SCCM Client Actions Tool

Often times I would end up working in environments where installing tools to get some basic troubleshooting and maintenance done is deeply frowned upon. If the software is not on the DoD’s approved software list, well then you are just out of luck. The same applies to many corporations that are trying to secure their environments as much as possible. You just have to get really crafty with your scripting skills or do it the hard way “manually”. Fortunately for SCCM admins, we have the “SCCM CAT ” hta.

This script is a life saver. It was created by Christjan Schumann of, for the very reasons I identified above. It is a very robust tool and can be downloaded here. SCCM CAT will also help you avoid the proliferation of installing the SCCM Console on every computer you use to administer your SCCM sites. In addition, over a period of time, our SCCM enterprises can start to get bogged down by the number of collections that are created. Instead of creating a collection for every single task you do, you can now simply populate a computer list to a file (XLS, XLSX, CSV, TXT), and run any of following tasks against it.

Client Schedule Actions

Depending on the size of your SCCM environment, you might have to schedule your Client actions to occur sparingly so that you can cut down on the amount of traffic between clients and your SCCM servers. Some environments might have their clients run inventories once a week and so forth. Which is why being able to launch these individual actions via the SCCM CAT tool is extremely useful.

SCCM CAT – Client Schedule actions

Let’s say you just conducted a hardware refresh for a department at a site office, and your boss wants updated numbers on the different hardware platforms. Rather than wait for the information to trickle in, you can simply launch a Hardware Inventory Cycle using SCCM CAT. You can also run other similar tasks like a:

Software Inventory Cycle – Initiates a full inventory of the installed software on the clients.

Running a Discovery Data Collection Cycle – initiates a heartbeat discovery of your clients which is useful when they get deleted by accident from SCCM and you want to speed up the discovery process to bring them back in.

Machine Policy Retrieval & Evaluation Cycle – when troubleshooting package deployments, it is sometimes necessary to initiate a Machine Policy Retrieval & Evaluation Cycle, which will force clients to immediately look for and process any mandatory advertisements. The default period for a scheduled Machine Policy Retrieval & Evaluation Cycle is 60 minutes, so using this function can save you some time.

Software Updates Scan Cycle and Software Updates Deployment Evaluation Cycle are closely tied together. A Software Updates Scan Cycle causes clients to start scanning against the Software Update Point (SUP) for compliance; once it is completed you can run a Software Updates Deployment Evaluation Cycle to trigger the downloading and installation of required updates. This can come in very handy when you have critical security patches that you want to deploy in a short amount of time.

File Collection Cycle – Allows you to initiate an inventory of all the file extensions that you have listed under the Software Inventory Client Agents properties. In some cases, you might have custom DLLs, you want to get an inventory of, for in-house applications.

Software Inventory Client Agent Properties – Inventory Collection

Software Inventory Client Agent Properties – File Collection

Windows Installer Source List Update Cycle – Have you ever installed Microsoft Office, and just did a minimal install? You decided you didn’t need the install files loaded on your machine. Months later, you realized the need to load the speech tools. When you attempt to install them, the setup program asks you for the install CD, but you have no idea where it’s at. Well, Windows Installer Source Location Manager can automatically search Configuration Manager 2007 distribution points for the source files, even if the application was not originally installed from a distribution point. So when you launch this particular cycle, you are asking for the Product Source Update Manager to complete a full update cycle.

Software Metering Usage Report Cycle – Software Metering in SCCM allows you to monitor and collect software usage data on Configuration Manager 2007 clients. Triggering a report cycle will cause the Software Metering Client Agent to evaluate the Metering rules on Configuration Manager Client computers, collect metering data, and report it back to the site database. This is useful when you want to get a good handle on how much a particular application is utilized, and it will give you a good idea if you are under licensed or over licensed.

Branch Distribution Point Maintenance Task – Sometimes, pre-staging packages on a branch distribution point will minimize the bandwidth otherwise necessary to download the packages. When you manually launch Branch Distribution Point Maintenance Task that is essentially what you are doing. This task will verify the pre-staged package and download any packages that do not exist on the branch distribution point. A success status message is sent to the management point, and server records are updated to reflect the availability of the package on the branch distribution point.

Certificate Maintenance Task - This task can help troubleshoot communication problems between client and management point or with Active Directory Services. This is only useful when you’re using SCCM in native mode. Once you execute this action, you can monitor CertificateMaintenance.log file for process on client.

Client Agent Actions

These are the actions that interact with the SCCM client agent. Usually all actions in SCCM CAT can be run against any number of remote computers, but there are two actions in this category that are only available if the target list contains up to 5 computers. These are actions to open client log folder and client setup folder. These might come in handy if a tool is used to troubleshoot a small number of computers at a time. A lot of these are pretty self explanatory so I won’t go into too much detail.

SCCM CAT – Client agent actions

Open SCCM client log folder – Opens client logs folder on target machines. This will only work on 5 clients at a time.

Open SCCM client setup folder – Opens a client setup folder on target machines. This will only work on 5 clients at a time.

Get Management point – Returns the management point for every client listed. A Management point is the SCCM server that manages that particular client.

Reassign site code – Used to redirect SCCM Clients to a Specific SCCM server that is designated by a three letter site code. Comes in handy when you are moving clients between different Sites.

Generate new SMS GUID – This action forces the client to generate a new GUID (Globally Unique Identifier ). At times you might come across another client that has the same GUID in the same environment.

Delete trusted root key – This action removes instance of TrustedRootKey in root\ccm\locationservices WMI namespace and restarts ccmexec service. The client will then obtain trusted root key again from the primary site. A very common reason for the root key to change is when reinstall and restore has been done on central site. It may also be helpful when moving the client from one hierarchy to another.

Delete certificates (re-register client) – This action stops ccmexec service, removes subkeys of “SOFTWARE\Microsoft\SystemCertificates\SMS\Certificates” and starts ccmexec service. This results in client requesting new registration.

Re-register ATL.DLL – If you ever run into error 1904 while installing the SCCM client, you are going to want to run this action to fix those client.

• Configuration Manager Client — Error 1904. Module C:\WINDOWS\system32\CCM\VAppRegHandler.dll failed to register.  HRESULT -2147221164.  Contact your support personnel.

Change client cache size – You can change the amount of disk space that the Configuration Manager 2007 client can use to store downloaded packages by running this task. The default size of the temporary program download folder is 5120MB.

Uninstall SCCM client – This action does the full uninstall of SCCM client. It removes SMSCFG.ini, deletes certificates and runs ccmsetup.exe /uninstall.

Install SCCM client – This action will install SCCM client from scratch by running ccmsetup.exe.

Client Health Actions

Common SCCM client health checks. Each check can be run with or without fixes. It’s highly recommended to run the checks first and then think about fixing.

SCCM CAT – Client health actions

Check WMI – WMI check is pretty simple – it just makes sure root\cimv2 can be connected to. WMI fix will stop WMI and dependent services, re-register all DLL, EXE, MOF and MFL files in correct paths (x86 and x64 supported) and then start the services again.

Fix WMI – When running the WMI fix action on remote computers, the tool first creates a fixing batch file “%TEMP%\fixwmi.bat” on administrator’s computer. This batch file is then copied to each remote computer (in “%windir%\temp\” folder) and the execution of the script is scheduled to run after 1 minute. All batch file output is written to “%windir%\temp\fixwmi.log” file on each remote computer.

Check services – Checks if winmgmt, lanmanserver, rpcss, wuauserv, bits and ccmexec services are running and their startup mode is “Auto” (except BITS and wuauserv as BITS can be manual and wuauserv can be manual on Vista+). Running the fix will change the startup mode if needed and start the services.

Check admin$ share; Check & Fix admin$ share - You can run either one of these actions to help troubleshoot client admin share issues. The admin share is required for SCCM client to function properly. The Check admin$ share portion checks if the administrative share is enabled. While running the Check & Fix admin$ share modifies the registry to enable the share and then restart the lanmanServer service.

Check assigned site; Check & Fix assigned site – Check assigned site – Checks if a client is assigned to a site.

Check & Fix assigned site – initiates a client auto-discovery on each client you direct it to.

Check registry – This task checks the following values in the HKLM\Software\Ole registry hive to see if they are set correctly:

§ EnableDCOM = Y

§ EnableRemoteConnect = Y

§ LegacyImpersonationLevel = 2

§ LegacyAuthenticationLevel = 2

When running the fix, the values will be set according to the list above.

Check inventory ­– Checks hardware and software inventory dates and compares them to maximum number of days passed. Default is 5 days for hardware and 7 days for software.

Check & Fix inventory – Fix triggers a full hardware and/or software inventory if they’re too old.

Check client version – Checks if the client version is the same or newer than the expected version.

Check & Fix client version – Client installation will be initiated automatically in case the installed client version is older than the expected version.

Full health check – This will run all the checks above on every computer.

Full health check with fixes – Full health check with fixes initiates the needed fixes for each health check.

Advertisement actions

This category includes administrative tasks for advertisements.

SCCM CAT – Advertisement actions

Query advertisement status – The “Query advertisement status” action simply shows available advertisements on remote computers that match the specified keyword.

Get all active advertisements – Lists machine based advertisements

Get all active user advertisements – List advertisements for currently logged on user. The action succeeds only when there is currently a user logged on the remote computer.

Rerun advertisement – This re-launches a specific advertisement that you specify by providing the advertisement ID.

Rerun user based advertisement - This will re-launch a specific user based advertisement that you specify by providing the advertisement ID.

Other actions

This category includes actions that are not exactly SCCM related, but otherwise helpful for administrators. So it’s possible to refresh group policies, ping a list of computers, gather information about logged on users or execute a command-line remotely. “Execute Remotely” action schedules the specified command-line on a remote computer and it will be run in the SYSTEM account context.

There are also actions for logging off users and restarting or shutting down remote computer(s). They ask for confirmation first, but are really helpful even if you don’t have SCCM running in your environment.

SCCM CAT – Other actions

SCCM Client Actions Tool (SCCM CAT)

• System Center 2012 – Orchestrator 2012 – Integration Packs (0)
• System Center 2012 – Orchestrator 2012 – Runbooks best practices (0)
• System Center 2012 – Orchestrator – Creating Runbooks (0)
• System Center 2012 – Orchestrator – Installation (0)
• System Center 2012 – Orchestrator Review (0)

In this final part of this series on Windows Intune we’ll look at the Intune client experience and then wrap up by comparing Intune to other similar products as well as look at the cost and the future of Intune.

Windows Intune Client

The easiest way to install the client agent on a PC is to download the 14 MB zip file from the console; save it in a network share or on a USB stick and then install it manually. The executable contains both the 32 and 64 bit version and will run the appropriate one automatically; supported client operating systems are Windows XP, Windows Vista and Windows 7. Server operating systems are not supported. The installation is really just a two click affair with no questions asked. Notice that the zip file also contains a WindowsIntune.accountcert file that has to be kept in the installation folder as it’s used by the agent to identify which account to connect to in the cloud.

The client shows up in the console a few minutes after the agent is installed (provided it has internet connectivity of course) but it can take up to 30 minutes for all the agents to report their status.

If you want to distribute the agent to multiple computers using an automated method the 32 and 64 bit MSI files can be extracted from the installation file and then distributed using Group Policy software distribution or any other installation method of your choice.

The agent puts a short cut on the desktop and has a very simple interface with links to Updates, Endpoint Protection and Remote Assistance which operates through Easy Assist; the system tray also has an icon for Endpoint Protection. The benefits of the cloud become apparent here as your users can ask for help wherever they are (as long as they’re connected to the internet) without being connected to the corporate network.

The Windows Intune client shouldn’t be hard for the average end user to figure out

Windows Intune and the competition

Windows Intune is a great offering for small businesses that don’t have a server today, giving them the ability to manage, monitor and maintain their computers in a way that they probably haven’t been able to do before. For small sites with a server today (most likely Small Business Server 2003/2008 or even 2011) the value proposition is less clear although the included Windows 7 Enterprise subscription will be a great boon to businesses that have so far held off updating from Windows XP. For larger businesses there’s some validity to Microsoft’s idea that unmanaged non-domain joined clients, mostly home computers, could be well served by Windows Intune.

Windows Intune also fits in well with the movement of consumerization of IT with more users bringing in their own devices and computers to work, this is an ideal way of having some control over these non-company IT assets.

Intune isn’t cheap, at $ 11 USD per PC per month, but if you take into account the inclusion of Windows 7 Enterprise the maths might add up. For another $1 a month you add Microsoft Desktop Optimisation Pack (MDOP) which adds multiple (enterprise level) tools; such as App-V for application virtualization, MED-V for desktop virtualization, Advanced Group Policy Management (AGMP), System Center Desktop Error Monitoring (DEM) and Microsoft Diagnostics and Recovery Toolset (DaRT). For most small businesses only the latter will be a natural fit.

For many small businesses that are on Windows XP today a major benefit will be the inclusion of Windows 7 Enterprise as that’s the only version (apart from Ultimate) that includes such goodies as Bitlocker (very useful for those executive laptops) and Bitlocker to Go (even more useful for everyone’s USB sticks) along with other great enterprise features.

A question many small business IT providers will be asking is how does Intune stack up against Managed Service Provider platforms such as Kaseya, Hound Dog and N-Able; at this stage the functionality is a bit limited compared to those more mature offerings but on the other hand it’s a true cloud based solution.

There’s a distinct version 1 feeling about Intune but I don’t mean that in a negative way, it’s certainly very capable and what it does, it does well. Missing from this first version is OS and software deployment, remote performance monitoring, remote control (Remote Assistance is always user initiated from the client machine) along with richer policy control for general client machine lock down. The Intune team is unusually candid about what they’re planning to include in future releases and their stated goal long term is to have “smart parity” with System Center Configuration Manager which means the same use scenarios should be covered but in a simpler fashion than in SCCM. Microsoft recommends Intune for up to 20,000 accounts but I suspect the major uptake will be in the SMB space.

Overall Intune is easy to work with and I can see a good fit for at least one of my SMB clients who don’t have a server today and is 1500 km away from my location.

Resources

Features of the new Windows Intune beta

Windows Intune Trial Guide document

Windows Intune Homepage

Windows Intune Team Blog

• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• FREE: SolarWinds VM-to-Cloud Calculator – Compare VM hosting costs (0)
• Decaf – Amazon EC2 client for Android (0)
• Office 365 review – Part 8: SharePoint Online and conclusion (0)
• Office 365 review – Part 7: Lync Online (0)

The last post of this series covered the Windows Intune workspaces System Overview, Computers, Updates, End Point Protection, and Alerts. Let’s have a look at the other workspaces.

Software

Here you’ll be provided with a collated list of all software packages installed across all managed PCs, this list can be sorted by how many installations you have, publisher, name or category. There’s also an option to drill down to see what’s installed on individual computers, it’ll even tell you if a package is installed as an App-V program. Third party applications are inventoried and categorised as well.

Licenses

This workspace is unlikely to excite small business but larger environments with volume licensing agreements for Office or Windows can upload license agreement numbers here and manually compare to installed numbers. There’s no enforcement of licensing, only a list of licenses versus install count. Currently it only covers Microsoft’s volume licensing but the Intune team says third party licensing tracking is coming in a future update.

Policy

Be warned – if you’re a Group Policy buff you’ll find the policy control available in Intune rather limiting but for many small businesses these might cover the bare necessities. Policies are created for one of three areas, Windows Intune Agent Settings, Windows Intune Center Settings and Windows Firewall Settings. Policies are applied on a computer group basis. The policy agent is based on “lantern” which is the same engine that’s used in Desired Configuration Management (DCM) in Systems Center Configuration Manager. Once policies are applied the Intune agent runs Gpupdate so if there are any conflicts between Group Policy and Intune policies the GP policies will win. Microsoft doesn’t recommend mixing Intune and Group Policy policies on the same computers.

The policy control in Intune is meagre compared to Group Policy but adequate for small business environments

Reports

In this workspace you’ll find pre-made reports for updates, installed software and licenses. These are generated on demand and can be viewed directly or exported to HTML or CSV. The latter can be useful if you have a lot of information and want to take advantage of power pivot in Excel for instance.

Comprehensive reporting is just a click away, like this list of installed software with drill down options for individual PCs

Administration

Here you can administer Intune, including configure update settings, customise alert and notification settings as well as manage administrator accounts. The Live ID account used to sign up for Intune becomes the Tenant Administrator for the account; you can then add further Service Administrators who each require their own Live ID.

One issue many people have with the concept of cloud services is the lack of control; Windows Intune comes with a 99.9% SLA which is financially backed but that won’t make you feel any better when the service is down. Microsoft offers a service status page (at http://status.manage.microsoft.com/Statuspage/servicedashboard.aspx) with a 30 day service availability history. If you use the link available in the Administration workspace the status page is customised and tells you which geographical area your subscription is hosted in.

At least if there’s a problem with your cloud service you can get some status updates easily//

There’s also a link to download the client software as well as links to documentation on how to automate the distribution of the Intune agent via Group Policy or Systems Center Configuration Manager.

In the fourth and final part we’ll look at the Intune client experience and we’ll compare Intune to other management solutions, both from Microsoft and others as well as look at where it’s going in the future.

• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• FREE: SolarWinds VM-to-Cloud Calculator – Compare VM hosting costs (0)
• Decaf – Amazon EC2 client for Android (0)
• Office 365 review – Part 8: SharePoint Online and conclusion (0)
• Office 365 review – Part 7: Lync Online (0)

The fist part of this series introduced Windows Intune. In this second part of this Windows Intune review we’ll explore the Intune user interface and discover how the different components make the solution tick.

System Overview

This workspace gives a quick look at the overall health of all monitored computers; broken down into issues with Endpoint Protection (Anti-malware), agent health, other alerts, update status as well as letting you create computer groups and view reports.

Agents that haven’t communicated for a while are flagged, to avoid that false sense of security that green ticks can give; just because there hasn’t been any information communicated back to the cloud.

Computers

Computers can be collated into groups, a computer account can belong to more than one group and you can have nested groups. The main use of groups is to target policies as well as structuring large number of accounts; whatever method makes sense can be used. For instance you could group computers based on geographical location, in my setup I divided accounts into domain and non-domain joined clients.

When a new agent is installed that computer is placed in the built in Unassigned Computers group and you can manually move it into the appropriate group (s). For each PC the OS, name and group membership is listed along with security, update and alert status. If you drill down into a particular computer account a full hardware and software inventory list is presented as well as detailed update and alert status along with any malware infections. For a particular application you can click its name to see a list of which other computers have that same program installed.

Updates

Windows Intune is your Windows Server Update Services (WSUS) server in the cloud and in this workspace you can approve or reject updates and select which products and classifications (security, critical, definition etc.) to cover. Here you’ll also find a list of all updates that are waiting to be installed as well as any problem with updates. In comparison to the non-interactive Updates report (see part 3) this view is more powerful as it allows you to drill down to whatever level of detail you require. Just as in WSUS you can create auto-approval rules to push out security updates for instance as soon as they’re released. Another common practise is to create a separate computer group with a few “guinea pig” PCs; push updates to those computers automatically and then approve the updates for the rest of the machines if no issues are discovered.

Control your Windows and Microsoft application patches as easy as in WSUS

Endpoint Protection

The Windows Intune Endpoint Protection is based on Forefront Endpoint Protection (FEP) which in my experience is a good anti-malware solution. The default policy will only install Endpoint Protection if the computer doesn’t have suitable anti malware already installed but you can change this policy and force installation which will disable the current solution.

Malware and computers with security issues are listed in two separate areas and past malware infections are kept in a list with links to information about each infection.

Remote Assistance is a very handy tool to have when your users are in a tight spot

Alerts

There are 380 alerts built into Intune although a large proportion is disabled by default. You can view all Alerts or filter the view based on the source such as Monitoring, Policy, System and Updates as well as other categories. Just in case you don’t spend your entire life staring at the Intune console you can set up Alert Notifications; currently only via email. A remote assistance request from a client computer will also raise an alert, make sure you add an email notification for that because if a user is asking for help, they generally want it NOW. You can’t change the built in alerts, nor can you add your own and they currently only cover Microsoft technologies (and hardware issues).

The list of available alerts is long indeed, I just wish I could build my own alerts

In the third instalment of this series we’ll finish the exploration of the Intune console and the different workspaces.

• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• FREE: SolarWinds VM-to-Cloud Calculator – Compare VM hosting costs (0)
• Decaf – Amazon EC2 client for Android (0)
• Office 365 review – Part 8: SharePoint Online and conclusion (0)
• Office 365 review – Part 7: Lync Online (0)

In this four part article we’ll look at Microsoft’s first foray into cloud based systems management and what Windows Intune is capable of providing.

The Windows Intune Console is easy to navigate

Most IT services and products today seem to have the word “cloud” added to their name, deservedly or not. Some companies seem to push cloud computing as the only clear way forward whereas others tout the security and control aspects of what’s called (sometimes derogatory) “legacy”, or “on-premise” computing.

The truth as always lies somewhere in-between as IT veterans know well. Most businesses, large or small will use both computing models with various hybrids and mixes for a long time to come.

Windows Intune Defined

But there’s no doubt that cloud computing is now another option when architecting IT solutions. And there’s one company that ably straddles both worlds; Microsoft. With extremely successful and mature on-premise solutions as well as emerging cloud services it’s the only vendor that offers platforms in both worlds. It’s therefore interesting to see new Microsoft cloud solutions brought to market which is some ways are competitors of its existing products. Windows Intune is one such product.

Windows Intune is a cloud based client computer management service targeted at both large and small businesses. There’s a client agent for each managed PC, antimalware (Windows Intune Endpoint Protection) built on Microsoft Forefront technology and a Windows 7 Enterprise upgrade subscription, all of which is managed from a web based management console.

The health of each managed PC is communicated centrally and alerts are raised when that health is threatened, there’s built in Remote Assistance capabilities and simple client policy management. Add to this Windows update patch control, client software and hardware inventorying and built in comprehensive reports. Windows Intune isn’t built on Active Directory and doesn’t integrate with it but will respect existing Group Policy settings.

Windows Intune Console

Let’s dive a little deeper into Intune, if you feel like tagging along there’s a 30 day free trial available here which lets you manage up to 25 PCs, although it doesn’t include the Windows 7 Enterprise subscription. Accessing the service is based on Windows Live IDs and if you’re a partner that helps other businesses manage their IT infrastructure there’s a multi account console that lets you select which company to work with. Once logged in to a particular company you’ll be greeted with a friendly Silverlight based console that’s divided into panels a ’la Outlook, these are called Workspaces in Windows Intune. To anyone familiar with Microsoft System Center products the layout is very familiar but it’s so easy to find your way around that even a part time IT person in a small business should be able to handle it.

All that is needed to start to manage PCs is a quick agent installation

The available workspaces are System Overview, Computers, Updates, Endpoint Protection, Alerts, Software, Licenses, Policy, Reports and Administration.

In the next part of this article we’ll dive into the Intune console and discover what the different parts are capable of.

• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• Microsoft Windows Intune – Part 4: The client (0)
• Microsoft Windows Intune – Part 3: Workspaces continued (0)
• Microsoft Windows Intune review – Part 2: Workspaces (0)
• Microsoft Systems Center Configuration Manager v.Next Beta 1 review – Part 3 (1)

There’s no in-place upgrade option for going from SCCM 2007 to v.Next. Fortunately Microsoft has built migration tools right into the console to help with the transition.

Migration

In a nutshell the process follows these steps: first your SCCM 2007 environment is evaluated, it has to be at the SP2 level, and then you install your new v.Next hierarchy. At the central site metadata is mapped from the old to the new so that each site is matched to its new counterpart (you’ll have to come up with new site codes, you can’t use the same ones you do today), this synching continues until you turn it off at the end of the migration so as to capture any changes in the SCCM 2007 environment.

All objects are then transitioned over using migration jobs that you can run straightaway, schedule for later or run manually when it suits you.

During the co-existence phase DPs are shared between both environments. Upgrading clients is an administrator initiated process; you can use any software deployment method of your choice. When your entire infrastructure has been migrated to v.Next you can decommission (which only means the synchronization of data stops) from the bottom of the hierarchy back up to the top. Computers and users can’t be in the same collection in v.Next so you’ll need to fix any such collections that you may have today.

Mobile

Microsoft has a product called Systems Center Mobile Device Manager 2008 (MDM) which puts smartphones into AD and lets sys admins manage them much like desktops and laptops. A cool technology that is limited to Windows Mobile 6.x so it’s probably safe to say it hasn’t been a best seller for Microsoft.

MDM functionality is being incorporated into v.Next whilst adding management support for Nokia Symbian devices (coming in beta2) including inventory, software deployment and settings management. Microsoft promises more platforms will follow; obvious targets are Windows Phone 7, iPhone and Android. There will be limited management of these platforms at RTM via a connector for Exchange Active Sync. What won’t be there at RTM unfortunately is remote control for mobile devices.

Role Based Access Control (RBAC)

Exchange 2010 pioneered a new way of doing administrative security for large applications that are managed by many people. v.Next adopts this approach and it’s fully integrated into the new console. For instance, if you have a software deployment administrator they will only be able to see that part of the console, anything else that they don’t have rights to manipulate won’t be visible.

Security roles are groupings of tasks (in beta1 there are 13 roles available); security scopes control on which objects / sites a user can perform those tasks. You can create your own security roles and security scopes.

Verdict

This is an early beta with several bits missing or announced as changing in the next beta. It’s clear however that this is a big refurbishment of config manager with many innovations sure to please businesses and sys admins alike. The thing that’s missing is PowerShell, is it possible that a new server application from Microsoft is NOT built on PowerShell? There’s no sign of it in beta1 at least.

User Centric Management should appeal to users and administrators alike whilst the new console and RBAC are obvious crowd pleasers. Broader mobile device management and a much more flexible application deployment model are sure to win over new businesses whilst existing SCCM sites will enjoy the simplified hierarchies.

• System Center 2012 – Orchestrator 2012 – Integration Packs (0)
• System Center 2012 – Orchestrator 2012 – Runbooks best practices (0)
• System Center 2012 – Orchestrator – Creating Runbooks (0)
• System Center 2012 – Orchestrator – Installation (0)
• System Center 2012 – Orchestrator Review (0)

Hands up all sys admins that love the MMC based console in SCCM 2007….. No one? Didn’t think so – it’s known to be slow in large environments.

New console

Whilst I haven’t been able to test the v.Next console in a large business it does seem snappier and easier to work with. The middle, main pane has tabs at the bottom which makes for less expanding and collapsing of the tree structure. Overall the console adopts the Outlook feel and the new “Wunderbar” (official name) in the lower left hand corner features links to Administration, Software Library, Monitoring and Assets and Compliance.

New Infrastructure

There are a number of technical restraints in SCCM 2007 which make large businesses create complex system hierarchies. If you want to have custom agent settings these are site specific so you might create another primary site just for clients where you need different settings. Or you might need to segregate administrative control per primary site.

Most of those limitations are removed in v.Next and the only reasons to have more than one primary site is scale out (about 100 000 devices per site) or fault tolerance. Administrative segregation is taken care of by Role Based Access Control (RBAC, see part3) and client agent settings can now be set by collection. Secondary sites were often deployed just to control WAN bandwidth usage, in v.Next those controls have been moved to Distribution Points (DP).

There’s a new type of site, the Central Administration Site (CAS), which is used when you have more than one primary site. CAS is only used for reporting and administration; it can’t have clients assigned to it. Replication of all config manager settings are done through SQL replication although the old file based model is still used for software and OS files.

Distribution Point groups are mostly cosmetic in SCCM 2007; in v.Next they control content replication. If you add a DP to a group it automatically receives all data from the other DPs in the group and if you add content to a group all DP members automatically receive it.

Desired Configuration Management (DCM) in SCCM 2007 reports configuration drift on managed devices; in v.Next it’s been renamed to settings management and it now goes the last mile by not only reporting on settings out of compliance with company policy but also automatically (if you so desire) remediating settings.

In the final part of this overview we’ll look at Migration, Mobile device support and Role Based Access Control.

• System Center 2012 – Orchestrator 2012 – Integration Packs (0)
• System Center 2012 – Orchestrator 2012 – Runbooks best practices (0)
• System Center 2012 – Orchestrator – Creating Runbooks (0)
• System Center 2012 – Orchestrator – Installation (0)
• System Center 2012 – Orchestrator Review (0)

Many systems administrators are familiar with Microsoft’s Systems Center Suite, relying on its various components for their day to day jobs. Operations Manager keeps tabs on the health of your infrastructure, Data Protection Manager makes sure all your (Microsoft) workloads are safely backed up, Virtual Machine Manager keeps your virtual servers and hosts in check and Configuration Manager keeps track of computer hardware and installed software.

Systems Center Configuration Manager (SCCM) 2007 was recently updated with an R3 release which added power management and a few other tweaks. In this article I’ll give an overview of the next major release of SCCM, currently called “v.Next” and explain where Microsoft is taking SCCM. This article is written on beta1; beta2 is expected in January 2011 with RTM possibly sometime mid next year.

There are major changes to the product with User Centric Management (UCM), a new management console, simpler infrastructure and administration along with a new role based security model.

User Centric Management

The enterprise IT landscape is changing for systems administrators. As if cloud computing wasn’t enough of an upheaval the consumerization of IT has well and truly taken hold. Gone are the days when all you needed to keep track of was servers, desktop computers and the occasional laptop. Today staff (especially younger employees, the “digital natives”) expect to be able to bring their own laptops, tablets and smartphones to work and access company data and applications. And mobility is truly ubiquitous with everyone expecting to be able to work whenever and wherever they choose.

v.Next adapts to this new world with User Centric Management (UCM); linking people to their Primary Devices and having one or more Primary User for each device. Assigning this user device affinity can be done manually by administrators, users themselves (if allowed), through an imported file or through SCCM collecting usage statistics.

Administrators can build rules around delivering applications to end users based on UCM; for instance if this is the users primary device, install the application as a native Windows installer but if it’s not their primary device only install an App-V version or connect to a Remote Desktop App instead.

UCM also lets users define their own work hours in the new client Software Center interface; v.Next deploys software outside these hours.

Applications Here, There and Everywhere

SCCM v.Next has a new model of distributing software; Applications takes the place of Packages (although packages are still around, for migration compatibility and “one off” scripts). An Application can be Available in which case the user has to install it (or request if it requires approval) through the new Silverlight based self-service web site called the Software Catalog. Alternatively an Application can be Required in which case SCCM will install it on the users device(s). Note that this new model is state based so if a user uninstalls a required application it will automatically be reinstalled. Each application can have one or more deployment types. In beta1 this includes Windows Installer, Script Installed, Microsoft App-V or Windows Mobile Cabinet. Most demonstrations also mention Remote Desktop App as a deployment type.

The last piece of the puzzle are Requirement Rules, these are designed to eliminate the need for complex query scripting by allowing administrators to set business or technical restraints on software deployment. These are evaluated at the time of installation; a common problem in SCCM 2007 was relying on SQL queries which might be almost a week out of date when the installation actually took place.

Applications can also have Dependencies where one application depends on another application being installed first. All software deployment is now tracked in the Monitoring node, in SCCM 2007 you had to rely on reports for tracking software installs.

In the next part of this article we’ll look at the Administrators experience and Migration.

• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 2 (1)
• System Center 2012 – Orchestrator 2012 – Integration Packs (0)
• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 1 (0)
• System Center 2012 – Orchestrator 2012 – Runbooks best practices (0)
• System Center 2012 – Orchestrator – Creating Runbooks (0)

PS Congratulations on becoming Technical Product Manager for Systems Center Operations Manager, you’re sort of straddling three products now. That would be a pretty big load?

JB The Systems Center teams in Microsoft have been hearing for a while that Management and Security, people want to deal with them as one kind of goal. So internally we’ve reorganised our teams to better align with how customers consume those technologies. So the management team which you saw in Systems Center and the security team which you saw in the Forefront line formally merged the organisations together. Different people picked up different products, to make it more organised around how customers leverages those products in data centre scenarios and client scenarios. The integration you see between Systems Center Configuration Manager and Forefront as a way to deliver antivirus and malware protection to the end user; that’s a client scenario. There’s Systems Center, a bit of Forefront but it’s there to meet the client’s needs. As opposed to, I’m a datacentre guy, I’ve always been a raised floor guy so in my space I think about servers. Monitoring your infrastructure and protecting it are really two sides of the same coin. So yes, I picked up Operations Manager, I’m really, really excited because we’re at 2007 R2 right now, we’ve been there for a while so you can imagine this is going to be a very exciting year.

PS vNext is coming

JB Yes, vNext is coming

PS I’ll be writing a review on that. I have already written the reviews on SCE and DPM 2010 so I don’t have any deeply technical questions as such. I sat in your yesterday afternoon session and I also sat in on most of your Disaster Recovery session today. I picked up quite a few things I didn’t know. So the first question, will there be a DPM 2010 plug in for SBS Aurora? You know how the Aurora console is extensible, and what we all want to add is backup? There needs to be a button in SBS Aurora, saying yes, that’s cool, I’ve got my local backup. Now I want a cloud backup as well.

JB I want that button too. So in general we’re not ready to tell you what will be there as far as that feature set goes. But if you look at what we’ve done so far DPM already has a story for SBS 2008. As for the features for products that haven’t been released yet, that’s absolutely a priority, although it might not appear as a button. Let me unpack this for you a little. The primary goal of DPM wasn’t being number one in the market, although certainly we want to be a trusted, market leading backup solution. When you’re looking at what we’re trying to solve it wasn’t necessarily being the number one backup solution. The core focus in general is around supportability and reliability of Exchange, SQL, SharePoint, Hyper-V, Windows and the client. Whenever there’s a new platform coming out, one of the things we sometimes hear from our customers is “hey I really want these features of this platform but my legacy backup solution doesn’t support it yet so I’m going to wait for that, until my legacy stuff catches up”. So one of the design goals of DPM is always making sure that our customers don’t have to wait. They know that as soon as those platforms come out there’s going to be a wholly supported and reliable backup and recovery solution for those workloads. There shouldn’t be a blocker for adopting new technology. As you can imagine, every new platform that comes out we’re always looking at making sure it’s got a reliable backup and recovery solution.

PS That sounds good. Except it’s not committing to actually putting the button in there but that’s fair enough, you work for Microsoft, you can’t talk about the things that aren’t there yet. So what’s your role in the DPM and SCE teams now that you’ve taken on SCOM?

JB By definition I’m what’s called a Technical Product Manager. In DPM I own basically “how we talk about the product” so how do we translate the features and products and help customers understand the business value? So to me it’s not about the check box, we have Live Migration support on Clustered Shared Volumes; to me it’s about helping the customer understand if you’re going to be leveraging Microsoft’s virtualization platform, and you really want to do that leveraging the High Availability components of that with features like site to site Live Migration, you need to know that there’s a reliable backup and recovery solution for it.

So I do the webcasts, I’m privileged sometime to be invited to do live speaking and this was a blessing for me, I enjoy doing this part of the job. I also write a lot of whitepapers and I manage the blogs. I do pretty much all of the evangelism from the top down about the products and because DPM and SCE has just finished their release cycles, those products, their content is pretty much complete. Their product teams are now blogging about operational issues and best practises, those kinds of things, which gives me a chance to take a deep breath. So it’ll be a few months before we start revving up for DPM vNext and SCE vNext, and what the plan is and then the TAP (Technology Adoption Program), the beta, and the RTM ship; so during this time, instead of just maintaining those products, now is the time to say, let me have something else and because Operations Manager is in a different part of its lifecycle I said yes. Operations Manager vNext will actually be the fifth Systems Center product I’ll be involved in the launch of; I’ve been with three generations of DPM, I managed file services in Windows Server 2008 and 2008 R2, components of certainly much bigger products within Microsoft, and now Operations Manager. The nice thing of course is that SCE has parts of Operations Manager within it so it’s leveraging the management packs, the auto discovery, the diagrams, and the knowledge that’s already embedded there. Those are all things I’m already familiar with from SCE so getting up to speed on the rest of Operations Manager for the Enterprise is going to be fine.

PS You didn’t hear it in the session this morning, you were talking about disaster recovery and site recovery and site resiliency. You said “we have a datacentre here and we have a datacentre here and we replicate from here to there to there, try to do that with tape” and somebody yelled out, “try do to that with the bandwidth in Australia”. And I laughed a bit because it’s true here, some of those scenarios do assume a certain amount of bandwidth that you can get at a reasonable cost elsewhere and I think that in some parts of Australia (at least) they’re going to have to stick with that courier guy with the van and the tapes because the cost per gigabyte is simply that much cheaper.

JB They might. The first design of DPM v1 (version 2006), its only job was centralised backup of branch offices. When we built it there was actually testers in Europe, which has a lot of bandwidth limitations, more constrained than the US but not quite as bad as Australia, something in the middle of the ground when DPM 2006 first came out it’s only goal was to centralise file backups so we assumed we had very thin pipes between your remote sites and back. And when I say that we really assumed a thin pipe, 56Kbps, really next to nothing. Because we could build it from the ground up, because we didn’t have this legacy architecture of taking tape and converting it to disk and that be our replication, the fact that we were just plucking blocks as they changed all really helped. Actually in most cases customers were telling us that they were happy with the bandwidth requirements. You are normally changing a lot less data than you think you are. So in some environments, it won’t work, you can’t put a golf ball through a garden hose, you need some bigger pipes to get that done.

And it may be something were you say that the majority of your data, is going to go by courier. You put the whole datacentre on tape and you use a courier to get that offsite but there’s an operational cost that comes along with that. You might translate that into some bandwidth connections and bolster that up. Moreover if you’re looking at true disaster recovery it’s not 100% of your data, I don’t care about Fred’s word documents, except for the ones you’ll be sending to my boss, so I don’t need all that stuff on day one. If I truly had a site level crisis I would argue that if you reached for the tapes from last Monday’s courier, missing some word documents might be OK. So if you focus on the top 20% of your data which truly is mission critical; now I can afford real time or near real time replication of that portion of the data and then I’ll go ahead and tolerate up to five business days loss of data on tape / disk from courier. That way the savings on those operational costs for daily courier can be used and the stuff that I actually need to resume business I can afford to put on the wire.

It’s hard for me to sign up for “you can’t use the WAN”, I don’t subscribe to that.

PS I agree, you can choose what gets replicated. You outline in your book very clearly the difference between synchronous and asynchronous replication and the costs involved. I work in the small business space running my own business. None of my customers will ever come to me and say “we want a synchronous data replication and site resiliency solution”. That’s just not going to happen.

JB Unless they read it in a book and read it out aloud; “I want a synchronous replication solution”.

PS And I’d say, that’s no problem, here’s the price tag and they’ll just go no thank you, we didn’t want that actually. We’ll buy something else.

JB And that’s what I talk about in the book, calculate the cost of lost data. If you’re a small business, the data that can’t be humanly recreated and the value of that data is enough then the cost justifies a pipe. And if it doesn’t the cost does not justify having a pipe, which was exactly the premise for that chapter: don’t buy more than you need but have an empirical way to figure out what ballpark you’re in, go out and buy it suitable solution.

PS I really like that approach, it’s good. It brings it down to the business level and that’s where you’ve got to talk about it.

JB I actually had that chapter as a hidden download PDF, so if you ever want your readers to get a taste of that, I’ll send you the PDF of just that chapter, if that’s something that they might find interesting.

PS Yes, I can think of at least one client of mine that would actually read that and have an understanding. I can think of another couple that wouldn’t have a clue but that’s alright. This is a side question but I’ll throw it in there anyway, I use Cristalink Firestreamer at one site. What do you hear about that in production? It’s running on a DPM 2007 box and I keep getting weird errors about tapes being cleaning tapes. The virtual tapes that are on the hard drive and I’m like no it’s not a cleaning tape, I promise you. It isn’t a cleaning tape because it’s just a file on a hard drive. Have you ever seen something like that?

JB No I haven’t but recognise that DPM 2007 was our first entry into automated tape management. Automated tape management wasn’t ever part of Windows, and it wasn’t part of DPM 2006 so there were a couple of things that were really quirky in our tape handling in DPM 2007. Tape management was an investment scenario in DPM 2010 so do that in-place upgrade and you might find that experience goes away along with the improvements of everything else.

PS Except I’d need Server 2008 to run it on and they run it on Server 2003,

JB The big things in DPM 2010 weren’t really about widening what we protect. It was really about how we protect it: better tape handling, better scalability, experiences like the SQL self service restore. Stuff that I talked about in the last session, better Disaster Recovery scenarios, better handling of Hyper-V, it was really about improving the experience and performance, auto healing, auto grow, a lot of “auto”.

PS I like the “auto” features.

JB A lot of “fire and forget”, makes DPM truly an Enterprise solution. What we saw in DPM 2007, customers were really excited about this whole “one throat to choke” experience, backup Microsoft with Microsoft but it didn’t scale as well as some of our larger customers wanted it to and in a couple of cases you had to continually go back and manage storage instead of DPM handling that itself. In DPM 2010 we wanted to have that reliability experience, a truly exceptional, “fire and forget”, lights out experience that gave the confidence that I’m using Microsoft to backup Microsoft and those were the business drivers. So having better tape handling is one of those things that DPM 2010 will take care of. The reason we went to Windows Server 2008 only was partly to ensure that higher ability to scale, you just can’t scale your back end backup servers on Server 2003, especially disk, it just doesn’t scale as well. And with Windows Server 2008 we get some capabilities from their disk management with storage handling. In Windows Server 2003 you could grow a volume but you couldn’t shrink it. So if you over allocated your space you just had to wait until you had consumed it. In Windows Server 2008 the shrinking of a volume is now possible. So now you can actually tune the storage which gives a couple of benefits on the operational level which Windows Server 2008 brings to the table.

PS Yes, I think most people can move forward with 2008.

JB And having a back end backup server running Windows Server 2008 with production servers on Windows Server 2003 is entirely possible. We don’t expect everyone to upgrade their entire infrastructure we just need to have the backup server up to date.

PS That’s probably not an issue for most small business customers, in this particular case all their servers are running Windows Server 2003 and there was no budget to actually buy a server for DPM 2007 so it had to be installed on an existing Iomega storage server running 2003.

JB I used to manage Storage Server.

PS Yes I know. Here’s something I’ll throw out to both of you since you’re working on Systems Center products, vNext etc. I’ve written a couple of reviews on Systems Center as a suite and it’s obviously a major focus for Microsoft. A lot of people come to you and say “management is critical”, we’ll give the hypervisor away, that’s great, the competition does as well but it’s the management, that’s where the crunch is. As soon as you’ve got more than five VMs on a single host you’ve got to start managing it. How do you manage it, whether it’s virtualization, whether it’s physical boxes, whatever. So there’s obviously a lot of focus on Systems Center, but one of the things that I found when I wrote the review, this was a while ago now, is that Systems Center Suite is still in most ways separate products. There’s a bit of overlap, like PRO packs linking SCOM to Systems Center Virtual Machine Manager and there’s a few connectors but essentially they are still more or less separate products. Is this something that’s going to alter in the future?

JB So a couple of points, the connectors are a good example, also if you look at how DPM and SCE were developed, there was no accident that those products were released within days of each other, their beta was 24 hours apart, their Release Candidates were about a week apart and the RTMs came within a week of each other. That was not an accident. Based on where those products were in their lifecycle we wanted to align their arrival to market because it made sense. When we synchronize the release cycle it makes it much easier to co-develop. Here’s one thing; remember your hands on experience with SCE? If you ever download the evaluation software for SCE 2010 it’s about 5 GB. There’s no other component in Systems Center that’s 5 GB. And the reason is that if you go to the directories for that install you actually find that there’s a build of Operations Manager 2007 R2 in it, there’s most of Virtual Machine Manager 2008 R2 and there’s all the installable bits of the distribution of WSUS 3.x in it and the fun part of it is that it’s one UI. It’s one UI that pulls the inventory information from WSUS, pulls the management packs from Operations Manager to show you a single pane of glass; this is how everything is doing. And your software distribution, you might do with your WSUS, monitoring which you might do with Operations Manager and the overview of your virtual infrastructure which is done through VMM, all of those are there for you in this single pane of glass. And that’s there today for our mid sized business customers.

So you can see that as our technologies come more into alignment and you can have that single UI framework that we have in Essentials. I don’t have any inside perspective about vNext, whether they all magically plug in or whether that’s coming in the version after vNext, but we’re telling one story in Essentials and little by little the products are talking more to each other. The management packs are also starting to be geared towards tasks, the DPM management pack has tasks embedded in it which lets you use Operations Manager as the central console to manage DPM. In some cases a lot of behaviours are in Management Packs, including Opalis by the way, you can use either Operations Manager to aggregate the actions or you can use Opalis to initiate new actions and not actually having to go to the DPM UI for them.

FD Systems Center is still a platform with a cohesive story. And sometimes you have to pick the information from different parts but it still provides the information. I’m curious to see if you’ve noticed how Systems Center has been received at Tech Ed this year, a few people mentioned it to me but pretty much everywhere regardless of the starting point of the conversation, everyone looks at what Systems Center means in terms of maximising your investment, for your platform as a whole.

JB What’s the most value of the platform, and you don’t have to stop at Systems Center itself, take a look at Forefront, Forefront Endpoint Protection is deliberately integrated into Configuration Manager. It doesn’t even have its own console per see. Configuration Manager is the back end, it’s pushing out the updates, it’s pushing the configuration for how often the clients should scan and check, what jobs to do, how often to update. Configuration Manager, as a part of Systems Center, is actually managing and controlling Forefront whose job it is to protect the whole Windows infrastructure. So little by little you’ll see more integration between the products.

PS I really like Systems Center; I really like Systems Center Virtual Machine Manager. I’ve always liked the fact that you manage VMWare with VMM. It’s cool, it’s quite competitive, and I’m just waiting for Citrix management in the next version.

Just to clarify, today if I have a Small Business Server 2008 at a client and I’m sitting back in my office I have to setup a VPN to do the backup over wire?

JB Yes, that’s correct, there has to be some form of connectivity. If you’re only protecting the files on that Small Business Server we can actually do it in an untrusted way because DPM 2010 can protect non-domain joined machines. There are a couple of other scenarios to consider there, we have a channel partner who have lots of small business clients and one of the things they’re looking at is dropping in a small appliance, a small white box into their customers environment, the white box is actually just a Hyper-V host, with one VM and that VM is a virtualized DPM server. The DPM server joins the domain of that client so that has full, trusted communications with the small business server and can backup all the workloads on that server as well as all the clients. So now we have all that data backed up to the DPM server. The host is not part of the client’s domain; it’s actually part of the reseller’s domain, so now I have a Hyper-V host with a DPM agent on it. So now I get this capability as a channel partner where I can remotely control the backups of all my customer’s sites as a service. More importantly I’m protecting the DPM server without necessarily being able to see into it so that gives me the ability to protect their data without violating the privacy of that data.

But I can still restore that DPM server so if they have a site crisis, if they’re a small business they’re not going to have a disaster recovery site, that’s grandiose for a small business. More importantly, if you’re a small business, and something goes wrong, your trusted reseller is the first people you’re going to call to get your business back up and running. Wouldn’t it be nice if they already had your data? Then the only thing they have to do is to drop in some kind of virtualisation platform and have DPM pushing data back onto it and start reconstituting it. From a phone call they can start and within 15 minutes they can have that VM server restored and be starting to put data back into that environment. If we’ve got a hotel or a conference room someplace, drop in some PCs, arrange data connectivity, we can have you back up and running. And that’s not something that a small business had access to three years ago. Certainly not five years ago. You’ve got your trusted provider, you’ve got software at a cost that’s certainly not astronomical for a mainstream small business, especially if you do it via VL pricing or for an educational customer. Now you actually get disk to disk and long distance vaulting and you get it at for a fairly small total cost.

As a service provider, one of the other things Microsoft has is something called Service Provider Licensing Agreement (SPLA) licensing where even the reseller doesn’t have to purchase the software outright, they can, I think the term is amortise, the license over time and resell that as a service which makes it even more attractive for that local reseller to become that local DR provider for their small business clients. I’m excited about that because, for our large customers, large companies they go to IronMountain, or they go to i365 or locally here in Australia there are other companies; so you’ve got options for disaster recovery to the cloud if you’re a large company. For a small company, I wouldn’t say that you don’t know who IronMountain is but you don’t have that same kind of recognition intuitively but you do know who “Paul’s reseller” is so let them provide that recovery service locally. There are some neat things that are starting to come out in this space this year.

PS I like that scenario, it’s given me something to think about. A colleague of mine who also runs his own business he’s actually doing this, he’s setting up a DPM server in his office to protect a DPM server at one of his clients and then they don’t have to worry about tapes or hard drives or anything else going offsite because it’s already going over the wire.

JB This works in small offices, let’s say you have a collaborative relationship with another business. Using IPSec you set up a tunnel between the two sites and you own the DPM server that backs up his environment and he owns the DPM server that backs up your environment. As far as you’re concerned it’s 2U somewhere in the back closet but now you have two self-standing environments that are symbiotic. In a true small business I wouldn’t be opposed to going with a small server, put it at the owner’s house, in the US at least he can write of the expense of that WAN connection (“this is part of my business infrastructure”), and now your DR site is at the owner’s house so if something happens to the office, the owner is going to want the data. I’ve been in backup for 20 years, and to me it’s always been number one goal, get the data out of there. That’s my primary passion, the data has to survive. And these days there are a lot of options for how to set that up.

PS Well if we get National Broadband Network here, if they actually build it that opens up a whole different set of scenarios. They’re talking gigabit, they already have 100 Mbps and that’s both ways.

JB I have cable to my house in the states so I think I’m like 30 Mbps down and 5 up. Sometimes I’m actually thinking that webpages are changing on their own but boy it’s fast.

PS That’s all the questions I had, it’s been great seeing you finally, after talking to each other on the phone for a couple of years and over email. Thank you also for your book, it’s a good book, this is clearly someone speaking from a lot of experience. I also work part time as a teacher so I’ll be bringing quite a few of the lessons in this book back to my students when I start teaching them about DPM 2010 in a couple of months.

FD Where do you teach?

PS Sunshine Coast TAFE, on the other side of Brisbane.

FD Has it been a good TechEd for you?

PS Yes, it’s been a great Tech Ed. This is my fourth TechEd and it’s a great way of learning but more importantly it’s a great way of networking with people. I meet a lot of really smart people here. The ability to create community and a communal buzz around products is not that easy to do but once you’ve got it going it’s one of your biggest assets.

JB I couldn’t agree more. You know when I come down for events, I would come down just to do the speaking because I love Australia but I don’t come just for the speaking. I come for the connections, I come for the “lets grab coffee”, that’s really great, we were talking earlier about my job description I’m also empowered to be the voice of community so you’ll see that I blog a lot and tweet a lot. But you’re absolutely right, the best voice we can have is not the Microsoft one, not to mention it doesn’t scale. What does works is; there were a few gentlemen in the front row of the session on DR you were in, one of them is Matt Marlor from AU Techheads and the other one is Orin Thomas who’s written books on like 20 different certifications and I met with them to find out what I can do to accelerate them here. That’s what I come for.

I can hit almost the same size audience as a webcast but I can’t connect that way.

PS Thanks guys, I really appreciate your time.

Paul started in IT back in the day of 286 PCs and DOS, he’s now a teacher, technical journalist and IT consultant in Australia. He’s an MCT, MCSE, MCSA, MCITP, and MCTS. Read more on his blog at http://tellITasITis.com.au.

• System Center 2012 – Orchestrator 2012 – Integration Packs (0)
• System Center 2012 – Orchestrator 2012 – Runbooks best practices (0)
• System Center 2012 – Orchestrator – Creating Runbooks (0)
• System Center 2012 – Orchestrator – Installation (0)
• System Center 2012 – Orchestrator Review (0)

Submitted by Jeffrey Botts, November 2007

You want network management software that works for you, not software that makes you work. You wish you could have it… without spending a fortune. Your wish is granted.

Introducing the free Spiceworks IT Desktop. Designed, tested and used by 160,000 IT pros in 185 countries (Michael’s update: Spiceworks is now used by 900,000 IT pros). Spiceworks has the everyday IT features you need:

• Automatic PC and software inventory and IT asset reporting to simplify your job.
• Network monitoring and troubleshooting to keep things running smoothly.
• Run an IT help desk for your company that’s easy to use and join the fastest-growing IT community.

It takes less than 5 minutes to get up and running. No agents. No scripts. No manual. No hassles. Just download Spiceworks and go.

Michael’s update: In addition to the above mentioned functions Spiceworks now also supports:

• Manage IT assets
• Manage changes & configurations
• Map your network
• Audit your software
• Manage power consumption
• Monitor SQL Server
• Be an MSP (Managed Service Provider)
• Talk to IT pros

Spiceworks 4.7 new features and screenshots

• Monitor and manage hosted email (more information)
• Get real-time Windows performance monitoring
• Track Dell warranty expiration dates (tracking for other manufacturers coming soon)

Spiceworks 4.6 new features and screenshots

View & Kill Processes Remotely – See and terminate device processes directly from Spiceworks without having to leave your desk or run your remote control utility

Discover Your Virtualization Servers - Automatically detect VMWare virtualization servers to get a more complete inventory of your virtual machines, along with allocated RAM and hard disk space.

Get (Even) More Out of Your Help Desk – Resize your help desk to see more tickets at once. Get email notifications to see when tickets have been assigned so you avoid duplicating efforts. Customize ticket attributes right from you smart phone or PDA.

Search & Buy CDW Products from the Toolbar* – Increase your purchasing power by searching for and instantly buying CDW products you need without leaving  Spiceworks to open a new browser. (*Only available in North America)

Get More Network Mapping Functionality – View all devices connected to your WAP, spread your network maps across your entire monitor, and locate all devices contained in your network map.

View Alerts Right in Your Spiceworks Toolbar – Pop-up notifications will keep you in the loop, whether it’s info on the latest Spiceworks plugins and reports, newly-added help desk tickets, or the latest Community posts.

Let Intel Help Save You Time & Money – Schedule your Intel vPro machines to remotely boot, suspend, or shut down to conserve power. And with Intel’s new SOL/IDEr Terminal plugin, you’ll have serial over LAN access to remotely boot and control the bios of your vPro enabled PCs.

View & Kill Processes Remotely
Discover Your Virtual Servers
Expand Your IT Help Desk
Help Desk Email Notifications
Customize Tickets On-the-Go
WAP Support for Network Maps
Network Alerts in Spiceworks Toolbar
Search & Buy CDW Products from the Toolbar
Track Power Management Consumption
See More Spiceworks (without Scrolling)
New Featured Plugin: Intel’s SOL/IDEr Terminal

Spiceworks

• FREE: Veeam ONE Free Edition – Real-time Hyper-V and VMware monitoring (0)
• FREE: FrameFlow – Web-based Windows monitoring (1)
• FREE: PDQ Inventory – Track software and hardware (1)
• Raffle: PA Server Monitor – Easy Windows server monitoring (0)
• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)

The integrated Inventory solution is one of these. It has its own tab where all inventory settings are configured and where you can access all inventory data. You can either scan all your computers manually or schedule regular scans. Desktop Central supports hardware and software inventory. You can retrieve information, such as the number of installations of a certain program or a certain device. With a few mouse clicks you can find out on which machines a certain program has been installed. Programs can be arranged in categories. My favorite feature is the Prohibited Software function. Whenever Desktop Central finds a program in this list, it will just be uninstalled.

Desktop Central comes with a good software licensing tool. To configure software licensing, you have to tell Desktop Central first which programs in your inventory database are commercial programs. These applications can then be added to a software group for which you can specify the number of purchased licenses and when they will expire. Desktop Central then generates an overview that lists all software groups with installed and available licenses.

In addition to hardware and software inventory, Desktop Central can also gather a variety of other information from your network. This data can be found in the Reporting tab. Desktop Central can generate reports about Active Directory objects (users, computers, user groups, organizational units, domains, and Group Policy objects), user logons, power management, Configurations, patch management, and inventory. I can’t describe all of Desktop Central’s reporting functions because they are quite comprehensive. I will just give you a few examples, though, so you get an idea what kind of information you can retrieve.

For instance, reports about Active Directory user objects give you an overview of the recently added users, inactive accounts, unused accounts, and 15 other reports on user objects. Reports about user logons allow you to find out things such as who is currently logged on and on what machine. It is also possible to retrieve a logon history. The inventory reports allow you to generate a list of computers of a certain age or manufacturer. You can generate software license compliance and recently installed software to name just a few. Desktop Central also supports custom reports. Reports can be exported as PDF or CSV file.

The last functions I want to discuss are the remote management tools that come with Desktop Central: Remote Control, System Tools, Wake on LAN, and Remote Shutdown. The Remote Control tool enables you to log on remotely on a machine. It is not as fast as Microsoft’s Remote Desktop Connection (RDC), but it works fine in the Intranet if you want to demonstrate something to a user or fix a problem remotely. Unlike with RDC you can have any number of simultaneous connections opened for the same computer. With the System Tools you can schedule check disk, disk clean up, and a disk defragmenter remotely on targeted machines. Wake on LAN belongs to any modern client management tool. What I like about Desktop Central’s implementation is the wake-up-speed option. So just in case your computers are a bit grouchy in the morning, you can give them a little more time to get their act together. With the Remote Shutdown utility you can shutdown, reboot, or lock computers, and you can also put them into hibernate or standby mode.

Desktop Central is a client management tool that encompasses all important desktop configuration tasks. Most small and mid-sized organizations won’t need any other tool to manage their desktop computers. Desktop Central doesn’t support OS deployment, but ZOHO Corp. offers a separate tool, ManageEngine OS Deployer, for this purpose. Together both products provide complete systems life cycle management starting from provisioning to retirement.

If you want the chance to win a license for Desktop Central, please send an email to:

with the subject ManageEngine Desktop Central. The deadline is July 12, 2009.

The winner will get licenses for 100 computers (worth $995) and the runner 50 (worth $545).

Update: Check out the new features of ManageEngine Desktop Central 7

• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• Microsoft Windows Intune – Part 4: The client (0)
• Microsoft Windows Intune – Part 3: Workspaces continued (0)
• Microsoft Windows Intune review – Part 2: Workspaces (0)
• Microsoft Windows Intune review – Part 1: Introduction (0)

This is the complete list of supported User Configurations: Alerts (password expiry, low system drive space, purge temp files), Display (wallpaper, name of computer icon, etc.), Environment Variables, Folder Redirection (Start Menu, My Documents, Desktop, etc.), Internet Explorer (home page, search page, proxy, etc.), Launch Application (run a program), MS Office (save folders, template folders, etc.), OS Search Paths, Power Management (all important settings), Secure USB (configure allowed USB device types: mouse, disk drive, etc.), Shared Printer, Custom Script (logon or logoff scripts), Drive Mapping, File Folder Operation (copy, rename, delete), Install/Uninstall Software, IP Printer (add/delete), Message Box, MS Outlook (most important settings), Permission Management (access control for files, folders, registry), Registry Settings (all hives), Security Policies (quite comprehensive, see screenshot), Shortcut (create or delete shortcuts on the desktop, start menu, quick launch bar, etc.)

I’ve listed all user Configurations here to give you an idea how comprehensive Desktop Central’s abilities are. You might have noticed that there are some settings that you could manage through Group Policy. However, as I have noted before, the main idea about Desktop Central is to use one central tool for all kinds of desktop management tasks. The tool does not support all Group Policy settings but offers the most often used ones.

The number of Computer Configurations is comparable to one of the User Configurations. I won’t list them all because I think that you’ve got the idea (see screenshot for a list). Some Configurations, such as File Folder Operations or Secure USB, are available for users and computers. I want to highlight one Computer Configuration because it is related to a topic I covered recently, that is the way the administrator account should be handled. Desktop Central allows you to remotely set the password of any account on multiple machines. In addition, you can add, remove, or modify users (all settings). It is also possible to manage user groups remotely.

Configurations can be grouped in so-called Collections. They have nothing to do with the collections you may know from other systems management solutions. The purpose of Desktop Central’s Collections is to apply multiple Configurations to a target. Thus, if you have a computer group that is supposed to share several settings, you can create a Collection of Configurations and deploy it in one step.

Desktop Central comes with a full-blown patch management solution for Windows updates. The tool currently cannot update third-party software, but it appears ZOHO Corp. is planning to add this feature because they placed a link in the user interface to a form where you can request the support for non-Microsoft software. Patches are deployed as Computer Configurations.

The main difference to other Configurations is that there is a special tab that offers detailed reports about the update status of all the computers in the network. For example, you can generate a list of all healthy, vulnerable, highly vulnerable, or scanned computers. Furthermore, you can schedule tasks to scan clients for missing patches, download updates, or deploy patches. It also is possible to assign one or multiple specific updates to configurable targets.

Like patch management, software deployment has its own tab in Desktop Central’s user interface. As noted before, a software deployment task can be a User or Computer Configuration. The software deployment tab lists all software deployment Configurations, regardless of their type.

This is also the place where you can configure packages. Packages can consist of MSIs or other executables together with a few settings, like scripts, that have to be executed before or after the installations.

It is interesting to note that installation files can either be placed on a network share or on a Web server. The latter option allows you to deploy software via HTTP. The software installation Configuration enables you to schedule deployment and to decide whether the installation takes place during the startup process or afterwards. You can also configure if the machine has to reboot afterwards or not.

Like with all other Configurations, software installation tasks are performed every 90 minutes or during startup if it is a Computer Configuration or when the user logs on if it is a User Configuration.

In my next post, I will discuss Desktop Central’s inventory, reporting, and remote control features.

If you want the chance to win a license (worth $995) for Desktop Central, please send an email to:

with the subject ManageEngine Desktop Central. The deadline is July 12, 2009.

It would be great if you could answer the is question:

What type of reports should a client management tool have?

Update: Check out the new features of ManageEngine Desktop Central 7

• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• Microsoft Windows Intune – Part 4: The client (0)
• Microsoft Windows Intune – Part 3: Workspaces continued (0)
• Microsoft Windows Intune review – Part 2: Workspaces (0)
• Microsoft Windows Intune review – Part 1: Introduction (0)

with the subject line ManageEngine Desktop Central. Please, add your name and the name of your organization. The deadline is July 12, 2009.

It would be great if you also answer this question:

What type of reports should a client management tool have?

Since ManageEngine Desktop Central has quite a few features, I will introduce this web-based Windows management software by three articles.

I should mention that there also is a free version that you can download without registering. Its main limitation is that it only supports up to 10 computers. There also is a Standard Edition which lacks some of the features. This article is about the Professional Edition. Please check out the comparison table to learn about the differences between the Standard and the Professional Edition.

Note that ZOHO Corp. offers a product called Desktop Central Free Windows Tools, which was added to the 4sysops list of free admin tools a while back. Even though the name sounds similar, it is a completely different utility. So don’t confuse it with the tool discussed here, ManageEngine Desktop Central, which is a much more sophisticated client management solution. The following only refers to “Desktop Central.”

Installing Desktop Central takes just a matter of minutes. You can install it on a desktop machine (Windows 2000 or higher) or on a server. I recommend the latter, especially if multiple administrators are supposed to use the tool. There are no special requirements. The tool supports Active Directory, but it can also be used in a workgroup environment.

You must install agents on the machines you want to manage. Some of Desktop Central’s features would not be possible without agents and deploying them is fairly easy. You only have to select the domain or Active Directory containers and let Desktop Central do the rest. Desktop Central comes with a script that you can execute on client computers to adjust the desktop firewall settings.

If a computer is not online while you trying to install the agent, Desktop Central will mark the machine accordingly. You can retry deployment on those machines with just a mouse click. Once the agent is installed, Desktop Central will always be aware of which computers are offline and perform remaining tasks as soon as the computer starts up or a user logs on.

Destkop Central is managed through an easy-to-use Web interface. I skimmed over the manual, but I only needed it once during my tests. This is astonishing as the tool’s capabilities are quite comprehensive. It has the following features: Software Deployment, Patch Management, Service Pack Installation, Asset Management, Software Inventory, Configurations, Security Policies, Remote Control, Windows Tools, Active Directory Reports, and User Logon Report.

I will discuss these features in the next two articles. Today, I just want to outline the concept behind Desktop Central because it differs slightly from other system management solutions. Essentially, all tasks you perform with Desktop Central are Configurations. A Configuration is a certain desired state of the targeted desktops. It can be a program you want to deploy or a specific desktop setting, like a firewall configuration. As different as these tasks may seem, they are handled the same way with Desktop Central. This makes the tool quite effective since you only have to learn one user interface to manage all aspects of your client computers.

There is another important difference compared to most other desktop management solutions. It is how the targets for a specific Configuration are defined. Many systems management tools use collections, that is, computer groups with certain properties, such as an OS version or specific hardware configuration, to target machines. Desktop Central does not work that way. Instead, targets are mostly based on Active Directory objects: sites, domains, organizational units, user groups, and specific users. In particular the possibility to target users instead of computers is an interesting option. This allows you to deploy a certain program or special security settings whenever a specific user logs on to a new machine.

But perhaps you don’t want Office to be installed when the user logs on to a Terminal Server. For this, Desktop Central allows you to define exclusions. The properties that can be used for exclusions are more specific than those for targets. For instance, you can exclude IP address ranges, operating system versions, and machine types (servers, desktops, notebooks, etc.)

In my next article I will discuss Desktop Central’s client configuration features.

Update: Check out the new features of ManageEngine Desktop Central 7

• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• Microsoft Windows Intune – Part 4: The client (0)
• Microsoft Windows Intune – Part 3: Workspaces continued (0)
• Microsoft Windows Intune review – Part 2: Workspaces (0)
• Microsoft Windows Intune review – Part 1: Introduction (0)

In the future, you will have the chance to win other admin tools as I am planning to run such contests frequently. I created a page that lists all 4sysops prize games. At the moment you have the chance to win a license of AutoAdministrator 2.0, a nifty tool that lets you automate all kinds of typical Windows administration tasks. There will be more tools to come soon.

Below are some of the responses of the participants in the Admin Arsenal contest. I want to say thanks to all who agreed to allow me to publish their answers to this question:

Describe the biggest challenge that you face as a Windows system administrator.

Feel free to post your answer as a comment to this article. I know that quite a few vendors of admin tools read this blog. Chances are that one of them will implement your ideas.

Answers of the Admin Arsenal contest:

Working with folder/share security is the biggest challenge for me.

—

One of the biggest challenges I face as a Windows sysadmin is the combination of license management and software inventory. How many people have the latest version of Adobe Pro? Who are they? Do they really need it? How many of my licenses have I used? How much is this costing me?

All questions I ask myself very often without a great way to answer them. Of course I’m not the only one asking about this, management is too. So I don’t just need to see the raw data myself, I need to compile it into a sort able, comprehensive, rich report and deliver it to my superiors.

Short and sweet, that is by far my biggest challenge.

—

I would say that my biggest challenge, or maybe just the biggest nuisance, as a Windows System Administrator is managing deployment of third-party updates in an organized fashion. There’s nothing more aggravating than having to whip up MSI installers and transformations for every new patch that comes out for Acrobat Reader, Java, Shockwave player, Flash, Quicktime, and so forth, and then configure a GPO. Plus, determining whether these installs were successful is a pain since you have to look through logs on each machine, or else just drop by and see what things look like. I dream of the day that there is a tool as easy to use as WSUS for this purpose.

By comparison, sifting through server logs and making rule changes on our firewalls seems downright easy and straightforward. Software like MS’s SCCM or Symantec’s equivalent are reportedly bloated, not to mention very expensive, so I am intrigued by Admin Arsenal.

—

Protecting USB ports, without having to spend a fortune, but still support AD integration.

—

Since we are a non-profit, the biggest challenge I face is working within incredibly tight budget requirements. Beyond that, the biggest challenge we have is managing offsite users, and making sure that all systems have the latest software/patches. Also, handling software updates and patches for laptop users who travel very frequently, thus making it hard to schedule updates, etc. Right now we are checking things by hand when we need to, and a number of systems are not getting updated correctly.

—

For me, the biggest problem is keeping plug-ins and add-ons up to date while having users run without admin privileges. By add-ons, I mean:

Flash, Java, Adobe Updater, Windows Live, Google Earth and Sketchup, etc.

It seems that every time one of these applications has a new update come out, I have to figure out a new way to deploy the update. Sometimes they show up as .msu, .msi, .exe, self-extracting zip, etc. Or, in the case of Windows Live, they don’t release an MSI. You have to download the Live installer, select the app, then find the msi on your PC. Then the msi is sometimes missing components to make the full app work. What a hassle!

It would really save a lot of time if these companies would recognize that companies would like to use their products and provide simple msi’s for deployment.

—

Just one? That’s tough.. seems to shift from day to day.

Personally I find that just keeping up with the tidal wave of new tools, methods, tricks, etc is the greatest challenge. Even worse when I am completely new to a particular concept. For example I’ve been a sys admin for 15 years and only now I’m considering changing OS deployment methods.

Rather than using sysprep/ghost/boot CD I would like to shift to MDT/ImageX/PXE boot (WDS). Getting up to speed with the suite of tools available is like drinking from a fire hose. I see lots of great stuff on your site that I would love to leverage but, I don’t have the foundation of knowledge of the infrastructure in place yet. It’s like reading about the advantages of the HOV lane on the highway without knowing how to drive.

More related to the tool you are focused on, I think that when a user complains that a machine is “slow” or “hiccupping” for some unknown reason -especially in a random pattern. It’s difficult to diagnose and repair such issues in less time that it takes to rebuild a machine which leaves me unsatisfied.

—

My biggest challenge as a Windows Sys Admin is to hardware inventory monitoring. There are a number of different tools that are available to manage hardware. However none that I have tried are good. Admin Arsenal will be very effective in accomplishing this task.

—

The biggest challenge I face in managing my Windows network is change management on the desktops and servers.

When a workstation or Citrix server behaves differently, I want to know how the software versions differ, and how key parts of the registry might have been modified, like the Session Manager keys for memory management, or what has changed with the many, many AutoRun keys, or what drivers (which actually get loaded) have changed versions or file dates.

• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• Microsoft Windows Intune – Part 4: The client (0)
• Microsoft Windows Intune – Part 3: Workspaces continued (0)
• Microsoft Windows Intune review – Part 2: Workspaces (0)
• Microsoft Windows Intune review – Part 1: Introduction (0)

Online Status

Before you perform a particular action, it is advisable to check whether the relevant computers are available. With AutoAdministrator, you can ping any number of computers with just two mouse clicks. You can configure the packet count, the packet size, the required success rate, and the maximum roundtrip time. The latter two options determine whether a machine is flagged as available or whether you receive an error message.

Services

This function is certainly one of AutoAdministrator’s highlights. Managing system services on multiple machines is a feature that many expensive system management solutions lack. AutoAdministrator enables you to query, start, stop, continue, pause, and restart services. Furthermore, you can configure the startup type remotely. You can, for example, use this feature to set the startup type of the Remote Registry service on all your machines to automatic, to ensure that you can use all of the features of AutoAdministrator. It is also possible to remove services, or to configure their logon account.

AutoAdministrator displays only services that are available on the computer where AutoAdministrator has been installed. However, if you want to remotely configure the services of third party applications that are not installed on your PC, you can just enter the service name. You can find the service name in the service properties. Don’t mix it up with the display name.

Registry

Another useful feature of AutoAdministrator is its remote registry editing function. You can add or change the value of the registry key types REG_DWORD, REG_SZ, and REG_EXPAND_SZ on multiple machines, regardless of the Windows version they employ. You can also read, delete, or copy REG_DWORD keys or values. AutoAdministrator doesn’t, however, allow you to browse the registry. That is, you have to know the exact key name you want to edit. I recommend using the copy key name function of Windows’ registry editor. This way, you can just copy and paste those long key paths. Make sure that you delete the main key (e.g. HKEY_LOCAL_MACHINE), which is provided by AutoAdministrator.

File Management

AutoAdministrator’s File Management feature enables you to send files to multiple remote computers. Similar tasks are usually accomplished by using login scripts. The advantage of using AutoAdministrator instead is that you can copy files with admin rights to any location without much hassle. Moreover, you can be sure that the files reach their destination without delay. AutoAdministrator is able to create a directory structure automatically if it is not yet available on the remote machines. You can also configure it to overwrite existing files.

File Information

The File Information function allows you to query file meta-data on multiple remote machines. You can retrieve the size, attributes, modification time, version, company, and description of any specific file. AutoAdministrator also enables you to calculate several checksums (CRC-32, MD5, SHA-1, SHA-256). There are a number of situations in which this feature can prove to be very useful. For instance, if there is a virus outbreak for which your anti-virus software doesn’t yet have the appropriate signatures, you can identify the machines that have been infected by using AutoAdministrator, and then use its file management feature to overwrite the infected files.

Logons

With this feature, you can retrieve information about users who are logged on to remote hosts. As usual, AutoAdministrator will display the retrieved information beside each computer name in its user interface. It is also possible to just count the users who are logged on, which could be useful in a Terminal Server environment.

Shutdown/Reboot

This function lets you shut down or reboot multiple computers in your network. You can configure a timeout period, after which the computers will shut down. AutoAdministrator will notify users with a message which you can configure. It is possible to force open applications to close and you can also cancel shutdowns remotely.

ODBC

Open Database Connectivity (ODBC) is a standard for moving data from one type of database to another. You can use AutoAdministrator to query, copy, and delete a System DSN (Data Source Name) The System DSN you want to manage has to be installed on the PC where you run AutoAdministrator. It is also possible to copy the corresponding drivers to remote computers, overwrite existing settings, and replace locked files during the next reboot. Be careful with this feature. AutoAdministrator has no “undo” function.

AutoAdministrator’s functions are quite varied. You can solve many different Windows administration problems with it. It is like a spanner set. You might not know what you will need it for next time, but you do know that it is an essential part of every toolbox. Considering that AutoAdministrator costs only $69, I think it belongs in any Windows admin’s toolbox.

If you would like to have the chance to win of one of the ten licenses, please send an email with the subject “AutoAdministrator” to

Don’t hesitate to send me an email if you already took part in the last contest. By the way, chances are higher than you might think that you are the one who will get a free copy of AutoAdministrator. This is not a TV show. The deadline is May 22, 2009.

• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• Microsoft Windows Intune – Part 4: The client (0)
• Microsoft Windows Intune – Part 3: Workspaces continued (0)
• Microsoft Windows Intune review – Part 2: Workspaces (0)
• Microsoft Windows Intune review – Part 1: Introduction (0)

AutoAdministrator 2.0 lets you query or manage nine different settings on multiple computers: Services (query and edit services), Password (manage user passwords), Registry (view or change registry values), File Management (copy and delete files and folders), File Information (view file details), Logons (view users logged on), Shutdown/Reboot, Online Status (ping hosts), and ODBC (query and manage DSNs).

Installing AutoAdministrator will take you only a few seconds. It officially runs on Windows 2000, Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008, but I had no problem with it on Windows 7. Its console supports English and German. For managed computers, there is no agent required.

For certain features, the Remote Registry service has to be running on managed machines. This is not, however, by default, and you can use AutoAdministrator to start this service on all your machines. I will explain later how this works. You also have to make sure that Windows Firewall isn’t in your way. To do so, you must allow File and Printer Sharing on all machines for your PC.

AutoAdministrator is very easy-to-use and requires no tutorial or manual. As you can see in the screenshot above, all the computers in your network can be seen in the right pane, the operations are selected by using the task bar, and settings can be configured in the left pane. The results of your operations are displayed right beside the corresponding computer. It is also possible to log all results in a text file.

AutoAdministrator scans your network for computers and also lets you access Active Directory to find computer objects. If you work in a Windows domain I recommend using domain administrator account to manage remote computers. AutoAdministrator allows you to work with alternate credentials.

It is possible to arrange PCs in Custom Groups by dragging one or more machines to group’s container. Custom Groups can be saved to a file, which allows you to repeat certain actions on specific computers at a later time. It is also possible to save profiles for common tasks. To query or update multiple computers, you can select each computer separately, if you want to target only a few machines, or you can query computers in the Custom Groups or in Active Directory containers.

In my next post, I will discuss AutoAdministrator’s management features.

If you would like to have the chance to win of one of the ten licenses that NETIKUS.NET is offering 4sysops readers, please send an email with “AutoAdministrator” in the subject line” to:

Feel free to write a few words about who you are and what you do. The deadline is May 22, 2009.

• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• Microsoft Windows Intune – Part 4: The client (0)
• Microsoft Windows Intune – Part 3: Workspaces continued (0)
• Microsoft Windows Intune review – Part 2: Workspaces (0)
• Microsoft Windows Intune review – Part 1: Introduction (0)

Software deployment is fairly easy with Admin Arsenal. You just have to select a collection and choose the MSI, MSU, or EXE file. It is also possible to remotely install software on a single computer or multiple computers by selecting each computer separately. Admin Arsenal supports unattended installations, you can uninstall or repair software, and it is possible to restart computers after an installation, if necessary. All prior remote installations are listed in the deployment interface.

Admin Arsenal starts immediately with the installation on all selected computers, which means there will be no delays, as you might know from enterprise software deployment solutions. The installation will fail if a computer isn’t online. Admin Arsenal won’t try again later; thus you must ensure that all machines are reachable before you start the deployment process. Because Admin Arsenal supports Wake on LAN, this shouldn’t be a problem for small and mid-sized networks.

Apart from Wake on LAN, Admin Arsenal has the following remote management features: reboot/shutdown, kill processes, start/stop/pause services, and remote command.

Remote command allows you to execute a command on one or multiple machines. The command has to be available on the remote machines and its directory path has to be stored in the Windows Path variable. Note that Remote Command is not a remote command prompt; that is, if the command requires a user’s input, it will hang on the remote machines. However, you can see the command’s output in Admin Arsenal’s Remote Command window.

Admin Arsenal also enables you to launch common Windows management tools such as Remote Desktop, Remote Assistance, VNC, Computer Management, and Event Viewer.

If multiple administrators are supposed to use Admin Arsenal, then you should install the tool on a server and use it in a Terminal Services session. This way, all administrators will use the same collections and inventory database. You also can install the tool on your desktop if you prefer working with your own database. But then you should take into account that you will generate more network traffic because each installed instance will scan all your computers.

Admin Arsenal is a system management tool for SMBs that can make a Windows administrator’s life easier. The user interface is well thought-out. During my test, I consulted the manual only once or twice. You can use the tool immediately just like you would use a TV remote control.

If If you would like to have a chance to win one of the five licenses, you only have to respond to the following:

Describe the biggest challenge that you face as a Windows system administrator.

Please send your response to:

• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 2 (1)
• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 1 (0)
• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• Windows deployment preflight checks – Part 2: The script (0)
• Windows deployment preflight checks – Part 1: Introduction (2)

Admin Arsenal offers the most important systems management functions: software and hardware inventory, software deployment, and remote management. Furthermore, it has essential monitoring features such as performance counters and event log monitoring. It doesn’t support OS deployment or patch management; however, considering that Microsoft offers two “free” SMB tools for this purpose, i.e., Windows Deployment Services (WDS) and Windows Server Update Services (WSUS), this is not really a shortcoming.

Admin Arsenal supports all Windows versions after Windows 2000, and the administration console requires .NET 2.0. All managed computers have to be Active Directory domain members. Installing Admin Arsenal is only a matter of minutes. The configuration wizard initializes the tool in a few steps. You just have to select the Windows domain, configure the e-mail address to which Admin Arsenal will send alerts, and specify the account for the background service. Best of all is that you don’t have to deploy agents to client computers.

What I like about Admin Arsenal is that it uses Active Directory to discover computers. Thus it doesn’t have to scan the network for new clients. Moreover, Admin Arsenal doesn’t maintain a separate database for computer objects. The advantage of this is that it can discover machines that are offline and, whenever you add a new domain member, Admin Arsenal has immediate access to it. By the way, this is what I dislike about enterprise systems management solutions such as Microsoft Configuration Manager. Client discovery is sluggish and there is always a discrepancy between the computer objects in Active Directory and the internal database.

Admin Arsenal also has its own database, where it stores inventory data. The one-way synchronization interval is configurable and is 15 minutes by default. You can also determine how often client computers are scanned for software and hardware changes. Inventory takes place once each day and online status (heartbeat) is checked every five minutes by default.

In my next posts I will describe Admin Arsenal’s inventory, software deployment, management, and monitoring features. Don’t hesitate to try the tool yourself in the meantime. You don’t even have to register to download the free trial.

If you would like to have a chance to win one of the five licenses, you only have to respond to the following:

Describe the biggest challenge that you face as a Windows system administrator.

Your answer will help Brisworks improve Admin Arsenal. Please send your response to with your name and the name of your organization to:

I will draw lots among all submissions to decide who gets the sponsored licenses. The deadline is April 30, 2009.

• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 2 (1)
• Raffle: SmartDeploy Enterprise – Easy OS deployment – Part 1 (0)
• FREE: SCCM Client Actions Tool (SCCM CAT) – Manage Configuration Manager clients (4)
• Windows deployment preflight checks – Part 2: The script (0)
• Windows deployment preflight checks – Part 1: Introduction (2)