ConfigMgr 2012: Key Updates & Features
ConfigMgr 2012: Key Updates & Features
HETEROGENEOUS MANAGEMENT
Under development but not slated for release with System Center 2012 Configuration
Management RTM is cross platform management functionality. Here are some highlights:
▶ Built and supported by Microsoft, uses a fully customizable CIMOM server to provide
the equivalent of Windows WMI service
▶ Anticipated support for Red Hat, SUSE, Solaris, HP-UX, and AIX
▶ Subset of ConfigMgr functionality, including inventory with reporting, software distri-
bution, and update management
User-Centric Management
System Center 2012 Configuration Manager is written with user-centric management in
mind. This is not an abandonment of managing devices; it simply makes the translation
of device to user an automatic one. During a deployment, the administrator targets the
user while ConfigMgr handles the translation to the device.
If you are a ConfigMgr administrator for any earlier version of the product, you do
this every day—just manually. Think about this: The challenge on earlier versions of
ConfigMgr is delivering software to a group of users, but before you can start, you must
have that list of users! The list is usually a list of devices passed through some type of
magical formula (query, script, and so on) to map the user relationship to the device.
When you have the device names, you can set up a collection and finally advertise
software.
System Center 2012 Configuration Manager goes beyond understanding user device affin-
ity (UDA). It uses UDA in ways that manages software deployment behavior for primary
devices and secondary devices. To illustrate this concept, imagine you are deploying an
application such as Microsoft Word to a user. While the user is on their primary machine,
a full version of Microsoft Word with authoring capability needs to be installed. If the
user logs into any other machine, the Microsoft Word Viewer must be available to read
authored documents. Integration with other technology such as Microsoft Application
Virtualization makes this scenario a reality.
www.it-ebooks.info
A package contains source files (in most cases) and “programs.” The programs in this
case are commands issued by the ConfigMgr agent. The commands issued are not
limited to just software installations, although this is the primary use case. You can also
2
use a package without source files with a program that simply runs a command, such
as copying files from one location to another. This still exists in System Center 2012
Configuration Manager, largely for backward compatibility.
Applications, on the other hand, employ a new concept for application management that
seeks to understand dependencies and build models around it. This is known as an appli-
cation model. This includes numerous advantages over the legacy deployment method.
Features such as global conditions and expressions remove the burden of managing
requirements from the query and the installation package. The application model itself
holds the requirements of the application instead.
Dependency intelligence has moved to the agent. The agent checks the requirements
(OS type, hardware, disk space, and so on) before it handles the installation request. This
improves things on several layers:
The application model can also be instructed on how to manage superseded applications
and application uninstalls.
Hierarchy Changes
The hierarchy model in ConfigMgr has changed to become a flat, simplified infrastructure,
redesigned with additions such as role-based administration that make segmentation of
responsibilities easier to manage. In previous versions, the primary site was the boundary
that separated the management of objects belonging to the site. There were ways to sepa-
rate security for workstations and servers, but this is not an easy process and often felt like
a hack.
www.it-ebooks.info
Enhancements to BITS
BITS continues to provide bandwidth management capabilities. In ConfigMgr 2012, BITS
throttling can be managed by client settings. Because client settings can be applied to
collections, BITS settings can be selectively managed allowing the management of devices
that may operate continuously over suboptimal bandwidth conditions.
Application Catalog
The Application Catalog website point and Application Catalog web services point are
new roles that together offer a new end user experience. The Application Catalog is a
self-service portal designed to enable users to install available software. If the software
installation is of a type requiring approval, the request goes to the administrator first.
The interaction with the ConfigMgr client no longer requires complicated backend cycles
of collection evaluations and client policy retrieval to initiate the software installation
process. Instead, installations happen almost instantaneously.
www.it-ebooks.info
2
Table 2.2 displays the features available in both types and which devices are supported.
Light management refers to devices managed through the Exchange ActiveSync Connector,
whereas depth management includes devices such as Windows Mobile 6.1, Windows Phone
6.5, and Symbian (Nokia). It also includes Windows Mobile 6.0 and Windows CE 6.0, but
with limited features.
Managing with depth gives administrators several more options above light management,
namely over-the-air enrollment and software distribution. For devices that cannot run
the ConfigMgr client, System Center 2012 Configuration Manager includes the Exchange
Server connector. This connector uses the Exchange ActiveSync protocol to find and
manage devices that connect to an Exchange environment bringing together mobile
device management into a single pane of glass. The Exchange Server connector provides
the ability to manage settings, collect inventory, and remotely wipe devices. See Chapter
15, “Mobile Device Management,” for additional information.
Boundary Changes
In previous versions of the product, the concept of a boundary defined the logical perim-
eter of a site. Any clients in the boundary of the site would typically become clients of
that site. In System Center 2012 Configuration Manager, the boundary is a hierarchy-wide
object. When defined, it is available at every site.
www.it-ebooks.info
With the addition of forest discovery, introduced in the “Discovery” section of this
chapter, ConfigMgr can inspect the entire AD forest and read information about all
the domains, sites, and subnets. Boundary groups can be created using the discovered
information. Having the ability to keep boundary information up to date in an effi-
cient manner is critical to maintaining client saturation and ensuring deployments work
smoothly, particularly with roaming clients.
Fallback Site
If a client does not reside in a defined boundary, typically the client remains unassigned.
With the introduction of a fallback site, a default site can be defined for this scenario.
Clients that do not reside in a boundary group would simply be assigned to the fallback
site.
Role-Based Administration
A much-needed shift in managing security is introduced in this version of ConfigMgr.
Role-based administration looks at security and permissions as roles instead of the confus-
ing and complicated use of class and instance rights. By using a combination of security
roles and security scopes, you can apply permissions to groups of securable objects by
assigning the role to a collection that holds these objects. Because security is available
throughout the hierarchy, an administrator with an assigned role can connect their
console to any site and expect to receive the same set of permissions assigned to them no
matter which site they are in. See Chapter 20 for additional information.
www.it-ebooks.info
Collection Changes
Configuration Manager takes advantage of a feature from previous versions known as
collection limiting and enforces its use. Any new collection must be limited to some other
collection. Collections can no longer contain a mixture of users and devices. Collections
update faster because they execute collection member evaluations through an incre-
mental process (by default, every 10 minutes). Because objects are globally available, a
2
collection at any site can contain the objects from the entire hierarchy. System Center
2012 Configuration Manager also adds two new collection rules, Include Collections and
Exclude Collections, making it much easier to include or exclude objects from another
collection, as shown in Figure 2.15.
FIGURE 2.15 New collection rules for including and excluding objects from other collections.
Folders
Subcollections no longer exist in ConfigMgr and are replaced with folders. Because the
scenario for creating subcollections was usually for organizational purposes, subcollections
were removed from the product.
www.it-ebooks.info
Remediation
Every seasoned ConfigMgr administrator uses some type of script or process to keep clients
running, which is a laborious process to maintain. Even so, some administrators rely on
manual remediation, which is time consuming and expensive. ConfigMgr 2012 looks to
help solve some of those problems by remediating client issues automatically.
Overall, the ease of creating and managing baselines has improved with additions such
as creating configuration items while browsing a “gold” device. Enhanced versioning is
included, which allows version-specific configuration items to be included in baselines.
After baselines are deployed, dashboards and reporting help easily determine the level of
compliance for the collection.
The 2012 product adds a missing feature of managing configuration drift. Automatic
remediation of registry and WMI settings can revert a value back if they are detected
as changed. Even a scripted discovery can have a corresponding scripted remediation
response.
Compliance settings broaden the target range by enabling user, device, and mobile
management.
www.it-ebooks.info
2
FIGURE 2.16 CTRL-ALT-DEL command is again available.
www.it-ebooks.info
▶ The capability to enable users to exclude their computers from power management
▶ Balanced
▶ High Performance
▶ Power Saver
www.it-ebooks.info
You can create your own power management plan by selecting Customized Peak or
Customized Non-peak, clicking Edit in the collection, and giving the customized power
management plan a name. Table 2.3 provides an overview of the possible settings, which
can be enabled individually or set differently for computers running on battery power and
computers that are plugged in.
2
TABLE 2.3 Possible Settings of a Power Plan
Name Description
Turn off display after (minutes) Length of time before the display is turned off for an
inactive computer.
Sleep after (minutes) Length of time before an inactive computer goes to sleep.
Require a password on wakeup Specify if you want the computer to lock after it wakes up.
Power button action Specify what the Power button on the computer will do
when pressed: sleep, hibernate, shut down, or nothing.
Start menu Power button Specify what the Power button in the start menu will do:
sleep, hibernate, shut down, or nothing.
Sleep button action Specify what the Sleep button will do: sleep, hibernate,
shut down, or nothing.
Lid close action What occurs when user closes the lid of laptop (sleep,
hibernate, shut down, or do nothing).
Turn off hard disk after (minutes) Length of time before inactive computer turns off hard
disk.
Hibernate after (minutes) Length of time before inactive computer goes into hiber-
nate mode.
Low battery action Specify computer action when battery is low (sleep, hiber-
nate, shut down, or do nothing).
Critical battery action Specify computer behavior when battery is at critical level:
sleep, hibernate, shut down, or do nothing.
Allow hybrid sleep Specify if computer should write a hibernate file when it
goes to sleep, so settings are preserved in case of power
loss during sleep.
Allow standby state when When you set this setting, a computer either can hiber-
sleeping action nate or turn off.
Required idleness to sleep (%) Specify the percentage of idle time of the processor
required before entering sleep. This option applies only to
computers running Windows Vista and not for Windows 7.
Enable Windows wake up timer You can enable the Windows wake up timer, when the
for desktop computers computer wakes up it remains awake for 10 minutes,
making it possible to install software or software updates,
and for the computer to receive policy from ConfigMgr.
www.it-ebooks.info
Functional Changes
System Center 2012 Configuration Manager adds new features to help ease the admin-
istrative burden of patching devices, whether manual or automatic. One such change to
the interface is the ability to perform granular searches of software updates. When the
right criteria are set, the criteria can be saved to be reused later. Other functional changes
include the ability to configure superseded updates so that software updates do not auto-
matically expire after being superseded; this allows the deployment of superseded updates
if required.
Automated Administration
Utilizing software update groups and automatic deployment rules, you can automate the
entire software update process. Software update groups are state-based. When deployed to
a collection, any updates added to the software update group are deployed automatically.
Using automatic deployment rules, software updates matching specified criteria can be
added to a software update group automatically and pushed out.
www.it-ebooks.info
2
FIGURE 2.18 Software Center showing updates.
Content Library
The content library has been added to ConfigMgr as a replacement for traditional file
storage. It uses single instance storage to help reduce drive space requirements. The
content library of a site holds content for all the DPs.
ConfigMgr also provides the ability to manage some of the new features of 2012 such as
defining user device affinity and installing applications. New features of the User State
Migration Tool (USMT) version 4 have also been included. Chapter 19, “Operating System
Deployment,” discusses OSD in detail.
www.it-ebooks.info
Prestaged Content
Distribution points accept prestaged content to help get files to remote distribution points
without the concern of over saturating a WAN link. Unlike ConfigMgr 2007, the tools for
managing prestaged content are integrated.
www.it-ebooks.info
Content Validation
Sometimes packages in ConfigMgr 2007 would go out of sync with the content of the
source location. Whenever this happens, the content hash fails to match up properly
causing clients to fail installing software because they would not obtain content. System
Center 2012 Configuration Manager includes content validation, which can be scheduled
or run manually to verify integrity.
2
System Center 2012 Endpoint Protection Integration
Endpoint Protection, known previously as Forefront Endpoint Protection, has been inte-
grated into System Center 2012 Configuration Manager. Unlike most of the other features
of ConfigMgr that are integrated into the ConfigMgr agent, Endpoint Protection uses its
own agent.
Endpoint Protection supports the detection and remediation of malware, spyware, and
rootkits. A full set of policies scan schedules, definition update source locations, exclusion
settings, default actions, and so on. In addition, Endpoint Protection can manage basic
Windows Firewall settings such as enabling or disabling the firewall state, blocking incom-
ing connections, and user notification of program blocking.
For example, BITS is required for distribution points. Because BITS is a part of IIS, IIS is
required for a distribution point. Other roles such as software update points require WSUS
because it is a core component to the way patch management works in ConfigMgr. Table
2.4 outlines the dependencies required for each role in System Center 2012 Configuration
Manager.
www.it-ebooks.info
76
TABLE 2.4 System Role Dependencies in System Center 2012 Configuration Manager
CHAPTER 2
Windows Update
.NET Framework
. NAP Policies
SQL Database
(Full Version)
Compression
Deployment
BITS Server
Differential
Windows
Services
WebDav
Remote
WSUS
Agent
.WCF
Optional ConfigMgr Roles
PKI
IIS
Application Catalog web service point X X X X
Application Catalog website point X X X
Asset Intelligence synchronization point X
Distribution point X X X2 X
Endpoint protection point X
Enrollment point X X X
Enrollment proxy point X X X
Fallback status point X
Management point X X2 X
Out of band service point X X X
Reporting services point X X
Software update point X2 X1 X X
State migration point X
System health validation point X
PXE X
Multicast X
1
Required by WSUS
2
Required for Internet-based management
6/22/12 10:35 AM
www.it-ebooks.info
Summary 77
Summary
The landscape of configuration management continually evolves. To stay current with
these changes, System Center 2012 Configuration Manager has evolved as well into a
user-centric configuration management platform. While increasing capability and perfor-
mance, the ConfigMgr infrastructure has simplified to reduce the administrative burden.
ConfigMgr is a completely scalable architecture, which can run in complex scenarios as a
2
widely distributed system or as a simple, stand-alone server.
www.it-ebooks.info