longer available at the above location all future repairs would halt with a generic 1635 error.
The other concern raised is if the file is still available however the client is constrained by high latency. Perhaps some packet drops. Well, perhaps the connection might be congested with Channel9 video streams. During the patch file-copy part the following error is very likely to happen
MSI: Action 1:44:18: InstallFiles. Copying new files ccmsetup 2015-08-02 01:44:18 8560 (0x2170) MSI: Internal Error 2902. ixfAssemblyCopy ccmsetup 2015-08-02 01:44:20 8560 (0x2170) MSI: Action 1:44:21: Rollback. Rolling back action: ccmsetup 2015-08-02 01:44:21 8560 (0x2170)
In the two above scenarios we will end-up with a completely unhealthy ConfigMgr client.
This is why a suggestion has been created to combine the PATCH property method of installing patches and the ClientPatch-concept into a single new way forward of deploying patches.
Go vote!
This will most likely need to be tested for each version of a potential App-V 5 upgrade, but lets clarify the issue.
When upgrading the App-V 5 client there are some nasty behaviors that cause grievances among users. Since App-V 5 is a middle-man there has been a personal hope that Microsoft would have addressed the upgrade path to offer the same seamless and smooth experience that for example Internet Explorer, Office or general Windows components offers.
What’s the issue?
The impact of running the App-V 5 version new upgrade when a user is active on the machine is rather frightening and will decrease the end-user productive. Terminating active virtual applications would stop most change management, but halting productivity until a reboot is of course a deal-breaker.
Depending on your scenario this issue might be able to workaround using processes alone, however in a road-warrior type of world where devices are laptops and either used or offline the ability to control the upgrade path to minimize user friction is of course limited.
Since two thirds of the worlds corporate Windows client estate is managed by Configuration Manager there are certain abilities to ensure that something is not installed while a user is active on the client. The client would become aware of what needs to be executed, download the necessary files and then would not start the install until the following condition is met;
The issue that still stands is that even though the new App-V 5 version new is installed the user can not start the virtual applications (or interact with the client) until the device is restarted.
It seems that the to avoid a scenario where the device drivers loaded into the system should not be different than service running the upgrade will stop the service. There may of course be issues, however running with this version difference (services vs drivers) within a limited time frame is a minor risk if it allows a gradual upgrade path and setting a new standard baseline for the App-V 5 client version
So, run the App-V 5 upgrade;
appv_client_setup.exe /ACCEPTEULA /CEIPOPTIN=0 /MUOPTIN=0 /ENABLEPACKAGESCRIPTS=1 /AUTOLOAD=0 /q /norestart
Start the App-V 5 client service:
net start appvclient
The user can then restart in their own time and hopefully everything should be running without any major hiccups. Obviously – this is very unsupported.
After creating a package of Adobe Captivate 8, validating that it runs as expected in a standalone scenario an obstacle come up during the import-process into the App-V 5 Deployment Type into System Center Configuration Manager 2012 R2.
Error code was very generic and only gave a vague reference:
Object reference not set to an instance of an object
Reviewing the activity with Process Monitor only revealed that the before the error occurred the appv-file was parsed. Obviously something within the file itself was generating this error.
No other application spawned the same behaviour, and regardless of how the application was sequenced (different OS, sequencer PVAD etc) the same error always came back.
Based on Microsoft supports reply it seemed to boil down to the fact that a package contained two files with the same name: AppXManifest.xml
The installer for Adobe Captivate generated this file in the following folder;
ProgramfilesCommonX64\Adobe\Adobe Captivate 8 app Packager\assets\AppxManifest.xml
The second file is the generic AppXManifest.xml generated by the sequencer that contains information of howto publish the application.
Workaround: Delete the second instance (not App-V 5 sequencer generated) copy of the file.
While troubleshooting the failure of the ConfigMgr 2012 R2 Client to install on a generic Windows 7 x64 installation on a machine we spent numerous hours digesting the following error code that refused the completion of the installation in the CCMSETUP.log file
Failed extract manifest file from cab file 'C:\WINDOWS\ccmsetup\ccmsetup.cab'. Error 0x80070008. File may be corrupt.
In the end it seemed that the inkling that the ccmsetup.cab was corrupted was false (surprise!), however the client did have issues extracting the manifest from it and so the installation halted.
Looking up the error code a generic answer is given:
Not enough storage is available to process this command. Source: Windows
The error code immediately leads to a KB-article by Microsoft (and written in similiar style by many other vendors and bloggers) that would hint towards manipulating the IRPStackSize registry key for older (Windows 2000..) versions of Windows to resolve the issue. Unfortunately Windows 7 will not be so easily tamed.
After reviewing the Process Monitor logs one idea came that it utilized the CABINET.DLL in C:\Windows\System32 to extract the information. Review the details tab revealed this;
A client without the issues gave us these properties:
Most likely a execution of SFC /SCANNOW might have resolved the issue, however since we knew the file we were interested in it was simply replaced with a known working version from a different machine.