My Blog

Monday, August 4, 2008

SCCM 2007 Fallback Status Point (FSP)

Function

The Fallback Status Point is a new Site System role in Configmgr 2007 that serves 2 purposes.
The initial goal of the Fallback Status Point is to serve as a contact point for Configmgr 2007 clients in native security mode that cannot contact their Management Point because of certificate problems. As we will see in Chapter X “Security and Network Access Protection” native mode requires https and client certificates for communication with the Management Point, Distribution Point, Software Update Point and the State Migration Point. This certificate requirement opens up a potential issue where a client’s certificate gets damaged, deleted or corrupted in one way or another essentially orphaning the client from the Configmgr 2007 infrastructure. The Fallback Status Point can be the lifeline for those clients as it will accept S.O.S. state messages from clients that need administrative assistance to get back in working order.
The second purpose of the Fallback Status Point is to allow for monitoring the state of a client rollout from a central location, based on a bunch of Configmgr 2007 reports. Historically the previous versions of SMS used to have a blind spot during the client rollout. System administrators could analyze some individual logs at the client side but didn’t have a full view of the entire installation process from a central location. This made follow-up during the client rollout stage of an SMS project fairly labor intensive for these sysadmins. This lack of central view made it difficult to detect clients that for instance started, and potentially completed the installation but that did not get assigned to an SMS Site. The Fallback Status Point helps system administrators in a Configmgr 2007 environment to avoid these problems. Configmgr 2007 clients send state messages to their Fallback Status Point after successful deployment another one after successful Site assignment, giving you a detailed overview of your client rollout. This functionality obviously assumes that the client knows where to find his Fallback Status Point.
A Configmgr 2007 client can find the Fallback Status Point by querying Active Directory or because a specific Fallback Status Point was defined during the installation.
As you might have concluded by reading the function description of the Fallback Status Point this is not a mandatory Site System role. Although this role is not really required, it is strongly advised to install one, and depending on your setup the necessity for one might be greater than for other setups. If you plan to use Internet Based Client Management or plan to use Native Security Mode than having a Fallback Status Point is not a luxury.

Type of network traffic

Because Fallback Status Points serve, amongst other things, as the lifeline for clients with certificate problems, and are most notorious for their function in an internet based scenario, it should come as no surprise that the communication protocol of choice is http.

Scalability & Availability

Another interesting question is the placement of your Fallback Status Point(s). There are two approaches to this. The first one is to just put a Fallback Status Point in your Central Site at the top of your hierarchy. Given the fact that the amount of network traffic to the Fallback Status Point is fairly limited, and mainly happens during the initial client rollout, this approach is one approach that should work pretty well in most environments. Another approach that is worthwhile to investigate is to put Fallback Status Points in accordance with your administrative model. In other words, put a Fallback Status Point in every location where you have administrative personnel that will follow-up on client rollout and client health. This makes it easy for Site Administrators to keep an eye on their own environment’s client health and rollout.
Note: The Fallback Status Point cannot be installed on a system that already has a Site System role installed that requires https for its communication protocol.

The above note might influence your Fallback Status Point decision quite a bit. This obviously only impacts sites that operate in Native Security Mode, but you might still want to consider it in your designs to minimize the impact of security mode upgrades in the future. The reason that they cannot be co-located is that Configmgr 2007 installs all Site System roles in the same website. Configmgr 2007 has the option of installing in a different website than the default website, but this is a site wide setting, meaning that all Site Systems would then install their websites in this new “SMSWEB” website, which doesn’t solve our http/https problem. Although you could have separate virtual directories with different http/https settings this is generally not accepted as a good security practice. Conclusion, the Fallback Status Point is generally best installed on a machine separate from the Management Point, Software Update Point or Distribution Point which might increase the cost of having the Fallback Status Point locations based on your administrative model.

Security

Because the Fallback Status Point is most important in internet based client management, and is most likely to be installed in a demilitarized zone, it deserves some extra security attention. The Fallback Status Point is the only Site System in Native Security mode that allows anonymous http connections to be mode. Although all other Site Systems are fairly well-protected using https and by requiring mutual authentication based on client certificates, the Fallback Status Point, because of its function cannot have these stringent security requirements in place. This leaves the Fallback Status Point open for attack.

To mitigate the impact of any potential attack Configmgr 2007 has implemented two ways of mitigation. The first one was covered in the configuration section, this is the throttling of the amount of messages you are willing to accept for this Fallback Status Point. The default settings are rather loose, but you could easily trim these numbers down to something that is more in accordance with your environment. The second way of mitigating the impact of an attack on your Fallback Status Point is to make sure that the firewall blocks all traffic from the Fallback Status Point to the intranet. By configuring the option Allow only site server initiated data transfers from this site system as explained in the adding a Site System section, you can make sure that the Fallback Status Point operates in a pull-only mode. So even if the Fallback Status Point would rollover during an attack it cannot be used as a jumphost to attack the rest of the Configmgr 2007 infrastructure. With these two security precautions configured the Fallback Status Point becomes an uninteresting target for most hackers.

Microsoft System Center Configuration Manager 2007 On-Demand Webcasts

SCCM 2007 Resources

SCCM 2007 Resources

Sccm 2007 Toolkit
The new Configuration Manager 2007 toolkit is live. The toolkit comes with the following tools:

Client Spy - A tool to help troubleshoot issues related to software distribution, inventory, and software metering on Configuration Manager 2007 clients.

"This is the Advanced client spy you might now from the sms 2003 toolkit 2"
Policy Spy - A policy viewer to help review and troubleshoot the policy system on Configuration Manager 2007 clients.

"Policy spy is again a tool that was already available in the sms 2003 toolkit 2. It allows you to take a look at the content of the policies that a client has received. This is a GREAT troubleshooting resource, and a terrific tool if you want to do Sccm 2007 deep dives.
Trace32 - A log viewer that provides a way to easily view and monitor log files created and updated by Configuration Manager 2007 clients and servers. "The Sccm 2007 log viewer, and don't let anyone tell you otherwise! This beautiful gem make those Configuration manager logs really readable. Apart from making the logs more readable it also comes with an error lookup tool built-in that lets you convert error numbers to readable error messages. This error lookup tool accepts win32 errors in Decimal and hexadecimal (-2147024891 or 80070005) and Network error messages (53).
Security Configuration Wizard Template for Configuration Manager 2007 - An attack-surface reduction tool for the Microsoft Windows Server 2003 operating system with Service Pack 1 and Service Pack 2 (SP1 and SP2) that determines the minimum functionality required for a server's role or roles, and disables functionality that is not required.
"The template to lock your SCCM 2007 site systems air-tight"

DCM Model Verification - A tool used by desired configuration management content administrators for the validation and testing of configuration items and baselines authored externally from the Configuration Manager console. "DCM authoring assistant, I'll do a separate blog post on DCM in the near future, it wasn't my favorite feature in Sms 2003, were it was a feature-pack, and I wasn't too thrilled with it becoming an integral part of the product. After some recent new things I learnt about it though, I guess I will have to change my mind.

DCM Digest Conversion - A tool used by desired configuration management content administrators to convert existing SMS 2003 Desired Configuration Management Solution templates to Desired Configuration Management 2007 configuration items.
"For the few brave souls out their that decided to get their hands dirty using the Dcm feature pack for Sms 2003"

DCM Substitution Variables - A tool used by desired configuration management content administrators for authoring desired configuration management configuration items that use chained setting and object discovery.
"You know what, I don't know enough about DCM to understand what this does"

http://www.microsoft.com/downloads/details.aspx?FamilyID=948e477e-fd3b-4a09-9015-141683c7ad5f&DisplayLang=en

Configuration Packs
As mentioned in the description of the toolkit, I will do another post on DCM, but below you will find some configuration packs to use with DCM in Sccm 2007.
http://www.microsoft.com/technet/prodtechnol/scp/configmgr07.aspx

Microsoft Deployment
Microsoft Deployment has been released as well, this is the successor to the Business desktop deployment accelerator. A lot of the functionality that BDD had, was directly rolled into Sccm 2007. The main reason to use Microsoft Deployment in combination with Configuration manager 2007 according to me is the support for unknown "bare metal" computers, and potentially the dynamic selection of the userstate store depending on statesize, and available local storage. And a more flexible way to slip-stream package installs after the image has been deployed.
Download details- Microsoft Deployment
SCCM 2007 Documentation
The Configuration manager 2007 technical library has been updated with new content.
http://technet.microsoft.com/en-us/library/bb892811.aspx
SCCM 2007 Webcasts
There is a great bunch of Configuration Manager webcast available, and quite a few new ones are planned for the near future.
http://www.microsoft.com/events/series/technetmms.aspx?tab=webcasts&id=42364#42364
SCCM 2007 Virtual Lab(s)
We only have one Configuration Manager Virtual lab available for now, but I assume several new ones will be added over the next couple of months.
http://www.microsoft.com/events/series/technetmms.aspx?tab=virtuallabs

custom Configmgr 2007 admin console

Building a custom Configmgr 2007 admin console
The work that needs to be done in the Configuration manager 2007 admin console is often spread out amongst different team members. Not all of these team members require access to the full admin console. Most environments do configure the permission set in a somewhat restrictive member so that team members only have the permission they need, but what is often forgotten is building a custom minimal admin console with just access to the features people need.
This shouldn't be done from a security point of view, the additional security this brings is neglectable, but more from a usability point of view. It makes the admin console easier to use, and avoids access denied errors, or empty detail panes because someone clicks on a heading in the admin console for which he doesn't have permission.

Now how do you build such a custom Configmgr 2007 admin console you might ask.
Step 1) You launch mmc.exe
Step 2) In the File menu, you select Add/remove snap-in
Step 3) Add the system center configuration manager snap-in, and select the "Select console tree items to be loaded (custom)" radio button.

Step 4) Select the console tree items you want

Step 5) Click Next, Finish and Ok, below is a screenshot of the tree pane of the custom console I created

Step 6) Select "System Center Configuration manager" in the tree pane, right-click it and select "New Window from here"
Step 7) In the File menu select options
Step 8) Name your console "Custom Configmgr admin console"
Step 9) In the console mode select "User mode - Limited access, single window"
Step 10) Clear the checkbox for "Allow the user to customize view"
Step 11) Tick the checkbox for "Do not save changes to this console"
Step 12) In the file menu save your snap-in
Step 13) In the prompt about multiple windows being open click "Yes"

Step 14) Launch your customized mmc console and verify whether everything looks according to plans.
PS: a similar option was already available in sms.

--
Enjoy.

a step by step on how to build a base XP SP3 image in SCCM 2007

This post and subsequent posts will be a step by step on how to build a base XP SP3 image in SCCM.

I will be outlining not necessarily pointing out every click. Hopefully others will find this helpful. This assumes an understanding of SCCM and uses what is refereed to as a “Thin Image Strategy”.
Create a network access account, it only need be a domain user and its password should not expire. Add the account to the Computer Client Agent in the Client node under Site Settings
Import XP SP3 as an operating system Install Package.
Add a Distribution point to your new XP SP3 package created in step 1
Create the XP SP3 sysprep package in SCCM
The Deploy.cab included on the CD was not updated properly for XP SP3 so you must download a new version here.
Create a package that points at the extracted CAB file for its source
You do not need to create any programs for the package the build task sequence takes care of this
Add the package to a DP that can be used during your build
Create a package for the Config Mgr Client
Specify always obtain file from source directory
Usually here I create a share at \\SCCMSERVER\Souce$\SCCMClient.
Update the ccmsetup command line properties accordingly. Extensive information about command line properties on TechNet here.
Add the package to a DP that can be used during your build
Create a “Build and capture a reference operating system image” task sequence
Name the task sequence something appropriate like “Build & Capture Windows XP SP3 Gold Image”
Select the x86 boot image
Select the Operating System Package you created in step 1
Enter a product key
Set the local admin password to any password
Join a workgroup
Select the Config Mgr client you created in step 4
Don’t add any software to the base image
Set your image properties
Select a location to save the image and make sure you include the full path including the .wim extension
Enter an account with rights to write to the share
Finish up
Change the task sequence to use “Quick Format”
Right Click on the Task Sequence and choose Edit
Select the “Partition Disk 0″ step
Choose properties on the Default (Primary) partition and check the “Quick Format” option
Create a collection to which you will advertise the task sequence; I usually use "customer" Base Builds
Advertise the task sequence to the collection you created in step 7 as optional
Right click Task sequence and choose advertise, follow the wizard
Make sure you select the check box “Make this task sequence available to boot media and PXE”
If you are in test and your boundaries are not defined make sure you select “When no local distribution points are available, use remote distribution point”
Make sure you completed step 1
Ensure that you have the network and mass storage drivers to boot the device on the boot image and in the driver store (If you have to do this in the future you must update the PXE and standard DPs)
Add the appropriate boot images (x86 / x64) to the PXE and standard DPs
Allow the client to boot from PXE
If this client previously had an SCCM agent on it you just need to add the client to the collection you created in step 6
If this is a new client and SCCM is pre-R2 add the client manually
Add the client by right clicking the Computer Associations node under OSD and choosing “Import Computer Information”
Enter the Name of the computer
Enter the MAC and or SMBIOS GUID
Add the computer to the collection you created in step 7
Boot the device up to PXE and choose your task sequence. In less than an hour you should have the start of a great XP Image

pregnant women diet haemoglobin issues Options

http://groups.google.com/group/ms-technologies-ans-by-pavan/browse_thread/thread/4049a1df34452f6a

To eat well during pregnancy you must do more than simply increase how much you eat. You must also consider what you eat. Although you need about 300 extra calories a day — especially later in your pregnancy, when your baby grows quickly — those calories should come from nutritious foods, so they can contribute to your baby's growth and development. Why It's Important to Eat Well When You're Pregnant? Do you wonder how it's reasonable to gain 25 to 35 pounds (on average) during your pregnancy when a newborn baby weighs only a fraction of that? Although it varies from a woman to woman, this is how those pounds may add up: 7.5 pounds: average baby's weight 7 pounds: extra stored protein, fat, and other nutrients. 4 pounds: extra blood 4 pounds: other extra body fluids 2 pounds: breast enlargement 2 pounds: enlargement of your uterus 2 pounds: amniotic fluid surrounding your baby 1.5 pounds: the placenta Of course, patterns of weight gain during pregnancy vary. It's normal to gain less if you start out heavier and more if you're having twins or triplets — or if you were underweight before becoming pregnant. More important than how much weight you gain is what makes up those extra pounds. When you're pregnant, what you eat and drink is the main source of nourishment for your baby. Truthfully, the link between what you consume and the health of your baby is much stronger than once supposed. That's why doctors now say, for instance, that no amount of alcohol consumption should be considered safe during pregnancy. The extra food you eat shouldn't just be empty calories — it should provide the nutrients your growing baby needs. For instance, calcium serves make and keep bones and teeth strong. While you're pregnant, you still need calcium for your body, plus extra calcium for your developing baby. Similarly, you require more of all the essential nutrients than you did before you became pregnant. A Nutrition Primer for Expectant Mothers Whether or not you're pregnant, a healthy diet includes proteins, carbohydrates, fats, vitamins, minerals, and plenty of water. The U.S. government publishes dietary guidelines that can help you determine how many servings of each kind of food to eat every day. Eating a variety of foods in the proportions indicated is a good step toward staying healthy. Food labels can tell you what kinds of nutrients are in the foods you eat. The letters RDA, which you find on food labeling, stand for recommended daily allowance, or the amount of a nutrient recommended for your daily diet. When you're pregnant, the RDAs for most nutrients are higher. Here are some of the most common nutrients you need and the foods that contain them: Nutrient Needed for Best sources Protein cell growth and blood production lean meat, fish, poultry, egg whites, beans, peanut butter, tofu
Carbohydrates daily energy production breads, cereals, rice, potatoes, pasta, fruits, vegetables Calcium strong bones and teeth, muscle contraction, nerve function milk, cheese, yogurt, sardines or salmon with bones, spinach Iron red blood cell production (needed to prevent anemia) lean red meat, spinach, iron-fortified whole-grain breads and cereals Vitamin A healthy skin, good eyesight, growing bones carrots, dark leafy greens, sweet potatoes Vitamin C healthy gums, teeth, and bones; assistance with iron absorption citrus fruit, broccoli, tomatoes, fortified fruit juices Vitamin B6 red blood cell formation; effective use of protein, fat, and carbohydrates pork, ham, whole-grain cereals, bananas Vitamin B12 formation of red blood cells, maintaining nervous system health meat, fish, poultry, milk (Note: vegetarians who don't eat dairy products need supplemental B12) Vitamin D healthy bones and teeth; aids absorption of calcium fortified milk, dairy products, cereals, and breads Folic acid blood and protein production, effective enzyme function green leafy vegetables, dark yellow fruits and vegetables, beans, peas, nuts Fat body energy stores meat, whole-milk dairy products, nuts, peanut butter, margarine, vegetable oils (Note: limit fat intake to 30% or less of your total daily calorie intake) Scientists know that your diet can affect your baby's health — even before you become pregnant. For example, recent research shows that folic acid helps prevent neural tube defects (including spina bifida) from occurring during the earliest stages of fetal development — so it's important for you to consume plenty of it before you become pregnant and during the early weeks of your pregnancy. Even though lots of foods, particularly breakfast cereals, are fortified with folic acid, doctors now encourage women to take folic acid supplements before and throughout pregnancy (especially for the first 28 days). Be sure to ask your doctor about folic acid if you're considering becoming pregnant. Calcium is another important nutrient for pregnant women. Because your growing baby's calcium demands are high, you should increase your calcium consumption to prevent a loss of calcium from your own bones. Your doctor will also likely prescribe prenatal vitamins for you, which contain some extra calcium. Your best food sources of calcium are milk and other dairy products. However, if you have lactose intolerance or dislike milk and milk products, ask your doctor about a calcium supplement. (Signs of lactose intolerance include diarrhea, bloating, or gas after eating milk or milk products. Taking a lactase capsule or pill, or using lactose-free milk products may help.) Other calcium-rich foods include sardines or salmon with bones, tofu, broccoli, spinach, and calcium- fortified juices and foods. Doctors don't usually recommend starting a strict vegan diet when you become pregnant. However, if you already follow a vegetarian diet, you can continue to do so during your pregnancy — but do it carefully. Be sure your doctor knows about your diet. It's challenging to get the nutrition you need if you don't eat fish and chicken, or milk, cheese, or eggs. You'll likely need supplemental protein and may also need to take vitamin B12 and D supplements. To ensure that you and your baby receive adequate nutrition, consult a registered dietitian for help with planning meals. Food Cravings During Pregnancy You've probably known women who craved specific foods during pregnancy, or perhaps you've had such cravings yourself. Researchers have tried to determine whether a hunger for a particular type of food indicates that a woman's body lacks the nutrients that food contains. Although this isn't the case, it's still unclear why these urges occur. Some pregnant women crave chocolate, spicy foods, fruits, and comfort foods, such as mashed potatoes, cereals, and toasted white bread. Other women crave non-food items, such as clay and cornstarch. The craving and eating of non-food items is known as pica. Consuming things that aren't food can be dangerous to both you and your baby. If you have urges to eat non-food items, notify your doctor. But following your cravings is fine, as long as you crave foods and these foods contribute to a healthy diet. Frequently, these cravings diminish about 3 months into the pregnancy. Food and Drinks to Avoid During Pregnancy As mentioned earlier, avoid alcohol. No level of alcohol consumption is considered safe during pregnancy. Also, check with your doctor before you take any vitamins or herbal products. Some of these can be harmful to the developing fetus. And although many doctors feel that one or two 6- to 8-ounce cups per day of coffee, tea, or soda with caffeine won't harm your baby, it's probably wise to avoid caffeine altogether if you can. High caffeine consumption has been linked to an increased risk of miscarriage, so limit your intake or switch to decaffeinated products. When you're pregnant, it's also important to avoid food-borne illnesses, such as listeriosis and toxoplasmosis, which can be life- threatening to an unborn baby and may cause birth defects or miscarriage. Foods you'll want to steer clear of include: soft, unpasteurized cheeses (often advertised as "fresh") such as feta, goat, Brie, Camembert, and blue cheese unpasteurized milk, juices, and apple cider raw eggs or foods containing raw eggs, including mousse and tiramisu raw or undercooked meats, fish, or shellfish processed meats such as hot dogs and deli meats (these should be well- cooked) fish that are high in mercury, including shark, swordfish, king mackerel, or tilefish If you've eaten these foods at some point during your pregnancy, try not to worry too much about it now; just avoid them for the remainder of the pregnancy. If you're really concerned, talk to your doctor. About Fish. Fish and shellfish can be an extremely healthy part of your pregnancy diet — they contain beneficial omega-3 fatty acids, and are high in protein and low in saturated fat. But limit the types of fish you eat while pregnant because some contain high levels of mercury, which can cause damage to the developing nervous system of a fetus. Mercury, which occurs naturally in the environment, is also released into the air through industrial pollution and can accumulate in streams and oceans, where it turns into methylmercury. The methylmercury builds up in fish, especially those that eat other fish. Because canned albacore (or white) tuna and tuna steaks are generally considered to be higher in mercury than canned light tuna, the U.S. Food and Drug Administration (FDA) recommends that you eat no more than 6 ounces a week. A 2006 review by Consumer Reports, though, showed that some canned light tuna can contain levels of mercury even higher than that of white tuna. But the FDA maintains that the levels are safe if consumption of the fish is limited, and that the current recommendations should stand. It can be ...

Also..... Walnuts....... Sorry I forgot.. This helps Baby Mind to Grow up... And this make's baby's to remember everything in one word to say as” EkasanthaGrahi"

All Best,
Paddy

How to check the WMI repository before rebuilding it

How to check the WMI repository before rebuilding it
I've had some WMI repository repair tidbits stashed away in my e-mail that I was going to blog about sooner or later. I'm not sure if today is sooner or later, but I did have to go looking through my old e-mails to find these steps for a lab machine today, and figured that was a sign I should finally post this information to the blog. If you suspect that the WMI repository has been corrupted, before throwing in the towel and blowing it away you can/should try to repair it
I couldn't remember where I got these command lines so I had to go look them up again! Looks like if the repository can't be repaired, it will be recreated anyway: http://www.microsoft.com/technet/scriptcenter/topics/help/wmi.mspx
Of course, you could use the WMI Diagnosis Utility to check for WMI corruption, but I'm a pretty impatient person at heart and find that this is just faster for me. The steps when using these commands go kind of like this--check it, fix it and worst case replace it.
Anyway, to check the WMI repository for errors on a Server 2003 SP1 or SP2 systems, run the following command from command prompt:
rundll32 wbemupgd, CheckWMISetup
Once you've run that command, check the setup.log file located at: %windir%\System32\Wbem\Logs\Setup.log. Check for entries from today's date. If you find none, then WMI is probably OK and you should continue troubleshooting somewhere else. If however, you see an error message from today saying that it can't find a namespace then yes, your WMI repository does have issues and you should do the below:
rundll32 wbemupgd, RepairWMISetup
This will re-create your WMI repository minus any custom .mof additions that were implemented without the -autorecover switch.
For Windows XP SP2, use the following command to check for corruption, and repair if necessary:
rundll32 wbemgupgd, UpgradeRepository
For Windows XP SP1, the check and repair commands are below and function just like the Windows Server 2003, SP1 commands:
rundll32 wbemupgd, CheckWMISetup
and
rundll32 wbemupgd, RepairWMISetup

Happy WMI Check,
PaddyMaddy