Microsoft System Center Configuration Manager Advanced Deployments电子书

Microsoft System Center Configuration Manager Advanced Deployment

Table of Contents

Microsoft System Center Configuration Manager Advanced Deployment

Credits

About the Author

Acknowledgments

About the Reviewers

www.PacktPub.com

Support files, eBooks, discount offers, and more

Why subscribe?

Free access for Packt account holders

Instant updates on new Packt books

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Downloading the example code

Errata

Piracy

Questions

1. Designing Complex Hierarchies

Selecting the appropriate site system server

When to use a central administration site

Determining the location of primary sites

Working with secondary sites

Client count

Traffic control

The local management point

What should you do when you are unsure?

Designing fault-tolerant hierarchies

Fault tolerance in site systems

Fault tolerance in site-system roles

Backup and recovery in Configuration Manager

Advanced backup options

Additional backup tasks

Restoring a Configuration Manager site

Post recovery tasks to complete the recovery

Designing to support trusted forests

Designing to support nontrusted forests

Designing a sample hierarchy

Business requirements

Design assumptions and risks

Planning the new hierarchy

Directly addressing the stated requirements

Planning for the SQL Server configuration

Planning for fault tolerance and high availability

Defining the business benefits

Delivering the design documentation

Design diagrams

Summary

2. Implementing Security with Certificates

Planning for the use of certificates

Setting up a secure communication

Preparing the certificate authority

Setting up certificate services using the user interface

Setting up certificate services using PowerShell

Configuring certificate templates

Creating the web server certificate template

Creating the client certificate for distribution points

Creating the client certificate for Windows computers

Issuing certificate templates

Requesting the web server certificate

Requesting the client certificate for distribution points

Exporting the distribution point client certificate

Deploying the client certificate for Windows workstations

Configuring IIS to use the distribution point certificate

Configuring Configuration Manager

Configuring distribution points to use certificates

Configuring management points to use certificates

Deploying certificates to workgroup computers

Summary

3. Working with Inventory, Asset Intelligence, and Software Metering

Configuring the software and hardware inventory

Planning the configuration of inventory

Configuring the hardware inventory

Configuring the required settings

Initiating inventory cycles manually

Using the inventory data to your advantage

Controlling the inventory with control files

Tracking assets with the inventory

Tracking build cycles with the registry

Preparing the MOF files

Import custom modifications

Tracking with reports

Making use of software metering

Modifying metering retention

Viewing metering data

Removing unused software with metering data

Real-world use of asset intelligence

Licensing with asset intelligence

Controlling applications with the inventory data

Using security groups for application control

Summary

4. Security with Endpoint Protection

Configuring the endpoint protection infrastructure

Deploying the endpoint protection point

Deploying the endpoint protection point with the console

Deploying the endpoint protection point with PowerShell

About the Microsoft Active Protection Service

Creating endpoint protection policies

Deploying endpoint protection policies

Importing predefined policy templates

Deploying endpoint protection definition updates

Setting up the software update point

Using automatic deployment rules

Deploying endpoint protection agents

Deploying agents using client settings policies

Deploying endpoint protection in your image

Responding to threats

Monitoring endpoint protection

Managing threat alerts

Testing endpoint protection with EICAR

Controlling the Windows Firewall

Summary

5. Advanced Content Management

Deploying distribution points

Planning for the placement of distribution points

Placement of distribution points with fast connectivity

Placement of distribution points with slow connectivity

Creating distribution points using the console

Creating distribution points using PowerShell

How to deploy cloud distribution points

How the service works

Creating the management certificate

Creating the certificate template

How to enroll the certificate

Exporting the management certificate

Uploading the management certificate to Windows Azure

Creating the cloud distribution point

Creating the DNS entry

Allowing clients to use cloud distribution points

Understanding the content library

Anatomy of the content library

Package library

Data library

File library

Content actions

Introducing network caching

Recommendations for where caching devices exist

Working with data deduplication

Deduplication on the content source

Deduplication on the distribution point

Evaluating data deduplication

Summary

6. Application Deployment

Introducing the application model

Application management workflow

Exploring the elements of an application

Using application requirements

Using application dependencies

Sample application deployment

Using application detection methods

Using simulated deployments

Superseding applications

How to specify a relationship

Targeting multiple platforms

Making applications persistent

Deploying virtual applications

Using virtual environments

How the application model works

When to use packages

Usage scenarios for packages

Summary

7. Deploying Windows 8.1 and Windows Server 2012 R2

Introduction to operating system deployment

Benefits of deploying standard images

Integrating the Microsoft Deployment Toolkit

Installing the console extensions

Configuring the deployment share

Configuring the deployment database

Creating custom boot images

Adding drivers to boot images

Adding components to boot images

Maintaining a driver library

Managing drivers using driver packages

Searching and downloading drivers

Extracting drivers and creating a repository

Importing drivers into Configuration Manager

Assigning driver packages to task sequences

Creating reference images

Deciding on your image format

Capturing and deploying thick images

Capturing and deploying thin images

Capturing and deploying hybrid images

Maintaining versions on your images

Using images in virtual environments

Creating VHD files using task sequences

Creating the task sequence for the VHD

Creating the VHD

Deploying your captured images

Configuring the task sequence information

Editing the task sequence

Making your task sequence available

Summary

8. Deploying Security Updates

Software updates

The anatomy of software update deployment

Introducing software update groups

Introducing deployment packages

Introducing automatic deployment rules

How software update synchronization works

Synchronization on child sites

Designing a software update infrastructure

Capacity planning of the software updates infrastructure

How to design the infrastructure for software updates

Planning the placement of software update points

Using an existing WSUS server as the source

Planning for the switching of software update points

Monitoring software updates

Viewing compliance using reporting

Monitoring compliance with baselines

A sample scenario to patch workstations

Customer requirements

Implementing the infrastructure for patching

Deploying a single software update point

Deploying multiple software update points

Software update point design decisions

Configuring the software update point component

Deploying patches to pilot devices

Creating automatic deployment rules

Deploying patches to live devices

Reporting patch compliance

Obtaining compliance with a compliance baseline

A sample scenario to patch servers

Customer requirements

Configuring maintenance windows

Applying maintenance windows to collections

Configuring automatic deployment rules and deployments

Summary

9. Advanced Reporting

Report Builder

Developing reports using Report Builder

Requirements for reports

Configuring Report Builder for Configuration Manager

Creating custom reports

Defining the report requirements

Creating the initial report layout

Adding the data source to the report

Creating the first report

Creating the parameter for the report

Creating the results dataset

Formatting and displaying the data

Creating the second report

Creating the dataset for the report

Creating custom charts

Working with chart components

Configuring data visualizations

Optimizing query performance

Configuring report subscriptions

Creating report subscriptions

Summary

10. Preventing Configuration Drift

An introduction to compliance settings

Use cases for compliance settings

Remedying of noncompliant clients

Example scenarios for compliance monitoring

Monitoring application-specific settings

Creating the configuration item

Creating the configuration baseline

Deploying the configuration baseline

Monitoring the deployment

Remediating the file presence

Monitoring unauthorized software applications

Creating the configuration item

Creating the configuration baseline

Removing the software where it is detected

Summary

11. Managing Bring Your Own Device and Mobility

Deploying company resource profiles

Managing Wi-Fi profiles with Configuration Manager

Managing certificates with Configuration Manager

Creating certificate profiles

Managing VPN profiles with Configuration Manager

Managing Internet-based devices

How Internet-based client management works

Functionality in Internet-based client management

Requirements for Internet-based client management

Using Internet-based client management

Using the Microsoft Exchange connector

Connecting to Exchange using the connector

Managing ActiveSync devices

Using Windows Intune

Requirements for Windows Intune

Deploying the Windows Intune connector

Enrolling mobile devices with Windows Intune

Summary

12. Advanced Troubleshooting

Error tracing in Configuration Manager

Modifying the logging options for components

Where to find specific logfiles

Using the Configuration Manager toolkit

Using server-based diagnostic tools

Using the DP job manager tool

Using the collection evaluation viewer tool

Using the content library explorer tool

Using the content ownership tool

Using client-based diagnostic tools

Using the Client Spy tool

Using the Policy Spy tool

Using the deployment monitoring tool

Using the service manager utility

Determining when to use the utility

Restarting Configuration Manager services

Real-world scenarios

Troubleshooting content distribution errors

Troubleshooting deployment errors

Troubleshooting site system errors

Summary

Index