The D-Spot (The Deployment Spot)

On the 17th of November the System Center User group (SCUG) will host a free SCCM event.  All details and registration can be found at http://scug.be/content/Events.aspx.

Agenda:

15u30 Registration

16u Opening Keynote by Kenny Buntinx & Alexandre Verkinderen

16u15 Wmi & SCCM autodoc by Kim Oppalfens

17u15 Break and Drink

17u30 Demonstrations of ConfigMgr 2007 R2 addons by Wally Mead

19u30 one hour lunch

20u30 Config Manager vNext overview by Wally Mead

21u30 Q&A and Drink

err… no it’s not a typo ! it’s not a bird, it’s not an aeroplane: it’s Windows 8 !

Even though Windows 7 has just been born, it’s not a secret that Microsoft is already working on its successor, let’s call it Windows 8 for the time being.

It’s too early off course to have official information on this, but what do we know already?

• - release date is somewhere in 2012 ( following a new major Server release )
• - near the end of 2010 the first public beta (including a nearly definitive feature list) should be available
• - stop 32 bit support, but introducing 128 bit support ?
• - thanks to a new API, hibernate/resume will be even more faster than today
• - better multimonitor support ( rumors about three or more monitors are spreading… )
• - changes in network security, authentication and encryption are very probable
• …

to be continued !

Last week we got some good news from Microsoft. I am proud that we are registered as an official preferred Windows 7 partner. As a team we were rewarded for our continuous investigation in new technologies. This is truly a reward for the team. You can find us at http://www.uptimegroup.be/media/html/bands/index.html

We are also listed on the following platform http://www.microsoft.com/belux/technetroadshow/default.aspx.

Windows 7 is the NEW Desktop Operating System around. Recently we hosted an event about “Managing the Dynamic Desktop”. This seminar not only listed many of the new features and functionality that are included in Windows 7 but also answered many deployment questions. Some of them were “how do I know which deployment system is best-suited for my organization?” and “how can I certify this to be my final mass deployment”

 The result can be found here:

http://seminar.the-d-spot.org/Windows 7 Presentation_part1.pdf

http://seminar.the-d-spot.org/Windows 7 Presentation_part2.pdf

BitLocker is around for some years, it was introduced with Windows Vista. This first release of BitLocker could only be installed to the boot partition and was pretty hard to configure. When Vista SP1 came out an updated BitLocker saw daylight.  Non-boot partitions could be encrypted in this version and some other modifications where made.

With the released of Windows 7, Microsoft improved BitLocker a lot! It’s easy to set up and easier to use. Right-click a drive in Windows Explorer and choose “Turn on BitLocker ” to encrypt a drive. This only works when your machine has a Trusted Platform Module (TPM) onboard. As most business laptops has such a chip, I will focus on that. If not, a USB stick can be used to store the encryption key. This USB stick needs to be plugged in the machine at startup.

To enable BitLocker follow this short guide.

On your Windows 7 machine, go to Control Panel, System and Security and choose BitLocker Drive Encryption. Or type “BitLocker” in the search bar and hit Enter.

I choose to apply BitLocker on my C: drive.

These two steps, shrinking drive C: and creating a system partition, weren’t applied because Windows 7 setup did them by default.

You can save your recovery key to a file, or print it out.  This key is used to access your files if a problem with your computer prevents you from access them.

At this point encryption begins.

The whole encryption process took 42 minutes. While encrypting you can use your computer as normal. I even rebooted to see if this breaks the encryption process. After rebooting BitLocker picks up encryption where it was interrupted for the reboot.

As you can see my C: drive is encrypted with BitLocker. I was amazed how Microsoft improved the installation of BitLocker with Windows 7.

Another great thing about BitLocker is that it’s centrally manageable through Group Policy. It allows you to store the Recovery Key and the Recovery Password in Active Directory.

With BitLocker To Go you can encrypt external hard drives and flash disks. BitLocker To Go works completely independently of BitLocker, so you do not need to enable BitLocker on your computer, or utilize any TPM hardware, to use BitLocker To Go. However, it is similar to BitLocker and can also be enabled via a simple right-click Windows Explorer.

My conclusion is that Microsoft improved BitLocker a lot, it’s easier to use and more pleasant to work with. Give it a try yourself!

In an older post on The D Spot we announced MDOP 2009 R2. As of today the product is available for MDOP customers. You can download MDOP 2009 R2 through Microsoft Volume Licensing Site (MVLS).  For others who wish to evaluate MDOP products, the MDOP software is available at MSDN and TechNet (in accordance with your MSDN or TechNet agreements, except for AIS).

If you’re not using MDOP, we recommend you take another look because it can provide immediate savings with little IT investment, especially when integrated into your Windows 7 plans. For example:

• By using Application Virtualization, you can optimize your Windows 7 deployment by reducing PC provisioning time, simplifying application delivery and update, and increasing productivity with user roaming
• You can enhance your Windows 7 manageability by addressing common system/application failures (with DEM), repairing unbootable PCs (with DaRT), and controlling Group Policy change (with AGPM).

Beyond MDOP 2009 R2, the MDOP roadmap includes:

1. Microsoft Enterprise Desktop Virtualization (MED-V) V 1.0 SP1 – This updated tool will support Windows 7 and enable enterprise deployment of virtual Windows XP environments to support incompatible applications. A Beta version of MED-V 1.0 SP1 will be available by the end of 2009 and final release is scheduled for the first quarter of calendar year 2010.
2. Asset Inventory Service (AIS) 2.0 – AIS 2.0 can track your existing assets to improve Windows 7 deployment planning and will have a series of enhancements that customers have requested: Enhanced hardware inventory, new Silverlight-based user interface, scale to 100,000 PCs, improved volume license reconciliation and ability to track virtual applications. The AIS 2.0 beta is now available (registration closes by October 24th) and the final release will be available in H2 CY2010.

Encouraging feedback

Already MDOP has been licensed for over 21 million desktops worldwide and more customers are looking forward to MDOP 2009 R2 and Windows 7! Below are a few quotes from some of our top customers who are seeing real and immediate value with MDOP:

BMW completed a proof of concept of application delivery with Application Virtualization. “We expect cost savings on desktop support once we start deploying App-V with Windows 7,” said Mr. Bernhard Huber, Head of IT Workplace Systems at BMW. “We are also considering AGPM [Advanced Group Policy Management] and MED-V [Enterprise Desktop Virtualization] at a later stage of Windows 7 deployment.”

Heinz Koehler, VP of Infrastructure for E.O.N., Power and Gas Company with 85,000 desktops that are being upgraded to Windows 7, talks about MDOP: “We also expect to use App-V to help reduce the packaging and testing costs of applications and use MED-V to help resolve any application compatibility issues.”

“…MDOP, specifically App-V, has been a hidden gem our customers have found to help them quickly deploy, and then easily manage and maintain their applications in an efficient manner.  In an economy when they are being asked to do more with less, the timing couldn’t have been better for MDOP 2009 R2 to help our clients meet their IT initiatives…,” said Rand Morimoto, President of Convergent Computing.

In addition, Answers Research recently surveyed 1000 IT pros across five countries (commissioned by Microsoft) and we found out that:

• 66% of MDOP customers deployed three or more of the MDOP products
• 52% of them deployed MDOP across more than half of their PCs
• 94% of MDOP customers said they would recommend MDOP to a colleague
• When comparing MDOP and non-MDOP customers, customer satisfaction with Software Assurance increases by 25%

To sum up, MDOP 2009 R2 is available today and it’s there to help you save money and reduce complexity, especially with your Windows 7 deployment.

Source: The Official MDOP Blog and Windows Team Blog.

Most of us consider the use of Task Sequences in SCCM to be meant only for the OSD part of SCCM.

to some extent, they are right !  but, there are more scenarios when this can be used, such as: managing the order how software will be installed and even handling required reboots between those installs.

In the following example, I have described the steps to upgrade from RTM OCS client to OCS R2 client:

- all required packages that will be run in the task sequence must be created first

- prepare a collection to target the advertisement on

- Create a new Task Sequence under the OSD tree (go for the create a new custom task sequence option)

- provide the task sequence with a clear and descriptive name

- open the task sequence editor for the newly created task sequence

- insert as many install software lines into the task sequence as the number of applications that will be installed

TS editor

- for each install software line you have to specify the package and program to be used

- In the Options section where you have to be careful with the continue on error field, you can specify some conditions if you want to do some more advanced manipulation.

- once the editing of the task sequence is complete, you can create an advertisement out of it by simply rightclicking on it.  Most of the options you see will not be new, in the distribution points and interaction part of the wizard you will encounter a few items that you might not have seen already.  Continue on with the advertisement as you would do otherwise.

- Most of the work is done already.  In the advertisements node, you will now see the difference between a standard program and your task sequence based one:

advertisements

Note: on the client itself you will see that the advertisement ID that corresponds to your task sequence will be there a couple of times (in fact once for every program that you entered in it)

I’ve downloaded a VHD file from Microsoft and wanted to boot from it. Just to experiment with the new feature. Here are the surprisingly simple steps to take:

1. Create an extra boot entry (copy from current entry) and give a description, BCDEdit will echo the created identifier:

bcdedit /copy {current} /d "Windows 7 Foundation Suite 3 VHD" 

"The entry was successfully copied to {a20180a3-a426-11de-96df-a3075ebd94a1}.

2. Set VHD to the newly created bootloader entry, with this two commands:

   1: bcdedit /set {a20180a3-a426-11de-96df-a3075ebd94a1} device vhd=[D:]\Images\WDTFS-x64.VHD\WDTFS-x64.VHD 

   2: bcdedit /set {a20180a3-a426-11de-96df-a3075ebd94a1} osdevice vhd=[D:]\Images\WDTFS-x64.VHD\WDTFS-x64.VHD 

3. Force auto detect the Hardware Abstraction Layer (if you’re using a syspreped VHD)

bcdedit /set {a20180a3-a426-11de-96df-a3075ebd94a1} detecthal on

Replace identifier (don’t forget curly braces) and .VHD path (yes, with square brackets round the drive letter) with your own.

4. We’re done! Reboot your machine and you will be presented with a new boot menu.

While deploying my first Windows 7 client with SCCM 2007 R2 SP2 I would receive a failure when the sysprep task would start. However the cause for this error was not due to my sysprep package but my SCCM client package. I had forgotten to create a new SCCM client package to use in my task sequence after installing SP2:

New package from definition -> select “Configuration Manager Client Upgrade”

For those cases when you happened to oversee something during your package testing, it could be very useful if you could group all clients with a specific problem together rather than just exporting them from the advertisement status they are in

Based on that group you could then create a new program to rectify the situation.

to achieve this, paste the following WQL in a new query based rule and modify the advertisementID or status according to your needs:

select SYS.ResourceID,SYS.ResourceType,SYS.Name,SYS.SMSUniqueIdentifier,SYS.ResourceDomainORWorkgroup,SYS.Client from sms_r_system as sys inner join SMS_ClientAdvertisementStatus as offer on sys.ResourceID=offer.ResourceID  WHERE AdvertisementID = ’00120019′ and LastStateName = “Failed”