6451B ENU Beta Trainer Handbook Volume1

OFFICIAL MICROSOFT LEARNING PRODUCT
6451B
Planning, Deploying, and
Managing Microsoft® System
Center Configuration Manager
2007 R2
Be sure to access the extended learning content on your

Course Companion CD enclosed on the back cover of the book.
ii Planning, Deploying, and Managing Microsoft® System Center Configuration Manager 2007 R2
Information in this document, including URL and other Internet Web site references, is subject to
change without notice. Unless otherwise noted, the example companies, organizations, products,
domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious,
and no association with any real company, organization, product, domain name, e-mail address,
logo, person, place or event is intended or should be inferred. Complying with all applicable
copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part
of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted
in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for
any purpose, without the express written permission of Microsoft Corporation.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual
property rights covering subject matter in this document. Except as expressly provided in any
written license agreement from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual property.
The names of manufacturers, products, or URLs are provided for informational purposes only and
Microsoft makes no representations and warranties, either expressed, implied, or statutory,
regarding these manufacturers or the use of the products with any Microsoft technologies. The
inclusion of a manufacturer or product does not imply endorsement of Microsoft of the
manufacturer or product. Links may be provided to third party sites. Such sites are not under the
control of Microsoft and Microsoft is not responsible for the contents of any linked site or any link
contained in a linked site, or any changes or updates to such sites. Microsoft is not responsible for
webcasting or any other form of transmission received from any linked site. Microsoft is providing
these links to you only as a convenience, and the inclusion of any link does not imply endorsement
of Microsoft of the site or the products contained therein.
© 2010 Microsoft Corporation. All rights reserved.
Microsoft, Microsoft Press, Access, Active Directory, ActiveSync, ActiveX, Authenticode, Entourage,
Excel, Forefront, Hyper-V, InfoPath, Internet Explorer, MS, MSDN, Outlook, PowerPoint, SharePoint,
SmartScreen, SoftGrid, SQL Server, Visio, Visual C++, Win32, Windows, Windows Live, Windows
Media, Windows Mobile, Windows NT, Windows PowerShell, Windows Server, and Windows Vista
are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or
other countries.
All other trademarks are property of their respective owners.
Technical Reviewer: Steve Bobosky
Product Number: 6451B
Released: 04/2010
MICROSOFT LICENSE TERMS
OFFICIAL MICROSOFT LEARNING PRODUCTS - TRAINER
EDITION – Pre-Release and Final Release Versions
These license terms are an agreement between Microsoft Corporation and you. Please read them. They
apply to the Licensed Content named above, which includes the media on which you received it, if any. The
terms also apply to any Microsoft
• updates,
• supplements,
• Internet-based services, and
• support services
for this Licensed Content, unless other terms accompany those items. If so, those terms apply.
By using the Licensed Content, you accept these terms. If you do not accept them, do not use
the Licensed Content.
If you comply with these license terms, you have the rights below.
1. DEFINITIONS.
a. “Academic Materials” means the printed or electronic documentation such as manuals,
workbooks, white papers, press releases, datasheets, and FAQs which may be included in the
Licensed Content.
b. “Authorized Learning Center(s)” means a Microsoft Certified Partner for Learning Solutions
location, an IT Academy location, or such other entity as Microsoft may designate from time to time.
c. “Authorized Training Session(s)” means those training sessions authorized by Microsoft and
conducted at or through Authorized Learning Centers by a Trainer providing training to Students
solely on Official Microsoft Learning Products (formerly known as Microsoft Official Curriculum or
“MOC”) and Microsoft Dynamics Learning Products (formerly know as Microsoft Business Solutions
Courseware). Each Authorized Training Session will provide training on the subject matter of one
(1) Course.
d. “Course” means one of the courses using Licensed Content offered by an Authorized Learning
Center during an Authorized Training Session, each of which provides training on a particular
Microsoft technology subject matter.
e. “Device(s)” means a single computer, device, workstation, terminal, or other digital electronic or
analog device.
f. “Licensed Content” means the materials accompanying these license terms. The Licensed
Content may include, but is not limited to, the following elements: (i) Trainer Content, (ii) Student
Content, (iii) classroom setup guide, and (iv) Software. There are different and separate
components of the Licensed Content for each Course.
g. “Software” means the Virtual Machines and Virtual Hard Disks, or other software applications that
may be included with the Licensed Content.
h. “Student(s)” means a student duly enrolled for an Authorized Training Session at your location.
i. “Student Content” means the learning materials accompanying these license terms that are for
use by Students and Trainers during an Authorized Training Session. Student Content may include
labs, simulations, and courseware files for a Course.
j. “Trainer(s)” means a) a person who is duly certified by Microsoft as a Microsoft Certified Trainer
and b) such other individual as authorized in writing by Microsoft and has been engaged by an
Authorized Learning Center to teach or instruct an Authorized Training Session to Students on its
behalf.
k. “Trainer Content” means the materials accompanying these license terms that are for use by
Trainers and Students, as applicable, solely during an Authorized Training Session. Trainer Content
may include Virtual Machines, Virtual Hard Disks, Microsoft PowerPoint files, instructor notes, and
demonstration guides and script files for a Course.
l. “Virtual Hard Disks” means Microsoft Software that is comprised of virtualized hard disks (such as
a base virtual hard disk or differencing disks) for a Virtual Machine that can be loaded onto a single
computer or other device in order to allow end-users to run multiple operating systems concurrently.
For the purposes of these license terms, Virtual Hard Disks will be considered “Trainer Content”.
m. “Virtual Machine” means a virtualized computing experience, created and accessed using
Microsoft® Virtual PC or Microsoft® Virtual Server software that consists of a virtualized hardware
environment, one or more Virtual Hard Disks, and a configuration file setting the parameters of the
virtualized hardware environment (e.g., RAM). For the purposes of these license terms, Virtual Hard
Disks will be considered “Trainer Content”.
n. “you” means the Authorized Learning Center or Trainer, as applicable, that has agreed to these
license terms.
2. OVERVIEW.
Licensed Content. The Licensed Content includes Software, Academic Materials (online and
electronic), Trainer Content, Student Content, classroom setup guide, and associated media.
License Model. The Licensed Content is licensed on a per copy per Authorized Learning Center
location or per Trainer basis.
3. INSTALLATION AND USE RIGHTS.
a. Authorized Learning Centers and Trainers: For each Authorized Training Session, you
may:
i. either install individual copies of the relevant Licensed Content on classroom Devices only for
use by Students enrolled in and the Trainer delivering the Authorized Training Session, provided
that the number of copies in use does not exceed the number of Students enrolled in and the
Trainer delivering the Authorized Training Session, OR
ii. install one copy of the relevant Licensed Content on a network server only for access by
classroom Devices and only for use by Students enrolled in and the Trainer delivering the
Authorized Training Session, provided that the number of Devices accessing the Licensed
Content on such server does not exceed the number of Students enrolled in and the Trainer
delivering the Authorized Training Session.
iii. and allow the Students enrolled in and the Trainer delivering the Authorized Training Session to
use the Licensed Content that you install in accordance with (ii) or (ii) above during such
Authorized Training Session in accordance with these license terms.
i. Separation of Components. The components of the Licensed Content are licensed as a single
unit. You may not separate the components and install them on different Devices.
ii. Third Party Programs. The Licensed Content may contain third party programs. These license
terms will apply to the use of those third party programs, unless other terms accompany those
programs.
b. Trainers:
i. Trainers may Use the Licensed Content that you install or that is installed by an Authorized
Learning Center on a classroom Device to deliver an Authorized Training Session.
ii. Trainers may also Use a copy of the Licensed Content as follows:
A. Licensed Device. The licensed Device is the Device on which you Use the Licensed Content.
You may install and Use one copy of the Licensed Content on the licensed Device solely for
your own personal training Use and for preparation of an Authorized Training Session.
B. Portable Device. You may install another copy on a portable device solely for your own
personal training Use and for preparation of an Authorized Training Session.
4. PRE-RELEASE VERSIONS. If this is a pre-release (“beta”) version, in addition to the other provisions
in this agreement, these terms also apply:
a. Pre-Release Licensed Content. This Licensed Content is a pre-release version. It may not
contain the same information and/or work the way a final version of the Licensed Content will. We
may change it for the final, commercial version. We also may not release a commercial version.
You will clearly and conspicuously inform any Students who participate in each Authorized Training
Session of the foregoing; and, that you or Microsoft are under no obligation to provide them with
any further content, including but not limited to the final released version of the Licensed Content
for the Course.
b. Feedback. If you agree to give feedback about the Licensed Content to Microsoft, you give to
Microsoft, without charge, the right to use, share and commercialize your feedback in any way and
for any purpose. You also give to third parties, without charge, any patent rights needed for their
products, technologies and services to use or interface with any specific parts of a Microsoft
software, Licensed Content, or service that includes the feedback. You will not give feedback that is
subject to a license that requires Microsoft to license its software or documentation to third parties
because we include your feedback in them. These rights survive this agreement.
c. Confidential Information. The Licensed Content, including any viewer, user interface, features
and documentation that may be included with the Licensed Content, is confidential and proprietary
to Microsoft and its suppliers.
i. Use. For five years after installation of the Licensed Content or its commercial release,
whichever is first, you may not disclose confidential information to third parties. You may
disclose confidential information only to your employees and consultants who need to know
the information. You must have written agreements with them that protect the confidential
information at least as much as this agreement.
ii. Survival. Your duty to protect confidential information survives this agreement.
iii. Exclusions. You may disclose confidential information in response to a judicial or
governmental order. You must first give written notice to Microsoft to allow it to seek a
protective order or otherwise protect the information. Confidential information does not
include information that
• becomes publicly known through no wrongful act;
• you received from a third party who did not breach confidentiality obligations to
Microsoft or its suppliers; or
• you developed independently.
d. Term. The term of this agreement for pre-release versions is (i) the date which Microsoft informs
you is the end date for using the beta version, or (ii) the commercial release of the final release
version of the Licensed Content, whichever is first (“beta term”).
e. Use. You will cease using all copies of the beta version upon expiration or termination of the beta
term, and will destroy all copies of same in the possession or under your control and/or in the
possession or under the control of any Trainers who have received copies of the pre-released
version.
f. Copies. Microsoft will inform Authorized Learning Centers if they may make copies of the beta
version (in either print and/or CD version) and distribute such copies to Students and/or Trainers. If
Microsoft allows such distribution, you will follow any additional terms that Microsoft provides to you
for such copies and distribution.
5. ADDITIONAL LICENSING REQUIREMENTS AND/OR USE RIGHTS.
a. Authorized Learning Centers and Trainers:
i. Software.
ii. Virtual Hard Disks. The Licensed Content may contain versions of Microsoft XP, Microsoft
Windows Vista, Windows Server 2003, Windows Server 2008, and Windows 2000 Advanced
Server and/or other Microsoft products which are provided in Virtual Hard Disks.
A. If the Virtual Hard Disks and the labs are launched through the Microsoft
Learning Lab Launcher, then these terms apply:
Time-Sensitive Software. If the Software is not reset, it will stop running based upon the
time indicated on the install of the Virtual Machines (between 30 and 500 days after you
install it). You will not receive notice before it stops running. You may not be able to
access data used or information saved with the Virtual Machines when it stops running and
may be forced to reset these Virtual Machines to their original state. You must remove the
Software from the Devices at the end of each Authorized Training Session and reinstall and
launch it prior to the beginning of the next Authorized Training Session.
B. If the Virtual Hard Disks require a product key to launch, then these terms
apply:
Microsoft will deactivate the operating system associated with each Virtual Hard Disk.
Before installing any Virtual Hard Disks on classroom Devices for use during an Authorized
Training Session, you will obtain from Microsoft a product key for the operating system
software for the Virtual Hard Disks and will activate such Software with Microsoft using such
product key.
C. These terms apply to all Virtual Machines and Virtual Hard Disks:
You may only use the Virtual Machines and Virtual Hard Disks if you comply with
the terms and conditions of this agreement and the following security
requirements:
o You may not install Virtual Machines and Virtual Hard Disks on portable Devices or
Devices that are accessible to other networks.
o You must remove Virtual Machines and Virtual Hard Disks from all classroom Devices at
the end of each Authorized Training Session, except those held at Microsoft Certified
Partners for Learning Solutions locations.
o You must remove the differencing drive portions of the Virtual Hard Disks from all
classroom Devices at the end of each Authorized Training Session at Microsoft Certified
Partners for Learning Solutions locations.
o You will ensure that the Virtual Machines and Virtual Hard Disks are not copied or
downloaded from Devices on which you installed them.
o You will strictly comply with all Microsoft instructions relating to installation, use,
activation and deactivation, and security of Virtual Machines and Virtual Hard Disks.
o You may not modify the Virtual Machines and Virtual Hard Disks or any contents
thereof.
o You may not reproduce or redistribute the Virtual Machines or Virtual Hard Disks.
ii. Classroom Setup Guide. You will assure any Licensed Content installed for use during an
Authorized Training Session will be done in accordance with the classroom set-up guide for the
Course.
iii. Media Elements and Templates. You may allow Trainers and Students to use images, clip
art, animations, sounds, music, shapes, video clips and templates provided with the Licensed
Content solely in an Authorized Training Session. If Trainers have their own copy of the
Licensed Content, they may use Media Elements for their personal training use.
iv. iv Evaluation Software. Any Software that is included in the Student Content designated as
“Evaluation Software” may be used by Students solely for their personal training outside of the
Authorized Training Session.
b. Trainers Only:
i. Use of PowerPoint Slide Deck Templates. The Trainer Content may include Microsoft
PowerPoint slide decks. Trainers may use, copy and modify the PowerPoint slide decks only for
providing an Authorized Training Session. If you elect to exercise the foregoing, you will agree
or ensure Trainer agrees: (a) that modification of the slide decks will not constitute creation of
obscene or scandalous works, as defined by federal law at the time the work is created; and
(b) to comply with all other terms and conditions of this agreement.
ii. Use of Instructional Components in Trainer Content. For each Authorized Training
Session, Trainers may customize and reproduce, in accordance with the MCT Agreement, those
portions of the Licensed Content that are logically associated with instruction of the Authorized
Training Session. If you elect to exercise the foregoing rights, you agree or ensure the Trainer
agrees: (a) that any of these customizations or reproductions will only be used for providing an
Authorized Training Session and (b) to comply with all other terms and conditions of this
agreement.
iii. Academic Materials. If the Licensed Content contains Academic Materials, you may copy and
use the Academic Materials. You may not make any modifications to the Academic Materials
and you may not print any book (either electronic or print version) in its entirety. If you
reproduce any Academic Materials, you agree that:
• The use of the Academic Materials will be only for your personal reference or training use
• You will not republish or post the Academic Materials on any network computer or
broadcast in any media;
• You will include the Academic Material’s original copyright notice, or a copyright notice to
Microsoft’s benefit in the format provided below:
Form of Notice:
© 2010 Reprinted for personal reference use only with permission by Microsoft
Corporation. All rights reserved.
Microsoft, Windows, and Windows Server are either registered trademarks or
trademarks of Microsoft Corporation in the US and/or other countries. Other
product and company names mentioned herein may be the trademarks of their
respective owners.
6. INTERNET-BASED SERVICES. Microsoft may provide Internet-based services with the Licensed
Content. It may change or cancel them at any time. You may not use these services in any way that
could harm them or impair anyone else’s use of them. You may not use the services to try to gain
unauthorized access to any service, data, account or network by any means.
7. SCOPE OF LICENSE. The Licensed Content is licensed, not sold. This agreement only gives you some
rights to use the Licensed Content. Microsoft reserves all other rights. Unless applicable law gives you
more rights despite this limitation, you may use the Licensed Content only as expressly permitted in this
agreement. In doing so, you must comply with any technical limitations in the Licensed Content that
only allow you to use it in certain ways. You may not
• install more copies of the Licensed Content on classroom Devices than the number of Students and
the Trainer in the Authorized Training Session;
• allow more classroom Devices to access the server than the number of Students enrolled in and the
Trainer delivering the Authorized Training Session if the Licensed Content is installed on a network
server;
• copy or reproduce the Licensed Content to any server or location for further reproduction or
distribution;
• disclose the results of any benchmark tests of the Licensed Content to any third party without
Microsoft’s prior written approval;
• work around any technical limitations in the Licensed Content;
• reverse engineer, decompile or disassemble the Licensed Content, except and only to the extent
that applicable law expressly permits, despite this limitation;
• make more copies of the Licensed Content than specified in this agreement or allowed by applicable
law, despite this limitation;
• publish the Licensed Content for others to copy;
• transfer the Licensed Content, in whole or in part, to a third party;
• access or use any Licensed Content for which you (i) are not providing a Course and/or (ii) have not
been authorized by Microsoft to access and use;
• rent, lease or lend the Licensed Content; or
• use the Licensed Content for commercial hosting services or general business purposes.
• Rights to access the server software that may be included with the Licensed Content, including the
Virtual Hard Disks does not give you any right to implement Microsoft patents or other Microsoft
intellectual property in software or devices that may access the server.
8. EXPORT RESTRICTIONS. The Licensed Content is subject to United States export laws and
regulations. You must comply with all domestic and international export laws and regulations that apply
to the Licensed Content. These laws include restrictions on destinations, end users and end use. For
additional information, see www.microsoft.com/exporting.
9. NOT FOR RESALE SOFTWARE/LICENSED CONTENT. You may not sell software or Licensed
Content marked as “NFR” or “Not for Resale.”
10. ACADEMIC EDITION. You must be a “Qualified Educational User” to use Licensed Content marked as
“Academic Edition” or “AE.” If you do not know whether you are a Qualified Educational User, visit
www.microsoft.com/education or contact the Microsoft affiliate serving your country.
11. TERMINATION. Without prejudice to any other rights, Microsoft may terminate this agreement if you
fail to comply with the terms and conditions of these license terms. In the event your status as an
Authorized Learning Center or Trainer a) expires, b) is voluntarily terminated by you, and/or c) is
terminated by Microsoft, this agreement shall automatically terminate. Upon any termination of this
agreement, you must destroy all copies of the Licensed Content and all of its component parts.
12. ENTIRE AGREEMENT. This agreement, and the terms for supplements, updates, Internet-
based services and support services that you use, are the entire agreement for the Licensed
Content and support services.
13. APPLICABLE LAW.
a. United States. If you acquired the Licensed Content in the United States, Washington state law
governs the interpretation of this agreement and applies to claims for breach of it, regardless of
conflict of laws principles. The laws of the state where you live govern all other claims, including
claims under state consumer protection laws, unfair competition laws, and in tort.
b. Outside the United States. If you acquired the Licensed Content in any other country, the laws
of that country apply.
14. LEGAL EFFECT. This agreement describes certain legal rights. You may have other rights under the
laws of your country. You may also have rights with respect to the party from whom you acquired the
Licensed Content. This agreement does not change your rights under the laws of your country if the
laws of your country do not permit it to do so.
15. DISCLAIMER OF WARRANTY. The Licensed Content is licensed “as-is.” You bear the risk of
using it. Microsoft gives no express warranties, guarantees or conditions. You may have
additional consumer rights under your local laws which this agreement cannot change. To
the extent permitted under your local laws, Microsoft excludes the implied warranties of
merchantability, fitness for a particular purpose and non-infringement.
16. LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGES. YOU CAN RECOVER FROM
MICROSOFT AND ITS SUPPLIERS ONLY DIRECT DAMAGES UP TO U.S. $5.00. YOU CANNOT
RECOVER ANY OTHER DAMAGES, INCLUDING CONSEQUENTIAL, LOST PROFITS, SPECIAL,
INDIRECT OR INCIDENTAL DAMAGES.
This limitation applies to
• anything related to the Licensed Content, software, services, content (including code) on third party
Internet sites, or third party programs; and
• claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence,
or other tort to the extent permitted by applicable law.
It also applies even if Microsoft knew or should have known about the possibility of the damages. The
above limitation or exclusion may not apply to you because your country may not allow the exclusion or
limitation of incidental, consequential or other damages.
Please note: As this Licensed Content is distributed in Quebec, Canada, some of the clauses in
this agreement are provided below in French.
Remarque : Ce le contenu sous licence étant distribué au Québec, Canada, certaines des clauses
dans ce contrat sont fournies ci-dessous en français.
EXONÉRATION DE GARANTIE. Le contenu sous licence visé par une licence est offert « tel quel ». Toute
utilisation de ce contenu sous licence est à votre seule risque et péril. Microsoft n’accorde aucune autre
garantie expresse. Vous pouvez bénéficier de droits additionnels en vertu du droit local sur la protection dues
consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties
implicites de qualité marchande, d’adéquation à un usage particulier et d’absence de contrefaçon sont
exclues.
LIMITATION DES DOMMAGES-INTÉRÊTS ET EXCLUSION DE RESPONSABILITÉ POUR LES
DOMMAGES. Vous pouvez obtenir de Microsoft et de ses fournisseurs une indemnisation en cas de
dommages directs uniquement à hauteur de 5,00 $ US. Vous ne pouvez prétendre à aucune indemnisation
pour les autres dommages, y compris les dommages spéciaux, indirects ou accessoires et pertes de
bénéfices.
Cette limitation concerne:
• tout ce qui est relié au le contenu sous licence , aux services ou au contenu (y compris le code)
figurant sur des sites Internet tiers ou dans des programmes tiers ; et
• les réclamations au titre de violation de contrat ou de garantie, ou au titre de responsabilité stricte,
de négligence ou d’une autre faute dans la limite autorisée par la loi en vigueur.
Elle s’applique également, même si Microsoft connaissait ou devrait connaître l’éventualité d’un tel
dommage. Si votre pays n’autorise pas l’exclusion ou la limitation de responsabilité pour les dommages
indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l’exclusion ci-dessus ne
s’appliquera pas à votre égard.
EFFET JURIDIQUE. Le présent contrat décrit certains droits juridiques. Vous pourriez avoir d’autres droits
prévus par les lois de votre pays. Le présent contrat ne modifie pas les droits que vous confèrent les lois de
votre pays si celles-ci ne le permettent pas.
Welcome!
Thank you for taking our training! We’ve worked together with our Microsoft Certified Partners
for Learning Solutions and our Microsoft IT Academies to bring you a world-class learning
experience—whether you’re a professional looking to advance your skills or a
student preparing for a career in IT.
■ Microsoft Certified Trainers and Instructors—Your instructor is a technical and

instructional expert who meets ongoing certification requirements. And, if instructors
are delivering training at one of our Certified Partners for Learning Solutions, they are
also evaluated throughout the year by students and by Microsoft.
■ Certification Exam Benefits—After training, consider taking a Microsoft Certification

exam. Microsoft Certifications validate your skills on Microsoft technologies and can help
differentiate you when finding a job or boosting your career. In fact, independent
research by IDC concluded that 75% of managers believe certifications are important to
team performance1. Ask your instructor about Microsoft Certification exam promotions
and discounts that may be available to you.
■ Customer Satisfaction Guarantee—Our Certified Partners for Learning Solutions offer

a satisfaction guarantee and we hold them accountable for it. At the end of class, please
complete an evaluation of today’s experience. We value your feedback!
We wish you a great learning experience and ongoing success in your career!
Sincerely,
Microsoft Learning
www.microsoft.com/learning
1
IDC, Value of Certification: Team Certification and Organizational Performance, November 2006
Planning, Deploying, and Managing Microsoft® System Center Configuration Manager 2007 R2 xiii
Acknowledgement
Microsoft Learning would like to acknowledge and thank the following for their
contribution towards developing this title. Their effort at various stages in the
development has ensured that you have a good classroom experience.
Conan Kezema – Content Developer

Conan Kezema, B.Ed, MCSE, MCT, is an educator, consultant, network systems
architect, and author who specializes in Microsoft technologies. As an associate of
S.R. Technical Services, Conan has been a subject matter expert, instructional
designer, and author on numerous Microsoft courseware development projects
including course 5105C: Deploying Windows Vista® Business Desktops.
Bob Lawler – Content Developer

Bob Lawler, MCSE, MCT, is owner and president of XPO-NET Corporation with
over 20 years of IT experience. As a professional technical writer, he has authored,
contributed to, and edited a variety of training software and videos, books,
magazine articles, and courseware for many Microsoft and third-party technologies.
As a consultant and trainer, Bob has provided expertise and guidance on
technologies such as Microsoft Exchange Server, ISA Server, and Configuration
Manager for many organizations, including some of the most recognizable names
in American business.
David Susemiehl – Content Developer

David Susemiehl has worked as consultant, trainer, and courseware developer
since 1996. David has extensive experience consulting on Microsoft Systems
Management Server/Configuration Manager 2007, as well as Active Directory,
Exchange Server, and Terminal Server/Citrix deployments. David has done
courseware development for Microsoft and Hewlett Packard, and has successfully
delivered those courses in Europe, Central America, North America, and Canada.
For the last several years, David has been writing courseware for Microsoft
Learning, and consulting on Infrastructure Transitions in Michigan.
xiv Planning, Deploying, and Managing Microsoft® System Center Configuration Manager 2007 R2
Steve Bobosky – Technical Reviewer

Steve Bobosky is the owner of System Center Tools based out of Portland, Oregon.
An MVP from 2006-2009, Steve specializes in Microsoft Configuration Manager,
and provides consulting services and software add-on solutions. Prior to starting
his own company in 2006, Steve worked for Microsoft Consulting Services. Steve
has written several popular software enhancements for Configuration Manager,
including Enhanced Discovery tools that significantly speed up the discovery
process and software distribution when new users are added to AD Global Groups
used for deployment of applications.
Planning, Deploying, and Managing Microsoft® System Center Configuration Manager 2007 R2 xv
Contents
Module 1: Overview of Microsoft® System Center Configuration Manager
2007
Lesson 1: Introduction to Configuration Manager 2007 1-3
Lesson 2: Configuration Manager Features 1-8
Lesson 3: Configuration Manager Deployment Scenarios 1-19
Lesson 4: Overview of the Configuration Manager Client 1-27
Module 2: Planning and Deploying a Single-Site Architecture

Lesson 1: Planning a Configuration Manager 2007 Site Deployment 2-4
Lesson 2: Preparing to Deploy a Configuration Manager 2007 Site 2-19
Lesson 3: Installing a Configuration Manager 2007 Site Server 2-36
Lab A: Deploying a Configuration Manager Site Server 2-41
Lab B: Deploying a Configuration Manager Site Server, Continued 2-51
Lesson 4: Performing Post-Setup Configuration Tasks 2-57
Lesson 5: Discovering Resources 2-66
Lab C: Managing Users and Configuring Boundaries and Discovery
Methods 2-84
Lesson 6: Monitoring and Troubleshooting Tools in Configuration
Manager 2007 2-91
Lab D: Monitoring and Troubleshooting Configuration Manager 2007 2-104
Module 3: Planning for and Completing Client Deployment

Lesson 1: Client Deployment Methods 3-3
Lesson 2: Deploying Clients 3-31
Lab A: Deploying Configuration Manager 2007 Clients 3-45
Lesson 3: Managing Configuration Manager 2007 Clients 3-51
Lesson 4: Using Configuration Manager Reporting with Client Installation 3-64
Lab B: Verifying Client Deployment 3-71
xvi Planning, Deploying, and Managing Microsoft® System Center Configuration Manager 2007 R2
Module 4: Inventory Collection, Software Metering, and Asset Intelligence

Lesson 1: Overview of Inventory Collection 4-4
Lesson 2: Collecting Hardware Inventory 4-11
Lesson 3: Collecting Software Inventory 4-19
Lesson 4: Managing and Troubleshooting Inventory 4-26
Lab A: Collecting Inventory 4-41
Lesson 5: Asset Intelligence 4-49
Lab B: Using Asset Intelligence 4-71
Lesson 6: Metering Software Usage 4-81
Lab C: Configuring Software Metering 4-94
Module 5: Querying and Reporting Data

Lesson 1: Introduction to Data and Status Message Queries 5-4
Lesson 2: Managing Queries 5-11
Lab A: Creating Queries 5-20
Lesson 3: Configuring and Deploying a Reporting Point 5-28
Lab B: Creating a Reporting Point 5-39
Lesson 4: Managing Reports 5-44
Lab C: Managing Reports 5-59
Lesson 5: Creating and Using Dashboards 5-67
Lab D: Working with Dashboards 5-74
Lesson 6: SQL Reporting Services in Configuration Manager 2007 R2 5-77
Lab E: Using SQL Reporting Services 5-92
Lesson 7: Client Status Reporting in Configuration Manager 2007 R2 5-98
Lab F: Installing and Using Client Status Reporting 5-114
Planning, Deploying, and Managing Microsoft® System Center Configuration Manager 2007 R2 xvii
Module 6: Distributing Software Using Microsoft® System Center

Configuration Manager 2007
Lesson 1: Overview of the Software Distribution Process 6-4
Lesson 2: Preparing for Software Distribution 6-13
Lesson 3: Overview of Distribution Points 6-23
Lab A: Preparing for Software Distribution 6-35
Lesson 4: Creating and Populating Collections 6-40
Lesson 5: Configuring Collections 6-53
Lab B: Creating and Configuring a Collection 6-61
Lesson 6: Creating and Configuring Packages and Programs 6-65
Lab C: Creating a Package and Configuring Programs 6-79
Lesson 7: Distributing Packages 6-84
Lesson 8: Advertising Programs 6-90
Lesson 9: Monitoring and Troubleshooting Software Distribution 6-103
Lab D: Deploying Applications by Using Software Distribution 6-119
Module 7: Deploying Virtual Applications Using Microsoft® System Center

Lesson 1: Configuring the Infrastructure to Support
Application Virtualization 7-3
Lesson 2: Deploying and Managing Application Virtualization Packages 7-18
Lesson 3: Using Virtual Application Programs 7-29
Lab: Deploying Virtual Applications to Configuration Manager Clients 7-35
Module 8: Deploying and Managing Software Updates

Lesson 1: Overviews of Software Updates 8-3
Lesson 2: Preparing the Configuration Manager Site for Software
Updates 8-18
Lesson 3: Managing Software Updates 8-33
Lesson 4: Monitoring and Troubleshooting Software Updates 8-51
Lab: Deploying and Managing Software Updates 8-58
xviii Planning, Deploying, and Managing Microsoft® System Center Configuration Manager 2007 R2
Module 9: Deploying Operating Systems Using Microsoft® System Center

Lesson 1: Overview of Operating System Deployment 9-3
Lesson 2: Task Sequences in Operating System Deployment 9-16
Lesson 3: Preparing for Operating System Deployment 9-30
Lesson 4: Capturing Operating System Images 9-60
Lab A: Capturing a Reference Computer 9-72
Lesson 5: Managing User Data 9-84
Lesson 6: Deploying an Operating System 9-99
Lab B: Performing an In-Place Upgrade Using Hard Links 9-114
Module 10: Working with Desired Configuration Management

Lesson 1: Overview of Desired Configuration Management 10-4
Lesson 2: Configuring Desired Configuration Management 10-23
Lesson 3: Integrating Microsoft Forefront Client Security Compliance 10-37
Lesson 4: Viewing and Troubleshooting Compliance Results 10-45
Lab: Configuring Desired Configuration Management 10-54
Module 11: Configuring Wake On LAN, Out of Band Management, and

Remote Tools
Lesson 1: Overview of Wake On LAN 11-4
Lesson 2: Overview of Out of Band Management 11-19
Lesson 3: Configuring Out of Band Management 11-30
Lesson 4: Overview of Configuration Manager 2007 Remote Tools 11-44
Lesson 5: Configuring the Remote Tools Client Agent 11-59
Lab: Configuring and Using Remote Tools 11-72
Planning, Deploying, and Managing Microsoft® System Center Configuration Manager 2007 R2 xix
Module 12: Planning and Configuring a Multiple Site Hierarchy

Lesson 1: Introduction to the Configuration Manager 2007 Site Hierarchy 3
Lesson 2: Configuring Configuration Manager 2007 Site Communications 13
Lab A: Planning a Configuration Manager 2007 Hierarchy and
Installing a Primary Child Site 31
Lesson 3: Installing a Secondary Site Server 44
Lab B: Installing Secondary Sites and Proxy Management Points 52
Lesson 4: Roaming in Multiple Site Hierarchies 58
Lab C: Roaming Between Configuration Manager 2007 Sites 68
Lesson 5: Decommissioning Sites and Hierarchies 77
Module 13: Maintaining and Monitoring Microsoft® System Center

Lesson 1: Configuration Manager 2007 Maintenance Tasks 13-3
Lesson 2: Backup and Recovery of Configuration Manager 2007 13-15
Lab A: Backing Up and Repairing a Primary Site System 13-34
Lesson 3: Using Microsoft System Center Operations Manager 2007
to Monitor Configuration Manager 2007 13-44
Lesson 4: Using Windows Performance Monitor to Monitor
Configuration Manager 2007 13-50
Lab B: Using Windows Performance Monitor to Monitor
Configuration Manager 2007 13-64
Module 14: Microsoft® System Center Configuration Manager 2007 Native

Mode and Internet-Based Client Management
Lesson 1: Introduction to Configuration Manager 2007 Native Mode 14-3
Lesson 2: The Public Key Infrastructure Required for Native Mode 14-13
Lesson 3: Configuring Sites for Native Mode 14-32
Lab A: Configuring Native Mode 14-41
Lesson 4: Internet-Based Client Management 14-51
Lab B: Configuring a Site for Internet-Based Client Management 14-64
xx Planning, Deploying, and Managing Microsoft® System Center Configuration Manager 2007 R2
Lab Answer Keys

Module 2 Lab A: Deploying a Configuration Manager Site Server
Module 2 Lab B: Deploying a Configuration Manager Site Server, Continued
Module 2 Lab C: Managing Users and Configuring Boundaries and Discovery
Methods
Module 2 Lab D: Monitoring and Troubleshooting Configuration Manager 2007
Module 3 Lab A: Deploying Configuration Manager 2007 Clients
Module 3 Lab B: Verifying Client Deployment
Module 4: Lab A: Collecting Inventory:
Module 4: Lab B: Using Asset Intelligence
Module 4 Lab C: Configuring Software Metering
Module 5 Lab A: Creating Queries
Module 5 Lab B: Creating a Reporting Point
Module 5 Lab C: Managing Reports
Module 5 Lab D: Working with Dashboards
Module 5 Lab E: Using SQL Reporting Services
Module 5 Lab F: Installing and Using Client Status Reporting
Module 6 Lab A: Preparing for Software Distribution
Module 6 Lab B: Creating and Configuring a Collection
Module 6 Lab C: Creating a Package and Configuring Programs
Module 6 Lab D: Deploying Applications by Using Software Distribution
Module 7 Lab: Deploying Virtual Applications to Configuration Manager Clients
Module 8 Lab: Deploying and Managing Software Updates
Module 9 Lab A: Capturing a Reference Computer
Module 9 Lab B: Performing an In-Place Upgrade Using Hard Links
Module 10 Lab: Configuring Desired Configuration Management
Module 11 Lab: Configuring and Using Remote Tools
Module 12 Lab A: Planning a Configuration Manager 2007 Hierarchy and
Installing a Primary Child Site
Module 12 Lab B: Installing Secondary Sites and Proxy Management Points
Module 12 Lab C: Roaming Between Configuration Manager 2007 Sites
Module 13 Lab A: Backing Up and Repairing a Site System
Planning, Deploying, and Managing Microsoft® System Center Configuration Manager 2007 R2 xxi
Module 13 Lab B: Using Windows Performance Monitor to Monitor

Module 14 Lab A: Configuring Native Mode
Module 14 Lab B: Configuring a Site for Internet-Based Client Management
About This Course i
MCT USE ONLY. STUDENT USE PROHIBITED

BETA COURSEWARE EXPIRES 9/27/2010
About This Course

This section provides you with a brief description of the course, audience,
suggested prerequisites, and course objectives.
Course Description
This five-day course provides students with the knowledge and skills to plan,
deploy, and manage Microsoft® System Center Configuration Manager 2007. The
course focuses on planning and deploying a single-site System Center
Configuration Manager infrastructure, including client deployment, hardware and
software inventory, software distribution, deploying operating systems, and
managing software updates. The course also includes instruction on how to
configure a multiple site hierarchy, and how to use Configuration Manager 2007 in
native mode.
Audience
This course is intended for systems engineers who have one to three years
experience supporting multiple desktop and server computers running Windows
Server® operating systems in medium to large enterprise organizations, and those
who plan on deploying Configuration Manager 2007.
Additionally, this course is intended for Configuration Manager 2007
administrators who are responsible for configuring and managing one or more
Configuration Manager 2007 sites and their supporting systems. Administrators
typically will have one to three years of experience supporting multiple desktop
and server computers running Windows Server in medium to large enterprise
organizations.
Student Prerequisites
This course requires that you meet the following prerequisites:
• A base-level understanding of Microsoft Systems Management Server (SMS)
2003 or Configuration Manager 2007.
About This Course ii

• System Administrator–level working knowledge of:
• Deployment, configuration, and troubleshooting for personal computers

running Windows® operating systems.
• TCP/IP networking
• Microsoft SQL Server®
• Active Directory® Domain Services (AD DS)
• Basic Public Key Infrastructure (PKI) concepts
Course Objectives
After completing this course, students will be able to:
• Provide an overview of Configuration Manager 2007.
• Plan and deploy a single-site architecture.
• Plan for and complete client deployment.
• Collect and manage inventory, implement software metering, and use Asset
Intelligence.
• Query data, and create reports.
• Distribute software.
• Deploy virtual applications.
• Deploy and manage software updates.
• Deploy Windows operating systems.
• Determine computer compliance using desired configuration management.
• Configure Wake On LAN, Out of Band Management, and Remote Tools.
• Plan and configure a multiple site hierarchy.
• Maintain and monitor Configuration Manager 2007.
• Describe native mode and Internet-based client management.
About This Course iii

Course Outline
This section provides an outline of the course:

Module 1, “Overview of Microsoft® System Center Configuration Manager 2007”
describes key features and primary infrastructure components of Configuration
Manager 2007. This module also describes deployment scenarios for organizations
of different sizes.
Module 2, “Planning and Deploying a Single-Site Architecture” describes how you
can plan, prepare to deploy, and implement a Configuration Manager 2007 site.
This module also describes the process of discovery, and how Configuration
Manager 2007 discovers resources to manage. The module concludes by
describing the tools you can use to monitor and troubleshoot Configuration
Manager 2007.
Module 3, ”Planning for and Completing Client Deployment” describes the site
system roles needed for client deployment. This module also describes different
Configuration Manager client deployment methods, and describes how you can
verify a successful deployment.
Module 4, “Inventory Collection, Software Metering, and Asset Intelligence”
describes how you can use hardware and software inventory features to collect
information related to client computers and files within a Configuration Manager
2007 hierarchy. This module also explains how you can implement software
metering to help monitor and collect software usage data for Configuration
Manager 2007 clients.
Module 5, “Querying and Reporting Data” describes how you can use queries to
find information related to resource discovery, inventory data, and status
messages. This module also describes how you can use reports to easily organize
and display information about the computers that Configuration Manager 2007
manages.
Module 6, “Distributing Software Using Microsoft® System Center Configuration
Manager 2007” describes how you can successfully set up the infrastructure that
you need to deploy and launch applications, scripts, or executables, using software
distribution.
Module 7, “Deploying Virtual Applications Using Microsoft® System Center
Configuration Manager 2007” describes how you can use Configuration Manager
2007 R2 to deploy and manage virtual application packages throughout your
environment.
About This Course iv

Module 8, “Deploying and Managing Software Updates” describes how the
software updates feature integrates with Configuration Manager 2007. This

module also describes how you prepare the software updates infrastructure, and
how you manage software updates. This module concludes by describing how you
can monitor and troubleshoot software updates.
Module 9, “Deploying Operating Systems Using Microsoft® System Center
Configuration Manager 2007” describes Operating System Deployment, and how
you can use it to deploy operating systems. This module also describes how you
can work with task sequences, and how you can configure reference computers.
Finally, this module explains how you can capture operating systems, and how you
can capture and restore user state information.
Module 10, “Working with Desired Configuration Management” describes the
Configuration Manager 2007 desired configuration management tools, and how
you can use them to help manage your systems.
Module 11, “Configuring Wake On LAN, Out of Band Management, and Remote
Tools” describes the Wake On LAN and out of band management features, and
describes how you can configure them. This module also describes the Remote
Tools feature, and how you can configure the Remote Tools Client Agent.
Module 12, “Planning and Configuring a Multiple Site Hierarchy” describes
Configuration Manager 2007 site hierarchies, and describes the options available
for building a large-scale Configuration Manager 2007 system for your enterprise.
This module also describes how you configure site communications, connect
primary sites, install secondary sites, roam between sites, and decommission sites
and hierarchies.
Module 13, “Maintaining and Monitoring Microsoft® System Center Configuration
Manager 2007” describes how you can configure and schedule site maintenance
tasks, and backup and recovery tasks for Configuration Manager 2007. This
module also explains how you can use Microsoft System Center Operations
Manager 2007 to monitor Configuration Manager 2007. This module concludes by
describing how you can use Windows Performance Monitor to monitor
Configuration Manager 2007.
Module 14, “Microsoft System Center Configuration Manager 2007 Native Mode
and Internet-Based Client Management” describes Configuration Manager native
mode, and the Public Key Infrastructure (PKI) requirements for native mode. This
module also explains how you configure sites for native mode, and how you
configure Internet-based client management.
About This Course v

Course Materials
The following materials are included with your kit:

• Course Handbook. A succinct classroom learning guide that provides all the
critical technical information in a crisp, tightly-focused format, which is just
right for an effective in-class learning experience.
• Lessons: Guide you through the learning objectives and provide the key
points that are critical to the success of the in-class learning experience.
• Labs: Provide a real-world, hands-on platform for you to apply the
knowledge and skills learned in the module.
• Module Reviews and Takeaways: Provide improved on-the-job reference
material to boost knowledge and skills retention.
• Lab Answer Keys: Provide step-by-step lab solution guidance at your finger
tips when it’s needed.
• Course Companion CD. Searchable, easy-to-navigate digital content with
integrated premium on-line resources designed to supplement the Course
Handbook.
• Lessons: Include detailed information for each topic, expanding on the
content in the Course Handbook.
• Labs: Include complete lab exercise information and answer keys in digital
form to use during lab time.
• Resources: Include well-categorized additional resources that give you
immediate access to the most up-to-date premium content on TechNet,
MSDN®, and Microsoft Press®.
• Student Course Files: Include the Allfiles.exe, a self-extracting executable
file that contains all the files required for the labs and demonstrations.
Note: To access the full course content, insert the Course Companion CD into the
CD-ROM drive, and then in the root directory of the CD, double-click StartCD.exe.
• Course evaluation. At the end of the course, you will have the opportunity to
complete an online evaluation to provide feedback on the course, training
facility, and instructor.
To provide additional comments or feedback on the course, send e-mail to

support@mscourseware.com. To inquire about the Microsoft Certification
Program, send e-mail to mcphelp@microsoft.com.
About This Course vi

Virtual Machine Environment
This section provides the information for setting up the classroom environment to
support the business scenario of the course.
Virtual Machine Configuration

In this course, you will use Hyper-V™ deployed on Windows Server 2008 to
perform the labs.
Important: At the end of each lab, you must revert the virtual machine back to the
state the virtual machine was in before the lab started. To revert a virtual machine,
perform the following steps:
1. In Hyper-V Manager, right click the virtual machine name, and click Revert.
2. In the Revert dialog box, click Yes.
The following table shows the role of each virtual machine used in this course:
Virtual machine Role

6451B-NYC-DC1 Domain controller in the Contoso.com domain.
6451B-NYC-CFG1 Configuration Manager 2007 server in the in the NYC site of the
Contoso.com domain.
6451B-NYC-CL1 Windows® 7 client in the Contoso.com domain.
6451B-NYC-CL2 Windows Vista® client in the Contoso.com domain.
6451B-NYC-SVR2 Member server in the Contoso.com domain
6451B-ATL-CFG1 Configuration Manager 2007 server in the in the ATL site of the
Contoso.com domain.
6451B-ATL-CL1 Windows 7 client in the Contoso.com domain.
6451B-NYC-CAP Pre-configured Windows 7 client in a workgroup.
6451B-NYC-REF “Bare-metal” system.
6451B-TOR-CFG1 Member server located in the TOR site of the Contoso.com domain
About This Course vii

Software Configuration
The following software is installed in this course:
• Windows Server 2008 R2
• Configuration Manager 2007 R2
• Windows 7
• Windows Vista
Classroom Setup
Each classroom computer will have the same virtual machine configured in the
same way. All of the aforementioned virtual machines are deployed in each student
computer.
Course Hardware Level

To ensure a satisfactory student experience, Microsoft Learning requires a
minimum equipment configuration for trainer and student computers in all
Microsoft Certified Partner for Learning Solutions (CPLS) classrooms in which
Official Microsoft Learning Product courseware are taught.
• Intel Virtualization Technology (Intel VT) or AMD Virtualization (AMD-V)

processor
• Dual 120 gigabyte (GB) hard disks 7200 revolutions per minute (RPM) SATA
or better*
• 8 GB random access memory (RAM)
• DVD drive
• Network adapter
• Super VGA (SVGA) 17-inch monitor
• Microsoft mouse or compatible pointing device
• Sound card with amplified speakers
*Striped
In addition, the instructor computer must be connected to a projection display

device that supports SVGA 1024 x 768 pixels, 16-bit colors.
Overview of Microsoft® System Center Configuration Manager 2007 1-1

Module 1
Overview of Microsoft® System Center
Contents:
Lesson 1: Introduction to Configuration Manager 2007 1-3
Lesson 2: Configuration Manager Features 1-8
Lesson 3: Configuration Manager Deployment Scenarios 1-19
Lesson 4: Overview of the Configuration Manager Client 1-27
1-2 Planning, Deploying, and Managing Microsoft® System Center Configuration Manager 2007 R2

Module Overview
Microsoft System Center Configuration Manager 2007 provides powerful desktop

administration tools for managing hardware and software inventory, software
distribution, operating system deployments, desired configuration monitoring,
software update management, and remote client troubleshooting. As a System
Center Configuration Manager 2007 administrator, you need to know how to
configure and manage these tools. This module introduces the key features and
primary infrastructure components of Configuration Manager 2007.
After completing this module, you will be able to:
• Describe Configuration Manager 2007.
• Describe the Configuration Manager 2007 features.
• Describe the Configuration Manager 2007 deployment scenarios.
• Describe the Configuration Manager client.

Lesson 1
Introduction to Configuration Manager 2007
Configuration Manager 2007 drives information technology (IT) productivity and

efficiency by reducing manual tasks and maximizing hardware and software
investments.
After completing this lesson, you will be able to:
• Describe the primary Configuration Manager features.
• Describe where Configuration Manager fits in the Microsoft System Center
management space.
• Describe the benefits of using Configuration Manager.

Primary Configuration Manager Features
Key Points
The primary Configuration Manager 2007 features fall into three broad categories:
• Asset management, which includes inventory, Asset Intelligence, and software
metering.
• Deployment, which includes software distribution, operating system
deployment, and software update management.
• Network security and support, which includes desired configuration
management, diagnostics and troubleshooting, and Network Access Protection
(NAP).

The primary features contribute to a more effective IT department by enabling:
• Operating system and application deployment

• Desired configuration management
• Enhanced system security
• Asset management of servers, desktops, and mobile devices
Configuration Manager also includes mobile device management, which extends

many of the primary features, such as inventory and software distribution, to the
Windows Mobile® platform.
Additionally, all Configuration Manager features are supported by a comprehensive
reporting tool.

Where Configuration Manager Fits in the System Center
Management Space
Key Points
System Center plays a central role in helping IT organizations benefit from self-
managed, dynamic systems. System Center solutions capture and aggregate
knowledge about your infrastructure, policies, processes, and best practices. This
helps your IT staff build manageable and automated systems that can reduce costs,
improve application availability, and enhance service delivery.
Question: Which System Center product helps with system backups?
Question: Which System Center products help deploy applications?


How Configuration Manager Can Benefit Organizations
Key Points
Configuration Manager allows organizations of all sizes to improve efficiencies and
reduce the total cost of ownership (TCO) in systems management through:
• Comprehensive deployment and updates.
• Enhanced IT infrastructure insight and control.
Additionally, Configuration Manager allows organizations to convert IT from a cost

center to a strategic business asset. Further, Configuration Manager can help IT
empower non-IT employees by delivering productivity tools in a timely and
efficient manner.

Lesson 2
Configuration Manager Features
Configuration Manager primary features include software updates, operating

system and application deployment, and asset management.
• Describe Configuration Manager 2007 features.
• Describe the Configuration Manager console.
• Describe Configuration Manager 2007 Service Pack 1 (SP1) features.
• Describe Configuration Manager 2007 Service Pack 2 (SP2) features.
• Describe Configuration Manager 2007 Release 2 (R2) features.
• Describe the Configuration Manager Software Development Kit (SDK).
• Describe using Configuration Manager in the workplace.

Configuration Manager 2007 Features
Key Points
Configuration Manager features and managements tools help organizations:
• Collect information about hardware and software installed on clients.
• Distribute software to clients.
• Track software usage.
• Deploy new operating systems and applications.
• Assess computer baseline deviation.
• Manage critical software updates.
• Manage assets.
• Administer client computers remotely.
• Start computers that have been turned off, in preparation for management
events.

Question: Which Configuration Manager features help with security?


Configuration Manager 2007 Administration Console
Key Points
The Configuration Manager 2007 Administration console, or Configuration
Manager console, is the primary interface that you use to configure, run, and access
Configuration Manager features and tools. You install and use the Configuration
Manager console to accomplish day-to-day tasks required to configure your sites,
maintain your Configuration Manager site database, and monitor the status of your
Configuration Manager hierarchy.

Configuration Manager 2007 SP1 Features
Key Points
Configuration Manager 2007 SP1 provides significant enhancements to the
original Configuration Manager 2007 release. These enhancements include:
• Out of band management
• Updates to the operating systems supported as site systems and clients
• Improvements to Asset Intelligence
• Additional reports
• Compatibility with Microsoft SoftGrid® and Application Virtualization (App-V)
applications

Configuration Manager 2007 SP2 Features
Key Points
Configuration Manager 2007 SP2 provides additional enhancements and
significant changes to the SP1 release. These include:
• ExtADSch.exe now offers feedback on the command line in addition to
logging.
• Support for Windows® 7 and Windows Server® 2008 R2.
• Support for the Configuration Manager 2007 SP2 management pack when
using either the 32-bit or 64-bit version of the System Center Operations
Manager agent.
• Windows® 7 BranchCache™ feature support, which enables caching and peer-
to-peer file sharing of distribution point content clients in branch locations.
• Windows 7 DirectAccess, which enables Internet-based clients to access site
systems as if connected to internal network.

• Significant changes to certain features, including:

• Asset Intelligence
• Operating System Deployment
• Client changes:
• Support for remote control of 64-bit clients.
• Support for App-V 4.6, including x64 clients.
• Removal of the built-in two-minute delay in the client policy evaluation
cycle.

Configuration Manager 2007 R2 Features
Key Points
Configuration Manager 2007 R2 provides additional features beyond those
available in the original release. These include:
• App-V management
• Forefront Client Security integration for desired configuration management
• SQL Reporting Services reporting
• Client status reporting
• Operating System Deployment enhancements, including:
• Support for Pre-Boot Execution Environment (PXE)-based deployment to
unknown computers
• Multicast deployment
• Using alternate credentials for command lines in task sequences

Note: Configuration Manager 2007 R2 is an add-on release. You must install

Configuration Manager 2007 SP1 (or SP2) first. Configuration Manager 2007 R2 is
available to Software Assurance customers.
Question: How does multicast transmission improve the Operating System

Deployment process?

Configuration Manager Software Development Kit
Key Points
The Configuration Manager Software Development Kit (SDK) provides
documentation and samples for writing applications to access and modify
Configuration Manager data. It includes information on extending and
customizing the Configuration Manager console. It also provides comprehensive
reference material for Configuration Manager features.
The Configuration Manager SDK provides information for automating
Configuration Manager administration through scripting. and for enhancing
Configuration Manager through development of additional functionality.

Discussion: Configuration Manager in the Workplace
Key Points
Discuss the following issues:
Question: What business factors are affecting your Configuration Manager

deployment?
Question: Are you upgrading from Microsoft Systems Management Server (SMS)
2003 or migrating from another configuration management solution?
Question: What are some of the challenges you face in the configuration
management workspace?

Lesson 3
Configuration Manager Deployment Scenarios
Configuration Manger 2007 supports organizations of all sizes. The way you
deploy Configuration Manager depends on factors such as the size of the
organization, geographical dispersal, administrative structure, and the number of
client computers.
• Describe basic implementation considerations for small-to-medium
organizations.
• Describe basic implementation considerations for medium-to-large
organizations.
• Describe basic implementation considerations for global organizations.

Implementing Configuration Manager for Small-to-
Medium Organizations
Key Points
Small-to-medium organizations often deploy Configuration Manager by
implementing only the required Configuration Manager components.
To better understand a Configuration Manager implementation for a small-to-
medium organization, consider the following scenario:
A. Datum Corporation is a small company with 500 computers in one location. A.
Datum uses a Windows Server 2008 R2 Active Directory® Domain Services
(AD DS)-based network and employs Windows Server Update Services (WSUS)
for software updates. The organization is satisfied with this solution.
However, A. Datum needs a solution for hardware and software inventory. It also
must be able to deploy various applications to computers in different departments.
The solution must also offer a way to report on the inventory data gathered.

To meet these requirements, A. Datum could deploy Configuration Manager as
follows:
• A primary site
• A single server hosting the following site system roles:
• Site server
• Site database
• SMS Provider
• Management point
• Distribution point
• Reporting point
• A fast boundary based on the Active Directory site name
• For each department, one custom collection that contains the computers for
that department

Implementing Configuration Manager for Medium-to-
Large Organizations
Key Points
Medium-to-large organizations often deploy Configuration Manager by
implementing many site system roles on several servers.
To better understand a Configuration Manager implementation for a medium-to-
large organization, consider the following scenario:

Fabrikam, Inc. is a company with approximately 4,500 workstations and servers in
six locations. The main office has 4,000 computers, and each of their four
manufacturing facilities has 100 computers. Fabrikam also has a number of small
satellite offices, each with 5 to 10 computers. Each manufacturing facility is
connected to the main office by a 1.544 megabits per second (Mbps) wide area
network (WAN) connection. Each satellite office connects to the main office by
using a 256 kilobits per second (Kbps) WAN connection. Fabrikam has deployed
Windows Server 2008 R2 and AD DS throughout the company. The main office
and manufacturing facilities each have their own Active Directory sites. No domain
controllers have been deployed at the satellite offices. Thus, the satellite offices are
configured as part of the main office’s Active Directory site. Fabrikam already
employs a SQL Server 2008 SP1 computer, which has ample capacity. Fabrikam's
IT support is centralized at the main office.
Fabrikam needs a solution for asset management, standard and virtualized
application deployment, and software update distribution. Because of the large
number of workstations, they want to ensure that they can positively identify
computers that are not properly configured for management. Additionally,
Fabrikam wants to be able to deploy operating systems to newly purchased, PXE-
enabled computers that have no operating system installed, and to deploy
operating system upgrades to users’ existing computers. Fabrikam also needs to
ensure that computers can still receive changes to management policy, even if a
single management server fails.
Fabrikam wants to ensure that all client-to-server communication related to the
management solution is encrypted. They have deployed a public key infrastructure
(PKI) solution.
To meet these requirements, Fabrikam could deploy Configuration Manager as
follows:
• One primary site in native mode
• A dedicated site server
• Site database on the existing SQL Server 2008 computer
• Default management point on a Network Load Balancing (NLB) cluster of two
computers

• A fast boundary for each physical location
• Additional site systems hosting the following roles:

• Protected distribution points in each manufacturing facility
• Protected branch distribution points in each satellite office
• Background Intelligent Transfer Service (BITS)-enabled distribution points
in the main office
• Fallback status point
• State migration point
• PXE service point
• Reporting point
• Software update point

Implementing Configuration Manager for Global
Organizations
Key Points
Large and global organizations often deploy Configuration Manager in a multi-site,
multi-tier hierarchy.
To better understand a Configuration Manager implementation for a global
organization, consider the following scenario:
Humongous Insurance needs a comprehensive management solution for its
approximately 50,000 computers. The company has a main office in London, and
regional offices in Vancouver, Buenos Aires, Madrid, Cairo, Beijing, and Auckland.
Each regional office has several dozen satellite offices throughout its respective
continent.

The main office has approximately 5,000 workstations and servers. Regional
offices have between 1,000 and 2,500 workstations and servers. The main office
and regional offices have local IT staff. Satellite offices have between 50 and 1,500
workstations and servers. Some of the smaller satellite offices have only one multi-
purpose server; those offices have no local IT staff. Larger satellite offices have
several servers and a small local IT staff.
Additionally, many of the satellite offices are responsible for managing computers
used by employees who work from home. Some of these remote computers
connect to the corporate network with virtual private network (VPN) connections.
Others are not regularly connected to the corporate network, and must be
managed over the Internet.
To meet these requirements, Humongous Insurance could deploy a Configuration
Manager hierarchy. Humongous Insurance's hierarchy could include:
• In London, a central site that is parent to the regional sites
• In each regional office, a primary child site that is also parent to that region's
satellite offices
• A primary child site in each large satellite office
• A secondary child site in each small satellite office
• A proxy management point in each secondary site
• Slow boundaries for VPN-connected clients
• Site systems configured to support Internet-based clients

Lesson 4
Overview of the Configuration Manager Client
The Configuration Manager environment consists of three key components: sites,

boundaries, and server roles. Within the Configuration Manager environment, sites
define the scope of administrative control, and boundaries define scope of client
management.
• Describe the Configuration Manager client.
• Describe Internet-based client management.
• Describe the supported Windows clients.
• Describe the supported mobile clients.
• Describe the International Client Packs.
• Describe how data flows in Configuration Manager.

The Configuration Manager Client
Key Points
Configuration Manager supports many Windows-based platforms as clients. To
manage a computer, you first must install the Configuration Manager client
software.
Client agents are Configuration Manager components that run on top of the base
client components. Every client agent that you enable allows you to use a different
Configuration Manager feature.
Question: If no agents are enabled within Configuration Manager, what data will
the Configuration Manager client collect?

Internet-Based Client Management
Key Points
Configuration Manager supports Internet-based client management, which allows
you to manage clients when they are not connected to your company network, but
have a standard Internet connection.
Because exposing Configuration Manager site systems to the Internet introduces
additional security concerns, using Internet-based client management requires that
sites be in native mode. This ensures that connections to the management point,
software update point, and distribution points are authenticated by an
independent authority, and that data to and from these site systems are encrypted
using Secure Sockets Layer (SSL).
Some client management features—such as user-based software distribution and
Operating System Deployment—are unavailable to Internet-based clients.
Question: Can software be deployed to Internet-based clients by targeting a user-

based security group collection?

Windows Client Support
Key Points
Configuration Manager supports:
• Windows 2000 SP4
• Windows XP SP2 and later
• Windows Vista®(Business, Enterprise, and Ultimate Editions)
• Windows 7 (Professional, Enterprise, and Ultimate Editions)
• Windows Server 2003 SP1 and later, and Windows Server 2003 R2
• Windows Server 2008 (Standard, Enterprise, and Datacenter Editions), and
Windows Server 2008 R2 (Standard, Enterprise, and Datacenter Editions)

Question: What needs to be done to a Microsoft Windows 98 workstation so that

Configuration Manager can support it?
Question: What needs to be done to a Windows XP SP2 workstation so that

Configuration Manager can support it?

Mobile Client Support
Key Points
Configuration Manager supports many mobile clients, such as Windows Mobile 6
Professional and Windows Mobile 5.0 for Pocket PC.

International Client Packs
Key Points
International Client Packs (ICPs) contain additional language files that you can
add to the Configuration Manager client, which must be installed first. Two ICPs
are available.
ICP 1 contains language files for the following languages:
• English
• French
• German
• Japanese
• Spanish

ICP 2 contains all of the language files in ICP 1, plus:
• Chinese (simplified and traditional)

• Czech
• Danish
• Dutch
• Finnish
• Greek
• Hungarian
• Italian
• Korean
• Norwegian
• Polish
• Portuguese (Brazilian and European)
• Russian
• Swedish
• Turkish

How Data Flows in Configuration Manager
Key Points
In Configuration Manager, certain types of data always flow down from parent site
to child site, and from site to client. Other types of data always flow up from client
to site, and from child site to parent site. If a type of data flows from client to site,
then that type also flows from child to parent (if one exists). Likewise, if a type of
data flows from parent to child, then that type also flows from site to client.
In a Configuration Manager hierarchy, data that flows from parent to child is often
thought of as flowing down the hierarchy, and data that flows from child to parent
is often thought of as flowing up the hierarchy. If communication between the site
and the client is considered in the same way, then it can also be said that some
data flows "down" from site to client, and other data flows "up" from client to site.
If all Configuration Manager data flows are considered from that perspective, then
any particular type of data can be considered to always flow in the same direction,
either "up" or "down."

Data that always flows “down” from parent site to child site, and from site to client
includes:
• Management data
• Configuration data
Data that always flow “up” from client to site, and from child site to parent site
includes:
• Client data
• Status data

Module Review and Takeaways
Review Questions
1. How does System Center Operations Manager complement Configuration
Manager?
2. How do you anticipate your organization will use the features included in
Configuration Manager 2007?
3. What type of Configuration Manager hierarchy do you have, or do you

anticipate using?
4. How can you define boundaries?


Real-World Issues and Scenarios
Clair Hector is the IT director and Jae Pak is the systems administrator for
Northwind Traders. Clair oversees all the IT and information services (IS)
departments. Jae manages the day-to-day operations of the network and server
environment.
1. Jae Pak wants to know if his organization has enough software licenses for
their computers. Which Configuration Manager feature should he use to
determine how many software licenses he needs?
2. Jae Pak reports to Clair Hector that their organization needs 100 licenses for a
particular software product. Clair is trying to trim their department’s budget.
She wants to determine if all 100 licenses are absolutely necessary to perform
their work. What Configuration Manager feature can Jae use to determine
usage levels for the software product? What kind of data does this
Configuration Manager feature provide?
3. Next, Jae must work with his team to examine the Configuration Manager
hierarchy to determine what roles the sites will play. He needs to understand
the following concepts:
• What are the differences between the primary and secondary
Configuration Manager sites?
• What is a central site? What are parent and child sites?
• What are site systems? Name two site systems. What do they do?
Planning and Deploying a Single-Site Architecture 2-1

Module 2
Planning and Deploying a Single-Site
Architecture
Contents:
Lesson 1: Planning a Configuration Manager 2007 Site Deployment 2-4
Lesson 2: Preparing to Deploy a Configuration Manager 2007 Site 2-19
Lesson 3: Installing a Configuration Manager 2007 Site Server 2-36
Lab A: Deploying a Configuration Manager Site Server 2-41
Lab B: Deploying a Configuration Manager Site Server, Continued 2-51
Lesson 4: Performing Post-Setup Configuration Tasks 2-57
Lesson 5: Discovering Resources 2-66
Lab C: Managing Users and Configuring Boundaries and Discovery
Methods 2-84
Lesson 6: Monitoring and Troubleshooting Tools in Configuration
Manager 2007 2-91
Lab D: Monitoring and Troubleshooting Configuration Manager 2007 2-104

Module Overview
The goal of single-site planning and deployment is to deploy a Microsoft® System

Center Configuration Manager 2007 site successfully and efficiently, with
minimum interruption to your users and the network. In this module, you will
learn about planning, preparing to deploy, and implementing a System Center
Configuration Manager 2007 site. You also will learn about discovery, and how
Configuration Manager 2007 discovers resources that it needs to manage. Finally,
you will learn about the tools used to monitor and troubleshoot Configuration
Manager 2007.
• Plan a Configuration Manager 2007 site deployment.
• Prepare to deploy a Configuration Manager 2007 site.
• Install a Configuration Manager 2007 site server.

• Perform post-setup configuration tasks.
• Configure and enable discovery methods.

• Monitor and troubleshoot Configuration Manager 2007.

Lesson 1
Planning a Configuration Manager 2007 Site

Deployment
To successfully implement Configuration Manager 2007, you must understand the

planning process, allocate appropriate resources, and ensure that your system
setup satisfies the prerequisites for installing a Configuration Manager site or site
system. You are not limited to a single deployment strategy for the entire site
hierarchy, and you may decide to employ a mixture of strategies that best fits your
needs.
• Describe the preplanning tasks.
• Design the Configuration Manager 2007 site hierarchy.
• Choose an installation method.

• Describe Configuration Manager 2007 site-naming considerations.
• Describe site-mode considerations.

• Discuss Configuration Manager 2007 deployment planning.

Overview of Preplanning Tasks
Key Points
Preplanning involves examining and documenting the current computing
environment, determining business and technical objectives, and building a test
lab in preparation for the pilot project.
Main Preplanning Tasks

Perform the following three preplanning tasks to ensure a successful deployment:
• Analyze and document your current network and computing environment. To
optimally design your Configuration Manager site and site hierarchy, create
detailed documentation of your computing environment.
• Analyze your needs and identify objectives. You should understand what you
need, want, and expect from Configuration Manager.

• Establish a test lab environment. Installing Configuration Manager in a
production environment without first testing it on an isolated network or

virtual environment can cause undesirable and potentially damaging results.
Later, during the deployment planning stage, you should design a pilot project
in your production environment for further testing.
Preplanning Worksheets
The following table lists the available preplanning worksheets, and some sample
questions raised in the worksheet:
Worksheet Sample questions
Organizational Data What is the divisional structure of your organization?

Preplanning Worksheet What are the global and local administrative policies and
service level agreements (SLAs)?
Are there any major business changes planned for the
future?
Information Technology How does your IT organization map to your geographic

Organization Preplanning profile?
Worksheet What are your auditing policies?
What are your change control policies?
Geographic Profile Are there remote locations?

Preplanning Worksheet What are the date and time differences between
locations?
What operating systems language versions are in use, and
which locations use them?
Active Directory® What is the logical structure of your organization?

Preplanning Worksheet What is the physical structure of your organization?
Network Topology What is the number of servers and clients at each

Preplanning Worksheet location?
What are the link speeds and available bandwidth
between locations?
Server Environment Where are your servers located, and what function do
Preplanning Worksheet they fulfill?
What are the naming conventions used throughout your
environment?

Worksheet Sample questions
Client Environment What client operating systems are in use?

Preplanning Worksheet What types of connectivity are used, including remote
clients?
Security Preplanning What separation or delegation of duties exists between IT

Worksheet divisions within the enterprise?
To what degree do users need to retain control of their
client computers, and are there any exceptions?
Question: What are your business objectives for Configuration Manager 2007?

Planning for a Configuration Manager 2007 Single-Site
Deployment
Key Points
In the planning phase, you need to design your Configuration Manager site
hierarchy, and create a project deployment plan and schedule. You can use the
following tools to help you plan your Configuration Manager environment.
• Configuration Manager Planning Worksheets
• Infrastructure Planning and Design Guide for Configuration Manager 2007
Planning Considerations
During the planning phase, incorporate the requirements defined in the
preplanning phase such as:
• Site configuration.
• Support for business and technical objectives.

• Site security.
• Backup and recovery operations.
Infrastructure Planning and Design Guide for Configuration Manager

2007
The Infrastructure Planning and Design Guide for Configuration Manager 2007 leads
the reader through the process of planning a Configuration Manager infrastructure.
The guide addresses the following fundamental decisions and tasks:
• Identifying which Configuration Manager features will be needed
• Designing the components, layout, security, and connectivity of the
Configuration Manager infrastructure
Prioritize business objectives at the start of the project so that they are clearly
understood and agreed upon by IT and business managers.
Question: Why is it important to know the number of clients at each location

during the planning phase?

Choosing an Installation Method
Key Points
To set up a new Configuration Manager 2007 site, you can use either the Setup
Wizard or perform an unattended installation using a scripted installation method.
Setup Wizard: Simple Setup

The Setup Wizard simple installation option installs a Configuration Manager
primary site in mixed mode, and configures a single computer to host all the
necessary site server roles. Use the simple setup option for evaluation purposes
only; do not use it to deploy a production or test environment.
Setup Wizard: Custom Setup

The Setup Wizard custom installation option allows you to customize all of the
setup options available, depending on the type of installation you have selected.

Scripted Installation
Use the /script setup command-line option for scripted installations. You must
create an initialization file and specify the initialization file name after specifying
the /script setup command-line option. The name of the file is unimportant as
long as it has the .ini file name extension. When referencing the setup initialization
file from the command line, you must give the full path to the file. For example, if
your setup initialization file is named setup.ini and it is stored in the C:\setup
directory, your command line would be:
setup /script c:\setup\setup.ini
Question: You need to quickly install a Configuration Manage 2007 site for a
demonstration. Which deployment method would you use?
Question: You are deploying Configuration Manager 2007 secondary sites in

several remote locations with similar requirements, and the deployment plan calls
for the deployment to occur over a six-month period. Which deployment method
would you use?

Site Naming Considerations
Key Points
Site codes and site names identify and manage the sites in a Configuration
Manager hierarchy, and you must plan them carefully before deployment.
Specifying Site Codes and Site Names

Configuration Manager setup prompts you for a site code and site name for each
primary and secondary site installation. In the Configuration Manager console,
these site identifiers are displayed in the <site code> - <site name> format.
Each site code in a hierarchy must be unique. Additionally, if Active Directory
Domain Services (AD DS) is extended for Configuration Manager, and sites are
publishing data, the site codes used within an Active Directory forest must be
unique even if a different Configuration Manager hierarchy is using them.
During Configuration Manager setup, in the site code, avoid using names that are
reserved by Windows®, such as AUX, CON, NUL, and PRN. Some Configuration
Manager components use these codes in folder names.

Note: Configuration Manager setup does not verify that the site code you enter is
not in use already.
To enter a site’s code when using Configuration Manager Setup, you must enter
three alphanumeric characters. Only the letters A through Z, numbers 0 through 9,
or combinations of the two, are allowed when specifying site codes. The sequence
of letters or numbers has no effect on communications between sites. For example,
it is not necessary to name a primary site ABC and a secondary site DEF.
The site name is a friendly name identifier for the site. Use only the standard
characters A through Z, a through z, 0 through 9, and the hyphen (-) in site names.
Note: Changing the site code or site name after installation is not supported.
Reusing Site Codes

You should not use site codes more than once in a Configuration Manager
hierarchy for active sites.

Site Mode Considerations
Key Points
Use site modes to configure client-to-server communication. Configuration
Manager 2007 includes two sites modes: native mode, and mixed mode.
Native mode provides a higher level of security between clients and servers than
that which is provided by mixed mode. Mixed mode exists to provide a supported
site mode for networking environments that do not have an existing public key
infrastructure (PKI) infrastructure and backward compatibility with Microsoft
Systems Management Server (SMS) 2003 clients and sites.
Mixed Mode
Use mixed mode if any of the following are true:
• The site will support SMS 2003 clients.
• The site has a parent site configured for mixed mode.

• You have an existing PKI, but have not installed the signing certificate on the
site server.
• You have not implemented a PKI in your environment.
Mixed mode sites cannot use client certificates to authorize clients; instead, they
use a configurable approval setting.
Native Mode
Use native mode if you need the highest level of security in Configuration Manager
or must support Internet-based clients. Before you configure native mode, you
must configure all of the following:
• An existing PKI
• A site server signing certificate that is installed on the site server
• Web certificates on certain site system roles
• Client authentication certificates on all Configuration Manager clients, and on
the management point
Note: Native mode secures client-to-server communications only. To protect server-

to-server communication, implement Internet Protocol Security (IPsec). To protect
site-to-site communication, use secure key exchange between sites.
Question: What is required before you configure a Configuration Manager 2007

site in native mode?

Discussion: Planning a Configuration Manager 2007
Deployment
Key Points
Consider the following scenario:
The Woodgrove Bank corporate headquarters uses 5,000 client computers. The
company also has two remote offices connected via separate 155 megabits per
second (Mbps) wide area network (WAN) links, one of which supports 200 client
computers, and the other 25 client computers. Information Technology (IT)
management would like to install Configuration Manager 2007, and use hardware
and software inventory, reporting, and software delivery. IT expects to support
delivery of large applications such as the 2007 Microsoft Office system.

Question: What are some of the site planning considerations you should use to
identify the number and types of sites you require?
Question: What are some of the site systems that you should consider during your
planning stage?
Question: What are some of the factors that will determine the site mode used in
the deployment?

Lesson 2
Preparing to Deploy a Configuration Manager

2007 Site
When preparing to deploy a Configuration Manager 2007 site, there are several
prerequisites that need to be in place before the installation of Configuration
Manager 2007 can proceed as planned. In addition, if the deployment plan
includes publishing site information to AD DS, then the Active Directory Schema
needs to be extended.
• Describe site system requirements.
• Use the Configuration Manager prerequisite checker.
• Install and configure the prerequisites for Configuration Manager 2007.
• Extend the Active Directory schema.

Site System Requirements
Key Points
Before installing Configuration Manager 2007, you must check your systems for
hardware requirements, supported platforms, and database requirements.
In general, the requirements for Configuration Manager installation are:
• A Windows Server® 2003 operating system with Service Pack 1 (SP1) or
greater, that is capable of running Configuration Manager in your
environment.
• A server installed with Microsoft SQL Server® 2005 SP2 or greater. This server
can be the same server as the site server, or a separate server.

Site System Hardware Requirements
The following table lists the minimum hardware requirements for a Configuration
Manager 2007 site system.
Hardware
component Requirement
Processor 733 megahertz (MHz) Pentium III minimum (2.0 gigahertz (GHz) or
faster recommended)
RAM 256 megabytes (MB) minimum (1024 MB or more recommended)
Free disk space 5 gigabytes (GB) minimum (15 GB or more free recommended if
using Operating System Deployment)
Network adapter Site system computers must have network connectivity to other
Configuration Manager 2007 site systems, and they must have
network connectivity to clients to manage them.
General site system hardware requirements are:

• Unsupported site system platforms. Configuration Manager 2007 does not
support site system role installation on the following operating systems:
• Windows Server versions prior to Windows Server 2003 with SP1
• Windows Server 2008 core installations
• Windows Server 2008 Foundation edition installations
• Unsupported client platforms. The Configuration Manager 2007 client is not
supported on any operating system prior to Microsoft Windows 2000 Server
with SP4.
• Active Directory domain. All Configuration Manager 2007 site systems must be
members of a Windows 2000, Windows Server 2003, or Windows Server
2008 Active Directory domain.
• Site database. You can install the Configuration Manager 2007 site database on
either the default instance or a named SQL Server instance that is supported
by the version of Configuration Manager 2007 that you are using.

Specific Requirements for Configuration Manager 2007

The following table describes the SQL Server versions that you can use to host the
Configuration Manager 2007 site database:
SQL Server version Edition Service pack System architecture

SQL Server 2005 Standard or Enterprise SP2 or SP3 x86 or x64
SQL Server 2008 Standard or Enterprise x86 or x64
Specific Requirements for Configuration Manager 2007 SP1

Configuration Manager 2007 SP1 introduced several new features that have their
own requirements.
• Network Access Protection. Network Access Protection in Configuration
Manager 2007 requires a System Health Validator point running the Windows
Server 2008 operating system.
• Out of band service point. This role requires the Intel vPro chip set, and the
following versions of Intel Active Management Technology (Intel AMT):
• Intel AMT version 3.2 with a minimum revision of 3.2.1
• Intel AMT version 4.0 and version 4.1
• Intel AMT version 5.0
• SQL Server 2008 SP1. In addition to the aforementioned SQL Server versions,
you can also use SQL Server 2008 SP1.
SQL Server version Edition Service pack System architecture

SQL Server 2005 Standard or Enterprise SP2 or SP3 x86 or x64
SQL Server 2008 Standard or Enterprise None or SP1 x86 or x64


Question: Your purchasing department has recommended buying a single 2U

server with Dual XEON Quad Core processors, 64 GB of ram, and a hard drive
array consisting of six 600 GB drives. Your organization plans to manage
approximately 200 applications across the headquarters and three well-connected
remote locations. Is this server adequate to use as a Configuration Manager 2007
SP2 R2 server running all supported roles, assuming it is the sole server used in
the Configuration Manager 2007 infrastructure?

Using the Configuration Manager Prerequisite Checker
Key Points
During installation, the Configuration Manager setup prerequisite checker verifies
that software and settings required for setup are installed. In some cases, the
required software may require additional software updates that Configuration
Manager setup does not verify. Before beginning Configuration Manager setup,
ensure that the operating system, and additional software components that
Configuration Manager setup relies on, have been updated with all relevant
software updates.
The prerequisite checker reviews installation requirements for the following
components:
• General site
• Configuration Manager primary site server
• Site database
• SMS Provider

• Configuration Manager secondary site
• Configuration Manager console

• Configuration Manager features
Running the Prerequisite Checker

You can run the prerequisite checker from the setup autorun window by clicking
the Run the prerequisite checker option.
Alternatively, run the prerequisite checking program from the
%CDROOT%\SMSSETUP\BIN\I386\ folder in a command prompt, as follows:
Setup.exe /prereq
Question: Does running the prerequisite checker with no reported issues

guarantee that all Configuration Manager features will function as expected?

Installing and Configuring the Prerequisites for
Key Points
After reviewing the Configuration Manager 2007-supported configurations, you
should next ensure that you have the proper prerequisites for installing a
Configuration Manager site or site system. Knowing what the prerequisites are
ahead of time enables you to efficiently deploy Configuration Manager sites and
features to most effectively support the clients assigned to the site.
In general, the custom installation prerequisites for a Configuration Manager 2007
primary site in mixed mode are:
• Internet Information Services (IIS) installed with the World Wide Web Service
or Web Server role, and:
• Active Server Pages (ASP) enabled
• Background Intelligent Transfer Service (BITS) enabled
• Web Distributed Authoring and Versioning (WebDAV) enabled

• The Microsoft Management Console (MMC) 3.0 and Microsoft .NET
Framework 2.0 or later on the primary site server

• Remote Differential Compression
• SQL Server database service. This service is the only required SQL Server
component to host the site database.
• Reporting Services feature. This feature is required to support a Reporting
Services point.
Question: You plan to install Configuration Manager 2007 SP2 with all
components on a single Windows Server 2008 R2 computer. What features and
components must be installed prior to Configuration Manager setup?

Demonstration: Installing and Configuring Configuration
Manager 2007 Prerequisites
Key Points
In this demonstration, you will review how to check for missing prerequisites with
the prerequisite checker, and how to install Windows Server 2008 features to
support the Configuration Manager installation.
Additionally, the instructor will configure WebDAV for IIS 7.5 and modify BITS
request filtering. Configuring WebDAV and modifying BITS request filtering is
necessary for BITS-enabled distribution point site server computers.

Demonstration Steps
Use the prerequisite checker

1. Run the prerequisite checker.
2. Fill in the Installation Prerequisite Check Options with the SQL Server name
and instance if applicable, the SDK Server name, and the management point
computer fully qualified domain name (FQDN) on the intranet.
3. Click OK. Note any missing prerequisites.
Install Windows Server 2008 features to support Configuration

Manager 2007
1. Exit the prerequisite checker and return to the Server Manager page.
2. Add the following features:
• Background Intelligent Transfer Service (BITS)
• Add Required Role Services
3. Add the following role services to the Web Server (IIS):
• WebDAV Publishing
• Windows Authentication
• IIS 6 Metabase Compatibility
• IIS 6 WMI Compatibility
4. On the Confirm Installation Selections page, click Install.
5. On the Installation Results page, click Close.
Configure WebDAV for IIS 7.5

1. In the Server Manager window, expand roles, expand Web Server (IIS), and
then select Internet Information Services (IIS) Manager.
2. Expand the server name, expand Sites, and then select Default Web Site.

3. Configure WebDAV Authoring Rules as follows:
• Enable WebDAV
• Add Authoring Rule
• Allow access to all content
• Allow access to this content to all users
• Read permissions
• WebDAV Settings
• Allow anonymous property queries: True
• Allow Custom Properties: False
• Allow property queries with infinite depth: True
• Allow hidden files to be listed: True
4. In the Actions pane, click Apply.
5. Close the Server Manager.
Modify BITS request filtering

1. In Notepad, open
%windir%\System32\inetsrv\config\applicationHost.config.
2. Search for the <requestFiltering> section.
3. Review the configuration.
Question: Which IIS 7.5 features are required to support Configuration Manager
2007 SP2?
Question: When do you need to edit the applicationHost.config file?


Extending the Active Directory Schema
Key Points
Extending the Active Directory schema is a forest-wide action that you perform
only once per forest. Extending the schema is an irreversible action and must be
performed by a member of the Schema Admins Group, or an administrator with
sufficient permissions to modify the schema. You can extend the Active Directory
schema before or after Configuration Manager setup. However, if you extend the
schema before setup, Configuration Manager automatically configures the site to
publish site information during setup, and publish site information to AD DS at the
completion of setup.
You can extend the Active Directory schema using either of the following methods:
• LDIFDE command-line utility and the ConfigMgr_ad_schema.ldf file
• ExtADSch.exe utility

Features and Functions That Use Active Directory Schema Extensions
Some Configuration Manager features—such as Network Access Protection (NAP)

for Configuration Manager and global roaming—require extending the Active
Directory schema. However, for other features that work best with extended Active
Directory schema, you may choose to not extend the schema.
Enabling Active Directory Functionality for Configuration Manager

Use one of the following methods to successfully enable Configuration Manager
clients to query AD DS to locate site resources:
Method one:
1. Extend the Active Directory schema.
2. Use the Active Directory Services Interface Editor to create the System
Management container within the System container.
3. Set security permissions on the System Management container. After creating
the System Management container, you must grant the primary site server’s
computer account full control to the System Management container, and to all
of its child objects, so that it can successfully publish information.
4. Enable Active Directory publishing for the Configuration Manager site.
Method two:
1. Extend the Active Directory schema.
2. Set security permissions on the System container. You must grant the primary
site server’s computer account full control to the System container, and all of
its child objects, so that it can successfully publish information.
3. Enable Active Directory publishing for the Configuration Manager site.
Question: What permissions must you have to extend the Active Directory schema
for Configuration Manager 2007?
Question: What permissions must you set on the System Management container?

Demonstration: Extending the Active Directory Schema
Key Points
In this demonstration, you will review how to extend the Active Directory schema,
and then verify that you successfully extended it. Additionally, the instructor will
create a System Management container in AD DS and configure its permissions.
Prior to extending the schema, you should always:
1. Create a backup of the schema master domain controller’s system state using
the NTBACKUP utility.
2. Disconnect the schema master domain controller from the network.
Note: This demonstration illustrates one method of extending the Active Directory
schema, and one method of setting System Management container permissions. The
lab that follows utilizes alternative methods.

Demonstration Steps
Extend the Active Directory schema

1. On the Domain Controller that is the schema master, copy
\\NYC-CFG1\Labfiles\ConfigMgrSP2\SMSSETUP\BIN\I386
\ConfigMgr_ad_schema.ldf to C:\Temp.
2. Edit ConfigMgr_ad_schema.ldf and replace all instances of DC=x with the
domain information: DC=Contoso,DC=Com
3. Open a command prompt with elevated rights.
4. Run the following command, using the temporary location you copied the
LDIF file to:
ldifde –i –f C:\Temp\ConfigMgr_ad_schema.ldf –v –j C:\temp\
Verify that the schema was successfully extended

• Review the ldif.log in C:\temp.
Note: Given a successful extension, you would now reconnect the schema master
domain controller to the network and allow it to replicate the schema extensions to
the global catalog servers throughout the Active Directory forest. If unsuccessful,
you would instead restore the previous system state using the NTBACKUP utility to
reverse the schema extension actions before reconnecting the schema master
domain controller to the network.
Create the System Management container in AD DS

1. Open ADSIEdit, and then connect to AD DS.
2. In the console pane, expand the containers until you expand the System
container, and then right-click CN=System.
3. On the Context menu, click New, and then click Object.
4. In the Create Object dialog box, select Container, and then click Next.
5. In the Value field, type System Management, and then click Next.
6. Click Finish.

Configure permissions on the System Management container
• Configure security so that the Configuration Manager server has full control
permissions on System Management container and “This object and all
descendant objects”.
Question: What information must you edit in the ConfigMgr_ad_schema.ldf file?


Lesson 3
Installing a Configuration Manager 2007 Site

Server
To setup a new Configuration Manager site, perform a scripted installation or use

the Configuration Manager Setup Wizard to perform a simple or custom
installation. From the Setup Wizard, you also may choose to upgrade an existing
site, install or upgrade the Configuration Manager console, perform maintenance
tasks, or uninstall a Configuration Manager site.
• Describe the Configuration Manager setup tasks.
• Install a primary site.
• Deploy a Configuration Manager site server.
• Verify a successful site server installation.

Configuration Manager Setup Tasks
Key Points
There are a number of tasks you can perform with the Configuration Manager
2007 Setup Wizard. You can determine which options best fit your deployment
needs.
Installing a Site Server

You have two options for installing new Configuration Manager 2007 sites: simple
setup, and custom setup. Simple setup is intended for evaluation purposes only,
and you should not use it to install a production site. Custom setup allows greater
flexibility in configuring site system and client agent settings.

Upgrading an Existing Installation
You can use the Configuration Manager Setup Wizard to perform an in-place
upgrade if you determine that you can upgrade an existing SMS 2003 or
Configuration Manager 2007 primary site directly to Configuration Manager 2007.
When you upgrade a site to Configuration Manager 2007 SP2 using the in-place
upgrade method, the site server and its site systems do not change their site system
roles. Also, existing clients do not change their site assignments when you upgrade
the site.
Installing or Upgrading a Configuration Manager Console

The Configuration Manager console installs automatically on all primary sites. To
distribute administrative tasks among your organization’s personnel, you might
choose to install the Configuration Manager console on other computers. If you
upgrade a primary site, you also should upgrade any remote administrator
consoles.
Performing Site Maintenance or Resetting a Site

Site maintenance allows you to change your the SQL Server configuration options
or perform a site reset. Selecting this action in the Configuration Manager Setup
Wizard allows you to perform the following actions:
• Modify the SQL Server configuration.
• Modify the SMS Provider configuration.
• Reapply default file and registry permissions on the site server. A site reset also
reinstalls all site system roles.
Uninstalling a Site Server

You can use the Configuration Setup Wizard to uninstall a primary or secondary
site, or the Configuration Manager console. After uninstalling a primary site, verify
that Configuration Manager deleted site information from AD DS. After
successfully uninstalling a secondary site, you must manually delete the address to
the secondary site, and also delete the secondary site from the primary site’s
Configuration Manager console using the Delete Secondary Site Wizard.
Question: What is the major difference between a primary site and a secondary
site?
Question: What new installation methods can you use to deploy a site server?

Demonstration: Installing a Primary Site
Key Points
In this demonstration, you will review how to install a primary site and the
Configuration Manager console.
Demonstration Steps
Install a primary site

1. On NYC-CFG1, run E:\Labfiles\ConfigMgrSP2\Splash.html.
2. Click Configuration Manager 2007 SP2.
3. In Welcome to the Microsoft System Center Configuration Manager 2007
SP2 Setup Wizard, use the Custom installation method to install a Primary
site. Use default settings except for:
• Site code: NYC
• Site name: Central Site - New York City

• Updated prerequisite components: The latest updates have already been
downloaded to an alternate path

• Updated prerequisite component: E:\Labfiles\Downloads
4. Review the Settings Summary page, and then click Next.
5. Review the Installation Prerequisite Check page, and then click Begin
Install.
Install the Configuration Manager console

1. On NYC-CL1, run \\NYC-CFG1\Labfiles\ConfigMgrSP2\Splash.html.
SP2 Setup Wizard, on the Available Setup Options page, ensure Install or
upgrade an administrator console is selected, and then click Next. Use
default settings unless otherwise indicated:
• Server name: NYC-CFG1
Install.
Question: What is required to install the site in native mode?
Question: If you do not select the NAP client agent during installation, would you
need to re-run setup if you decide to install a Windows Server 2008 NAP
infrastructure at a later date?

Lab A: Deploying a Configuration Manager Site
Server
Lab Setup
For this lab, you will use the available virtual machine environment. Before you
begin the lab, you must:
1. On the host computer, click Start, point to Administrative Tools, and then
click Hyper-V Manager.
2. Ensure that the 6451B-NYC-DC1, 6451B-NYC-CFG1, and the 6451B-NYC-
CL1 virtual machines are running.
• NYC-DC1: Domain controller in the Contoso.com domain.
• NYC-CFG1: Configuration Manager 2007 server in the Contoso.com
domain.
• NYC-CL1: Windows 7 client computer in the Contoso.com domain.

3. If required, connect to the virtual machines. Log on to the computers as
Contoso/Administrator using the password Pa$$w0rd.
Important: Start the NYC-DC1 virtual machine first, and ensure that it starts fully
before starting the other virtual machines.
Lab Scenario
You are the network administrator for Contoso, Ltd. Contoso has begun a new
initiative for system management and auditing. As part of this initiative, Contoso
has plans to upgrade the client operating systems and line-of-business (LOB)
software throughout the company. You have decided that Configuration Manager
2007 will meet Contoso’s requirements for management and audit support, while
also providing a mechanism for upgrading the existing clients.

Exercise 1: Installing Configuration Manager Prerequisites
Scenario
To ensure a successful Configuration Manager installation, you must first prepare a
server.
The main tasks for this exercise are as follows:
1. Check for existing prerequisites.
2. Install Windows Server 2008 features.
3. Configure WebDAV.
Task 1: Check for existing prerequisites

1. Log on to NYC-CFG1 as Contoso\Administrator using the password
Pa$$w0rd.
2. Open Windows Explorer and browse to E:\Labfiles\ConfigMgrSP2.
3. Run Splash.html.
4. Run the prerequisite checker with the following:
• SQL Server and instance, if applicable: NYC-CFG1
• SDK Server: NYC-CFG1
• Management point computer FQDN on the intranet: NYC-
CFG1.contoso.com
5. Record the missing prerequisites.
Task 2: Install Windows Server 2008 features

1. On NYC-CFG1, open Server Manager and add the following features:
• BITS and any required role services

2. Add the following Web Server (IIS) Role Services:
• Common HTTP feature node: WebDAV Publishing

• Security node: Windows Authentication
• Management Tools / IIS 6 Management Compatibility node: IIS 6
Metabase Compatibility and IIS 6 WMI Compatibility
Task 3: Configure WebDAV

1. On NYC-CFG1, open the Internet Information Services (IIS) Manager.
2. On the default Web site, enable WebDAV.
3. Add an authoring rule for WebDAV and configure it as follows:
• Allow access to: All content
• Allow access to this content to: All users
• Permissions: Read
4. Configure the WebDAV settings as follows:
• Property behavior: Allow Anonymous Property Queries: True
• Property behavior: Allow Custom Properties: False
• Property behavior: Allow Property Queries with Infinite Depth: True
• WebDAV behavior: Allow Hidden Files to be Listed: True
Results: After this exercise, you should have installed the prerequisite components
for a Configuration Manager 2007 SP2 single-site deployment.

Exercise 2: Extending the Active Directory Schema for
Configuration Manager
Scenario
You have prepared a server for installing a Configuration Manager 2007 primary
site server. After researching the methods that client systems can use for locating a
site server, you have determined the most efficient method for the Contoso
environment is AD DS. To utilize AD DS, you first need to extend the Active
Directory schema.
1. Extend the Active Directory schema with EXtADSch.
2. Configure Active Directory permissions.
Task 1: Extend the Active Directory schema with ExtADSch

1. Log on to NYC-DC1 as Contoso\Administrator using the password
Pa$$w0rd.
2. Browse to \\NYC-CFG1\Labfiles\ConfigMgrSP2\SMSSETUP\BIN\I386.
3. Run the ExtADSch.exe utility as an administrator.
4. Review C:\ExtADSch.log.
Task 2: Configure Active Directory permissions

1. On NYC-DC1, open Active Directory Users and Computers, and then turn on
Advanced Features viewing.
2. Grant NYC-CFG1 full control permissions to the System container and all
descendant objects.
Results: After this exercise, you should have extended the Active Directory schema
and set permissions for the Configuration Manager server to publish information in
AD DS.

Exercise 3: Installing Configuration Manager 2007 SP2
Scenario
Having prepared the server and the Active Directory environment for
Configuration Manager 2007, you are now ready to begin the installation. You
have decided to use a custom installation and install a management point on the
primary site server. You will also install the Configuration Manager console on
your desktop.
1. Install a primary site.
2. Install the Configuration Manager console.
Task 1: Install a primary site

1. On NYC-CFG1, connect to E:\Labfiles\ConfigMgrSP2.
2. Run Splash.html.
3. Install a Configuration Manager site server with the following:
• Installation settings: Custom settings
• Site type: Primary site
• Destination folder: C:\Microsoft Configuration Manager\
• Site code: NYC
• Site name: Central Site - New York City
• Site mode: Configuration Manager Mixed Mode
• Management point: NYC-CFG1: Contoso.Com
• Updated Prerequisite Components: The latest updates have already been
downloaded to an alternate path,
E:\Labfiles\ConfigMgrSP2\Download.
4. While the installation completes, continue to the next task.

Task 2: Install the Configuration Manager console
1. On NYC-CL1, connect to \\NYC-CFG1\Labfiles\ConfigMgrSP2.

2. Run Splash.html.
3. Install the Configuration Manager console with default settings, except for the
following:
• Server name: NYC-CFG1
Results: After this exercise, you should have begun the installation of Configuration
Manager 2007 and the Configuration Manager console on a separate machine. The
installation will run for about 30 minutes while the instructor continues with the
course. You will continue deploying a Configuration Manager site server in the next
lab.

Demonstration: Installing Configuration Manager 2007 R2
Key Points
In this demonstration, you will review how to verify a successful site server
installation, and then you will see how to install Configuration Manager 2007 R2.
Demonstration Steps
Verify successful site-server installation

1. Verify site-server installation has completed as indicated by a green check
mark, and then click Next.
2. On the Completing the Microsoft System Center Configuration Manager
2007 SP2 Setup Wizard page, click View Log.
3. View the log entries from the prerequisite check through the completion of the
installation. Note the various stages and completion messages.
4. Close the ConfigMgrSetup.log.
2007 SP2 Setup Wizard page, click Finish.

6. Open and review the C:\ComponentSetup.log.
7. Close the C:\ComponentSetup.log.
Verify the creation of the Configuration Manager objects in AD DS

1. In ADSIEdit, verify the CN=SMS-Site-NYC object and the CN=SMS-MP-NYC
objects exist under the System Management container.
2. Close all open windows.
Verify the Configuration Manager 2007 version for the site

1. Open the Configuration Manager console.
2. Expand Site Database, expand Site Management, right-click NYC-Central
Site-New York City, and then click Properties. Note the information on the
General tab.
Install Configuration Manager 2007 R2

1. On NYC-CFG1, run E:\Labfiles\ConfigMgrR2\splash.html.
2. Under Install, click Configuration Manager 2007 R2.
R2 Setup Wizard, install Configuration Manager with default settings.
Update the Configuration Manager console

1. On NYC-CL1, run \\NYC-CFG1\Labfiles\ConfigMgrR2\splash.html.
R2 Setup Wizard, install Configuration Manager with default settings.

Verify successful Configuration Manager installation

Site-New York City, and then click Properties. Note the R2 status line.
Question: What is the name of the Configuration Manager setup log file, and
where is it located?
Question: Which user was added to the SMS Admins group during installation?
Question: What are the requirements for installing Configuration Manager 2007
R2?

Lab B: Deploying a Configuration Manager Site
Server, Continued
Lab Setup
1. On the host computer, click Start, point to Administrative Tools, and click
Hyper-V Manager.
domain.
Contoso\Administrator, using the password Pa$$w0rd.

Lab Scenario
has plans to upgrade the client operating systems and LOB software throughout
the company. You have decided that Configuration Manager 2007 will meet
Contoso’s requirements for management and audit support, while also providing a
mechanism for upgrading the existing clients.

Exercise 1: Verifying a Successful Configuration Manager
Site Server Installation

Scenario
You have installed the primary site and the Configuration Manager console. Now
you need to verify the installation of the base product—Configuration Manager
2007 SP2—before proceeding with any initial configuration.
1. Complete the installation on NYC-CL1.
2. Complete the installation on NYC-CFG1.
3. Review the Configuration Manager Setup log.
4. Review the Configuration Manager Component Setup log.
5. Verify the Configuration Manager 2007 version of the site.
Task 1: Complete the installation on NYC-CL1

1. Connect to the NYC-CL1 computer.
2. Complete the Microsoft System Center Configuration Manager 2007 SP2
Setup Wizard.
Task 2: Complete the installation on NYC-CFG1

1. Connect to the NYC-CFG1.
2. Complete the Microsoft System Center Configuration Manager 2007 SP2
Setup Wizard.
Task 3: Review the Configuration Manager Setup log

1. Open C:\ConfigMgrSetup.log.
2. Review the log file to check for errors. Ensure that the following events
completed successfully:
• Prerequisite checking
• Verifying SMS Active Directory Schema Extensions

• DATABASE CREATION
• Collection creations
• Adding a login for the SMS Site Server
• SQLINSTALL Returning with Success!
• Successfully created local user group
• Granted SMS Admins rights to WMI Name Space
• Done with service installation
• Completed monitoring installation of Configuration Manager services
• Installation and configuring site are done
• Moving to Finish page
Task 4: Review the Configuration Manager Component Setup log

• Open C:\ComponentSetup.log, and review the log file for errors.
Task 5: Verify the Configuration Manager 2007 version of the site

1. On NYC-CFG1, open the Configuration Manager console.
2. Review the properties for the NYC-Central Site-New York City site.
Results: After this exercise, you should have verified that the Configuration Manager
installation has completed successfully.

Exercise 2: Verifying the Creation of the System
Management Container
Scenario
You are satisfied that the installation was successful, and now want to verify that
the Active Directory objects were successfully created.
• Verify the creation of the Configuration Manager objects in AD DS
Task: Verify the creation of the Configuration Manager objects in

AD DS
• On NYC-DC1, in Active Directory Users and Computers, check the System
container for the following objects:
• System Management container
• SMS-MP-NYC-NYC-CFG1 object in the System Management container
• SMS-Site-NYC object in the System Management container
Results: After this exercise, you should have verified that the System Management
container was successfully created in AD DS, and that the Configuration Manager
objects were created in AD DS.

Exercise 3: Installing Configuration Manager 2007 R2
Scenario
You successfully installed Configuration Manager 2007 SP2, and the Active
Directory objects exist as expected. Now you are ready to install the Configuration
Manager 2007 R2 update.
1. Install Configuration Manager 2007 R2 on NYC-CFG1.
2. Verify the Configuration Manager 2007 R2 installation.
3. Install Configuration Manager 2007 R2 on NYC-CL1.
Task 1: Install Configuration Manager 2007 R2 on NYC-CFG1

1. On NYC-CFG1, connect to E:\Labfiles\ConfigMgrR2.
2. Run Splash.hta.
3. Install Configuration Manager 2007 R2 with default settings.
Task 2: Verify the Configuration Manager 2007 R2 installation

2. Review the properties for the NYC-Central Site-New York City site.
Task 3: Install Configuration Manager 2007 R2 on NYC-CL1

1. On NYC-CL1, connect to \\NYC-CFG1\Labfiles\ConfigMgrR2.
2. Run Splash.hta.
3. Install Configuration Manager 2007 R2 with default settings.
4. Log off NYC-CL1 when installation completes.
Results: After this exercise, you should have installed and verified Configuration
Manager 2007 R2.

Lesson 4
Performing Post-Setup Configuration Tasks
After installing Configuration Manager 2007, you must configure the new site.
Begin the site configuration process by defining site characteristics, and
configuring site systems at a single site. After completing basic site system
configuration, you must prepare the site to manage clients, and additional feature
installation and configuration. After installing primary sites, there are some
mandatory tasks that you must complete, and others which are optional.
• Describe the required post-setup configuration tasks.
• Configure Configuration Manager 2007 object security.
• View and configure site settings.

Required Post-Setup Configuration Tasks
Key Points
After Configuration Manager setup, there are still a few tasks you must perform to
create a functioning Configuration Manager 2007 site. A Configuration Manager
site usually requires a management point, and additional site settings must be
configured before you configure specific features.
Note: Configure each Configuration Manager 2007 site individually. Child sites do
not inherit the properties of their parent sites.
The Configuration Manager console is the primary interface between you and the
Configuration Manager site. The Configuration Manager console tree contains a
hierarchical listing of Configuration Manager objects. From the console tree, you
can view:
• The contents of a selected item displayed in the results pane.
• Shortcut menu options in the Actions pane.

Mandatory Configuration Tasks
You must perform the following tasks after installing a Configuration Manager site,
if the site will have assigned clients:
• Configure Configuration Manager site boundaries. Boundaries are defined by
IP subnets, Active Directory site names, Internet Protocol version 6 (IPv6)
Prefix, or IP ranges. Decide whether you will use the site boundary for either a
slow or unreliable, or a fast local area network (LAN) connection.
• Configure the site’s default management point. Install the management point
site system role on one or more site systems for the site. If installed during
setup, Configuration Manager automatically configures the default
management point. Otherwise, you need to configure the management point
yourself.
• Configure site systems. Add additional site systems for offloading components,
and modify site system properties. Site system properties are described in later
modules.
• Configure site system roles, and add additional roles for planned features. Site
system roles are described in later modules.
• Configure site components. The following components have site-level
configuration options:
• Software distribution
• Software update point
• Status reporting
• System Health Validator point
Site components are described in later modules.
Question: What are several site system roles you might be required to set up after
deploying a Configuration Manager site?

Configuration Manager Object Security
Key Points
The SQL Server database stores the Configuration Manager security settings. By
default, the setup process grants the site server system account (NT Authority
\SYSTEM) full control permissions in SQL Server for the Configuration Manager
database. Permissions defined for Configuration Manager objects are stored in the
SQL Server database.
The Configuration Manager console contacts the SMS Provider server using
Windows Management Instrumentation (WMI). The SMS Provider then queries
the SQL Server database to determine if the user running the Configuration
Manager console has the appropriate object security rights to perform the
requested task.
If the SMS Provider computer is unavailable, the Configuration Manager console
does not function.

Question: What is the purpose of the SMS Provider?
Question: In addition to setting object and class rights for users or groups, you
add users to what other group if they are required to use the Configuration
Manager console?

Demonstration: Performing Post-Setup Configuration Tasks
Key Points
In this demonstration, you will review how to perform a variety of post-setup
configuration tasks.
Demonstration Steps
Examine site properties

1. On the Configuration Manager 2007 server, open the Configuration Manager
console.
2. Examine the site Properties.

Configure boundaries
• Create a New Site Boundary with the following settings:

• Description: Headquarters network
• Type: IP address range
• Starting address: 10.10.0.1
• Ending address: 10.10.0.99
Examine client agents, component configuration, and the site system

node
1. In Configuration Manager console, click the Client Agents node. Note the
agents.
2. Click the Component Configuration node. Note the components.
3. Click the Site Systems node. Note the roles.
Clone an existing user

1. In the Security Rights node, under the Users node, right-click a user, and then
click Clone ConfigMgr User.
2. Create a user called Contoso\BadUser.
Clone an existing user using the ConfigMgr User Wizard

1. Right-click the Users node, and then click Manage ConfigMgr Users.
2. Use the ConfigMgr User Wizard to grant the SCCM_Full_Admin group the
same rights as the Contoso\Administrator user.
Add a user using the ConfigMgr User Wizard

• Use the ConfigMgr User Wizard to add the SCCM_Dist_Software group, and
then grant the following rights:
• Class: Collection, Instance: All Windows Workstation or Professional
Systems, Rights: Advertise.
• Class: Package, Instance: (All Instances), Rights: Read.

Test the Configuration Manager console for remote access
1. Log on to NYC-CL1 as Ed.

2. Click Start, click All Programs, click Microsoft System Center, click
Configuration Manager 2007, and then click ConfigMgr Console.
3. Once the System Center Configuration Manager Home Page appears, click Site
Database (NYC-CFG1). Note the error that occurred because Ed does not
have the appropriate Distributed Component Object Model (DCOM) rights on
the server. He does not have Administrator status.
4. Close the Configuration Manager console.
Configure DCOM for remote management

1. On the Configuration Manager server, run Dcomcnfg.exe.
2. In Component Services, click Console root, expand Component Services,
expand Computers, right-click My Computer, and then click Properties.
3. In the My Computer Properties dialog box, click the COM Security tab, and
then in the Launch and Activation Permissions section, click Edit Limits.
4. In the Launch and Activation Permissions dialog box, click Add.
5. In the Select User, Computers, or Groups dialog box, click Locations, select
the Configuration Manager 2007 server, and then click OK.
6. In the Enter the object names to select (examples): box, type SMS Admins,
and then click OK.
7. In the Permissions for SMS Admins section, select the Allow check box for
Remote Activation.
8. Close all open windows
Configure permissions on the Microsoft Configuration Manager folder

1. On NYC-CFG1, open the Allfiles (E:) drive.
2. Open the Microsoft Configuration Manager folder, and then click
Properties.

3. On the Security tab, grant the SMS Admins local group read permissions to
the folder and all subordinate folders.

4. On the Sharing tab, grant the SMS Admins local group read permissions to
SMS_NYC share.
Add SCCM_Full_Admin to the Administrators group

1. On NYC-CFG1, open Computer Management, and then expand Local Users
and Groups.
2. Open the Administrators group and the Contoso\SCCM_Full_Admin group.
Test remote management

1 Log on to NYC-CL1 as Ed.
3. Note that Ed can now see all the management options.
5. Log off NYC-CL1, and then log back on as Andrea.
7. Note that Andrea has a limited selection of management options.
Question: If you granted a new user Read permissions directly to the Collections
node, what additional task must you complete before the user could view the
collections?
Question: What three actions are available in the ConfigMgr User Wizard?

Lesson 5
Discovering Resources
You can use Configuration Manager discovery methods individually or in

combination to identify your organization’s resources. All discovery methods
generate discovery data. However, each method serves a different purpose.
• Describe resource discovery.
• Describe the resource discovery methods.
• Configure Active Directory discovery methods.
• Configure Network Discovery options.
• Configure Heartbeat Discovery.
• Describe collections.
• Configure and enable discovery methods.

Overview of Resource Discovery
Key Points
Once you install your central Configuration Manager 2007 site, you can begin
adding clients and resources by using one of the available discovery methods.
These discovery methods search your network to find resources that you can use
with Configuration Manager 2007. You must use at least one discovery method
before you can use most Configuration Manager functions.
Resources
Within Configuration Manager, a resource is an object that one of the available
Configuration Manager discovery methods discover. A resource can take a variety
of forms, including Active Directory objects (such as users, groups, and computers)
site systems, routers, hubs, printers, and other IP-addressable devices on your
network.

The following table outlines the three types of resources, each of which has a
number of attributes that describe the resource’s properties:
Resource type Description
User Group resources Includes discovered user groups, with distinct attributes such
as user group name, domain, creation date, and agent site.
System resources Includes discovered computers and IP-addressable resources,

with distinct attributes such as operating system name and
version, NetBIOS name, system role, and media access control
(MAC) address.
User resources Includes discovered users, with distinct attributes such as user
name, organizational unit, and domain.
Database Records
As Configuration Manager discovers resources, it creates records in the
Configuration Manager database. These records are called data discovery records
(DDRs) and each generated file has a DDR extension. The specific information
contained in each record varies depending on the resource Configuration Manager
discovered, but it can include data such as the NetBIOS name of a computer, IP
address and IP subnet of a computer or device, operating system, MAC address,
and so on.
The Discovery Data Loader loads the discovered data from the DDR file into the
database. Depending on the discovery method used, resource DDRs are
periodically regenerated to keep the discovery data updated and to verify that the
resource is still a valid resource within the Configuration Manager site.
Viewing the Discovery Data

Information about resources used within collections is available within the
Resource Properties dialog box. Available information includes discovery data,
advertisements to the given resource, and custom variables defined for the
resource.

Discovery Privacy Information
Discovery in Configuration Manager 2007 is a fairly low-risk activity. There are no

additional security recommendations for discovery, but you should be aware of the
type of data that discovery collects, and any potential privacy implications with that
data collection.
Discovery information is not sent back to Microsoft; rather, the site database stores
the data, and then deletes it from the database if it is not updated within the time
specified in the Delete Aged Discovery Data site maintenance task. The default time
period is 90 days.
Question: What are some examples of Configuration Manager resources?


Resource Discovery Methods
Key Points
Configuration Manager 2007 provides you with six configurable methods to
search for network resources. Each of these methods provides you with a different
view of your network, and results in a different set of discovered resources.
After a custom Configuration Manager setup, you can configure each discovery
method. The methods are disabled by default (with the exception of Heartbeat
Discovery) and you must enable them prior to use.
The following table provides information about each discovery method:
Discovery method Description

Network Discovery Searches the network for resources that meet a specific profile.
Network Discovery discovers resources that are:
• Listed in a router’s Address Resolution Protocol (ARP)
cache for a specified network subnet.
• Running a Simple Network Management Protocol
(SNMP) agent configured for a specified community.

Discovery method Description
• Configured as Dynamic Host Configuration Protocol

(DHCP) Server clients.
Active Directory Retrieves details about the computer, such as computer name,
System Discovery IP address, and Active Directory site.
Active Directory User Retrieves information about user accounts created in Active
Discovery Directory.
Active Directory Extends other discovery methods by retrieving details such as

System Group organizational unit, global groups, universal groups, and
Discovery nested groups. Active Directory System Group Discovery
cannot discover a computer that has not already been
discovered by another method, and only adds discovery
information to resources assigned to the local site or any
direct child secondary sites.
Active Directory Retrieves security groups created in AD DS.

Security Group
Discovery
Heartbeat Discovery Refreshes Configuration Manager client computer discovery

data in the site database. Unlike other methods, this method
works only on computers that already have Configuration
Manager installed.
This discovery method is important to the continued
maintenance of your site database, as it ensures that resource
records are current, and will not accidentally be aged out of
the Configuration Manager database.
Configuration Manager 2007 also creates database records for site server and site
system computers that are assigned a site system role. This discovery method is
automatic and not configurable.
Question: Which discovery method do you think would work best in your
environment and why?

Active Directory Discovery Methods
Key Points
You can configure Configuration Manager 2007 to query AD DS for information
about domain resources. The Active Directory discovery methods search for system
resources by polling the closest Active Directory domain controller. There are four
distinct Active Directory discovery methods:
• Active Directory System Discovery
• Active Directory User Discovery
• Active Directory System Group Discovery
• Active Directory Security Group Discovery
Note: Active Directory discovery polling can generate significant network traffic, so
you should schedule discovery to occur at times when network traffic will not
adversely affect business uses of your network.

The following table outlines considerations for enabling and configuring all Active
Directory discovery methods:
Guideline Description
Specify the Three options are available:

container search by • Local domain. Searches for Active Directory containers in
location the domain in which the computer hosting the
Configuration Manager console resides.
• Local namespace. Searches for Active Directory containers
in the forest in which the computer hosting the
Configuration Manager console resides.
• Custom LDAP or GC Query. Searches for Active Directory
containers using a Lightweight Directory Access Protocol
(LDAP) or a global catalog query.
Select additional Two options are available:

search parameters • Recursive. Specifies that the search includes child
containers. This check box is selected by default. If you
clear it, discovery does not search child containers.
• Include groups. Specifies that discovery consider objects
within groups. If you enable this option, you can discover
objects in other domains, but the likelihood of discovering
the same object more than once increases. If you clear this
check box, duplicate objects and objects in other domains
are less likely to be found. This results in a faster discovery
process. This check box is cleared by default.
Specify the polling By default, polling occurs once every 24 hours. Use the Polling
schedule Schedule tab to set a custom schedule, if desired.
Note: Allow enough time for the polling to complete. If the
polling occurs too frequently, it is possible discovery may never
complete.
Note: All Active Directory discovery methods return the objects as reflected in AD
DS when the discovery method last ran. Although the data is updated when the next
poll takes place, you should not consider this method dynamic.

Active Directory Permissions for Discovery
Configuration Manager 2007 must have Read rights to the containers that you
specify for Active Directory System Discovery, Active Directory System Group
Discovery, and Active Directory User Discovery. Configuration Manager uses the
site server computer account to perform Active Directory discovery. When you use
the site server computer account in domains other than the domain in which the
site server is located, the account must have user rights on those domains. The
account must at least be a member of the Domain Users group or local Users
group on the domains.
Additionally, you must have Modify permissions on the site security object or
instance to configure the Active Directory System Discovery method.
How Active Directory System Discovery Discovers Systems

Active Directory System Discovery uses two pieces of information to determine
whether a computer is a member of a network:
1. The computer's account in AD DS
2. Successful IP address name resolution through DNS
If Active Directory System Discovery can obtain both pieces of information, the
computers are discovered, and a DDR is created for each computer.
If nonexistent computers are not removed from AD DS and their records remain in
DNS, Configuration Manager will continue discovering them. Prevent this behavior
by enabling DNS scavenging on your DNS server, and by removing unused objects
from AD DS.
Note: Active Directory System Discovery will not discover disabled systems.
Question: What is required to generate a DDR for a system discovered with Active
Directory System Discovery?

Network Discovery Options
Key Points
Network Discovery allows Configuration Manager 2007 to perform a broad search
of your network by checking the DHCP leases, looking at routers’ ARP caches, or
looking for SNMP-enabled devices in a community. Network Discovery also is
likely to find resources—such as printers—that are incapable of becoming
Configuration Manager clients.
Note: The more subnets and domains that Configuration Manager discovers, the
more network traffic is generated. To mitigate the network impact, schedule several
small discoveries instead of a single large one. Such small discoveries would run
serially, and you would need to change the scope of your Network Discovery each
time.

Network Discovery provides an extensive list of attributes as part of the discovery
record, including:
• NetBIOS name
• IP addresses
• Resource domain
• System roles
• SNMP community name
• MAC addresses
Configuring Network Discovery

To configure Network Discovery effectively, you must know your network’s
general topology. You can use the Network Discovery method to determine the
topology before you use it to discover resources.
You can specify the discovery scope and enable and configure a combination of
discovery options by using the Subnets, Domains, SNMP, SNMP Devices, DHCP,
and Schedule tabs in the Network Discovery Properties dialog box.
The following options are available for selecting a discovery type:
Network Discovery
method Description
Topology Determines the topology of your network only: IP subnets
and routers. The extent of how much of your network is
discovered depends on the number of router hops
selected on the SNMP tab. By default, this option is
selected.
Topology and client Determines the topology of your network, as well as

potential client computers using an IP address. If you
specify a DHCP server on the DHCP tab, potential clients
leasing an IP address from that DHCP server are included
here.
If you have a large network, you might want to limit the
number of router hops searched to reduce your network
traffic. A maximum of 5,000 potential clients per
discovery is recommended.

Network Discovery
method Description
Topology, client, and Determines the topology of your network, as well as
client operating systems potential client computers and their operating systems
and versions.
Question: When using Network Discovery, what additional service should you
install and configure so that you can retrieve the client’s operating system
information?

Guidelines for Configuring Heartbeat Discovery
Key Points
The Heartbeat Discovery method is the only configurable discovery method that is
enabled automatically when you install Configuration Manager. This is because
Heartbeat Discovery maintains updated DDRs in the Configuration Manager
database.
Heartbeat Discovery helps you maintain your site database. It ensures that resource
records are current, and are not aged out of the Configuration Manager database
accidently. This method is useful for maintaining up-to-date discovery data on
clients that are not normally affected by one of the other discovery methods. By
default, Heartbeat Discovery generates an updated DDR for each client every seven
days.

Note: Heartbeat Discovery is active only on computers that have already been
installed as Configuration Manager clients.
Question: Why should you not disable Heartbeat Discovery?


What Are Collections?
Key Points
Creating and using collections is a fundamental aspect of Configuration Manager.
Within Configuration Manager, collections represent groups of resources that can
consist not only of computers, but also of Windows users and user groups as well
as other discovered resources.
Collections allow you to organize resources into easily manageable units, enabling
you to create an organized structure that logically represents the kinds of tasks that
you want to perform. Collections also serve as targets for performing Configuration
Manager operations on multiple resources at one time (such as software
distribution or software updates).
In the Configuration Manager console, the Collections node contains the
collections that are defined for the current site. The results pane displays the
resources gathered within the selected collection.
Question: What data can you use to create a collection?


Demonstration: Configuring Discovery Methods
Key Points
In this demonstration, you will review how to configure and use various discovery
methods.
Demonstration Steps
Configure Network Discovery

2. Expand the Configuration Manager nodes through Site Settings, and then
click on Discovery Methods.
3. Enable Network Discovery with the following settings:
• Topology, client, and client operating system
• Search local subnets
• search local domain
• 5 minutes from the current time

Configure and run Active Directory System Discovery
• Configure Active Directory System Discovery with the following settings:

• Enable Active Directory System Discovery starting at the root of the local
domain
• Create a new Attribute name for discovery to return: comment
• Non-recurring schedule
• Run discovery as soon as possible
Examine the discovered resources

1. View the discovery information of one of the existing systems.
2. On the General tab, scroll down and review the following:
• AD Site Name
• The Agent Name entries
• The Comment entry. Note that this field was not populated in AD DS for
NYC-CL1.
3. View the discovery information for the Configuration Manager server.
• The Agent Name entries.
• The Comment entry. Note that this field contains the information we
entered.
• Note all the system roles listed.
Configure and run Active Directory System Group Discovery

• Configure Active Directory System Group Discovery with the following
settings:
• Enable Active Directory System Group Discovery starting at the root of the
local domain.
• Non-recurring schedule.
• Run discovery as soon as possible

Re-examine the discovered resources
1. View the Discovery information of one of the existing systems.

• The Agent Name entries.
• System Container Name [0].
• System Group Name [0].
Question: What is the purpose of the Recursive and Include groups search
options?
Question: Why does the Configuration Manager site system’s DDR show one
additional Agent Name entry when compared to nonsite systems?

Lab C: Managing Users and Configuring
Boundaries and Discovery Methods
Lab Setup
domain.

3. If required, connect to the virtual machines. Log on to the servers as
Contoso\Administrator, using the password Pa$$w0rd. Do not log on to the

client computer until instructed.
Lab Scenario

Exercise 1: Managing Configuration Manager Users
Scenario
You are a firm believer in the principal of using least-privileged accounts for day-to-
day operations. To accommodate the tasks of managing Configuration Manager
2007, you have decided to create some groups and assign the appropriate
permissions to the Configuration Manager site server.
1. Create and populate groups.
2. Create Active Directory sites.
3. Clone an existing user using the ConfigMgr User Wizard.
4. Create a new user using the ConfigMgr User Wizard.
5. Configure DCOM.
6. Configure permissions on the Microsoft Configuration Manager folder.
7. Add SCCM_Full_Admin to the Administrators group.
Task 1: Create and populate groups

1. If necessary, log on to NYC-DC1 as Contoso\Administrator with a password
of Pa$$w0rd.
2. Open Active Directory Users and Computers.
3. In the IT OU, create the following security groups:
• SCCM_Full_Admin
• SCCM_Dist_Software
4. Add Ed Meadows to the SCCM_Full_Admin group.
5. Add Andrea Dunker to the SCCM_Dist_Software group.

Task 2: Clone an existing user using the ConfigMgr User Wizard
1. Connect to the NYC-CFG1 computer, and then start the Configuration

Manager console.
2. Use the ConfigMgr User Wizard to grant the SCCM_Full_Admin group the
following permissions:
• Copy rights from an existing ConfigMgr user or user group
• Contoso\Administrator
Task 3: Create a new user using the ConfigMgr User Wizard

1. Use the ConfigMgr User Wizard to grant the SCCM_Dist_Software group the
• Class: Collection
• Instance: All Windows Workstation or Professional Systems
• Permissions: Advertise
2. Use the ConfigMgr User Wizard to grant the SCCM_Dist_Software group the
• Class: Package
• Instance: (All Instances)
Task 4: Configure DCOM

1. On NYC-CFG1, run Dcomcnfg.exe.
2. Navigate to My Computer, and then open the Properties dialog box.
3. On the COM Security tab, in the Launch and Activation Permissions section,
click Edit Limits.
4. Grant the local SMS Admins group Allow Remote Activation permissions.

Task 5: Configure permissions on the Microsoft Configuration
Manager folder
1. Grant the SMS Admins group Read permissions to the C:\Microsoft
Configuration Manager folder.
2. Grant the SMS Admins group Read permissions to the SMS-NYC share.
Task 6: Add SCCM_Full_Admin to the Administrators group

1. On NYC-CFG1, add the SCCM_Full_Admin group to the local Administrators
group on NYC-CFG1.
2. Log off of NYC-CFG1.
Results: After this exercise, you should have configured Active Directory groups for
use with Configuration Manager 2007, and configured security for Configuration
Manager 2007.

Exercise 2: Configuring Boundaries
Scenario
You have decided to use IP address ranges for the Configuration Manager site
boundaries. You plan to locate the central site at the Contoso, Ltd headquarters in
New York. Additionally, you will deploy an additional site in the Atlanta office after
you have installed, configured, and tested the New York site.
The main task for this exercise is as follows:
• Create a Configuration Manager site boundary
Task: Create a Configuration Manager site boundary

1. Log on to NYC-CL1 as Ed with a password of Pa$$w0rd.
2. Open the Configuration Manager console, and then create a site boundary
with the following information:
Results: After this exercise, you should have configured a Configuration Manager
site boundary.

Exercise 3: Enabling and Configuring Discovery Methods
Scenario
All of the computer systems in Contoso, Ltd are members of the Contoso domain.
You do not need to include devices such as printers and routers in your
Configuration Manager database. Given this, you have decided to implement
Active Directory System Discovery as your discovery method. Additionally, you use
System groups for organizing the departmental computers in AD DS, so you will
also implement Active Directory System Discovery.
1. Configure and run Active Directory System Discovery.
2. Configure and run Active Directory System Group Discovery.
3. Verify that discovery completed.
Task 1: Configure and run Active Directory System Discovery

1. Configure Active Directory System Discovery to search the local domain.
2. Set the recurrence pattern to None.
3. Configure discovery to run as soon as possible.
Task 2: Configure and run Active Directory System Group Discovery

1. Configure Active Directory System Group Discovery to search the local
domain.
2. Configure discovery to run as soon as possible.
Task 3: Verify that discovery completed

1. Open the All Systems collection.
2. Update and refresh the collection membership.
3. Review the discovery information on NYC-CL1.
Results: After this exercise, you should have configured and run Configuration
Manager 2007 discovery.

Lesson 6
Monitoring and Troubleshooting Tools in

Configuration Manager 2007 has several troubleshooting tools that you can use to
help solve issues that might arise. Some troubleshooting tools are built into the
product, while you must install others.
• Describe the Configuration Manager 2007 log files.
• View log files with Trace32.
• Describe the ConfigMgr Service Manager.
• Monitor system status.
• Configure status messages.

Configuration Manager 2007 Log Files
Key Points
All the client and site server components in Configuration Manager 2007 record
process information in individual log files. You can use the information in the
client and site server log files to help you troubleshoot issues that might occur in
your Configuration Manager hierarchy.
By default, client and server component logging is enabled in Configuration
Manager 2007.
Client Log Files

Each of the Configuration Manager client processes and agents write detailed log
files to a folder on the client system. The Configuration Manager client logs are
located in one of the following locations:
• On computers that serve as management points:
%ProgramFiles%\SMS_CCM\Logs
• On all other computers: %Windir%\System32\CCM\Logs or
%Windir%\SysWOW64\CCM\Logs

Site Server Log Files
Most Configuration Manager site server log files are located in the
<InstallationPath>\LOGS folder. By default, most Configuration Manager log files
have a maximum size of 2 MB. Once a log file reaches that size, Configuration
Manager renames the current log file with an lo_ extension, and creates a new log
file.
Because Configuration Manager relies heavily on IIS, you can review the IIS log file
for additional errors that relate to client access to the IIS server. The IIS log file is
located in the %Windir%\System32\logfiles\W3SVC1 folder on the IIS server.
Log Files for Discovery-Related Processes

There are many log files related to server processes. As you learn about the
different features and processes, we will also discuss the related log files. The log
files associated with Discovery and Collection Evaluation, as discussed in the
previous lesson, are described in the following table.
Log file name Description
ddm.log Saves DDR information written to the Configuration Manager

database by the Discovery Data Manager.
adsysdis.log Saves discovery information generated during the Active Directory

System Discovery process.
adsysgrp.log Saves discovery information generated during the Active Directory

System Group Discovery process.
adsgdis.log.log Saves discovery information generated during the Active Directory

Security Group Discovery process.
adusrdis.log Saves discovery information generated during the Active Directory

User Discovery process.
netdisc.log Saves discovery information generated during the Network

Discovery process.
CollEval.log Records when collections are created, changed, and deleted by the
Collection Evaluator.

Question: When troubleshooting a discovery issue in which some groups

associated with computer systems are not being discovered, which log file would
you review?

Viewing Log Files with Trace32
Key Points
The Trace32.exe utility, or SMS Trace, is an add-on tool that you can find in the
downloadable Configuration Manager 2007 Toolkit 4.0. SMS Trace allows you to
view and monitor log files, including:
• Log files in SMS or Client Configuration Manager (CCM) format
• Plain ASCII or Unicode text files, such as Windows Installer logs
SMS Trace also simplifies the process of analyzing log files because of its
highlighting, filtering, and error-lookup features.
Question: How would you find every line in a log file that listed a specific system?

The ConfigMgr Service Manager
Key Points
Use the ConfigMgr Service Manager to control Configuration Manager services. In
ConfigMgr Service Manager, you can view the status of Configuration Manager
components that are running on any site system. Manage components the same
way you manage services in Windows Server Services. That is, you can start, stop,
pause, resume, or query the components.
Not all components run continuously. In general, components run as soon as there
is something for them to do, which is typically when a configuration file is written
to a component's inbox.
Configuration Manager Components

Components consist of threads, services, and applications that run on both server
and client computers, and provide Configuration Manager functionality. Thread
and service components perform tasks such as communication for intersite and
intrasite connectivity, configuration, resource discovery, client installation, site
maintenance, status, site system installation, and reporting.

Thread components are Configuration Manager server components that function
as part of the SMS Executive service. They are not services.

Service components are Configuration Manager server programs that run as
services. You can stop or start service components in Control Panel by clicking
Administrative Tools, and then clicking Services.
The number of active service components on each server depends on which
Configuration Manager features you install.
Client components process Configuration Manager client operations. SMS Client
Service—which you can start and stop through Control Panel—is the main client
service component. Several other client components—such as the Software
Inventory Agent—run as their own processes.
ConfigMgr Service Manager Actions

The ConfigMgr Service Manager allows you to manage individual components or
multiple components. From the Components menu, ConfigMgr Service Manager
can perform the following actions:
• Query. Updates the status of any selected components.
• Start. Runs a stopped component. Stopping and restarting a component clears
the log files and other files so that you can start a new query.
• Pause. Pauses a running component. Pausing preserves the component's run-
time environment. You can pause a component, observe system behavioral
changes, or copy transaction or log files, and then continue running the
component. Not all components can be paused, however.
• Resume. Resumes a paused component.
• Stop. Stops a running component. Stopping a component shuts down its run-
time environment. To preserve a component's run-time environment, use
Pause.
• Logging. Allows you to configure logging. You can configure the name and
location for the log file, as well as the maximum size of the file.

Monitoring System Status
Key Points
Configuration Manager 2007 status messages report information about
Configuration Manager component behavior and data flow. Configuration
Manager status messages are categorized by severity and type.
Configuration Manager provides a number of tools to help you manage the large
numbers of status messages that might be generated on a typical site, including:
• Queries. Perform searches on all status messages stored in the site database.
• Status filter rules. Initiate actions when a specified status message is generated,
such as reporting to the Windows Event Log.
• Filters. Limit the results shown in the ConfigMgr Status Message Viewer.

System Status Node
The System Status node is the parent container for all the system status messages.
On the System Status node, you can configure Class security rights for status
messages. The System Status node contains the following status messages groups:
• Site Status
• Advertisement Status
• Package Status
• Status Message Queries
Note: The Advertisement Status, Package Status, and Status Message Queries nodes
will be discussed in upcoming modules.
Site Status Node

The Site Status node displays a status summarizer for each site in the hierarchy.
When you click the Site Status node for the Configuration Manager console, you
can view more detailed status information about the current Configuration
Manager site and any other sites in the Configuration Manager hierarchy.
When viewing the Site Status Home page, you have the option to adjust the display
interval, either from the Actions pane or a context menu. Setting the display
interval allows you to filter the displayed message counts by date and time.
Component Status Node

The Component Status node displays a status summarizer for all of the
Configuration Manager components. When you click the Component Status node
of the Configuration Manager console, you can view a more detailed status of each
component in the Configuration Manager site on the Component Status Home
page.
Site System Status Node

The Site System Status node displays a status summarizer for all of the
Configuration Manager site servers. When you click the Site System Status node of
the Configuration Manager console, you can view a more detailed status of each
site server in the Configuration Manager site.

ConfigMgr Status Message Viewer
Right-clicking on most status objects enables you to choose one of the Show
Messages options. The ConfigMgr Status Message Viewer displays the messages,
and is the primary tool for viewing status messages stored in a Configuration
Manager site database.
Question: If the System Status node shows a critical status, what is the next step?

Configuring Status Messages
Key Points
All major Configuration Manager 2007 components generate status messages. You
do not have to configure the Configuration Manager status system; its default
settings are reasonable for most environments. However, you can configure three
aspects of the Configuration Manager status system:
• Status reporting
• Status filter rules
• Status summarizers
Status Reporting
You can specify that status messages be reported to the status system, to the event
log, or to both. You can configure where status messages are reported to and
stored, for both the server and the client.

Status Filter Rules

Status filter rules allow you to automatically process status messages when they
arrive at a site from child sites. You can have an unlimited number of filter rules.
Each one specifies certain message criteria, such as the component that generated
the message, its severity, and its properties. Each message passes through the site's
status message filter until it matches all criteria in a filter rule. If you want specific
actions to occur when fewer criteria are met, create multiple filter rules, each with a
single criterion. Messages then need only match one of the criteria.
When a status message matches a filter rule, Configuration Manager performs the
actions specified for that filter rule, such as running a program, writing the
message to the Configuration Manager site database, or replicating the message to
the parent site.
Status filter rules are evaluated in the order in which they are listed, from top to
bottom, in the results pane of Status Filter Rules. However, a possible status filter
rule action is “Do not process lower-priority status filter rules.” In this case, when a
status message matches that filter rule, no other lower-priority filter rules are
evaluated.
Status filter rules are located in the Site Settings/Status Filter Rules container.
You need to configure two status filter rule components. The General page, which
specifies the message matching criteria, and the Actions page, which specifies the
actions to take when a status message matches the criteria.
In the New Status Filter Rule Wizard, you can give each status filter rule a unique
name. You cannot change this name after the wizard completes the task.
Use the General tab of the Status Filter Rules Properties dialog box (or the
General page of the New Status Filter Rule Wizard) to specify a status message
filter rule on which to take an action. For a status message to match a filter rule, all
selected criteria must match the status message. For example, if Site Code and
Severity are both selected, only messages that match both criteria will match the
filter rule. You can select the values for each criteria from the appropriate lists.
Use the Actions tab of the Status Filter Rules Properties dialog box (or the
Actions page of the New Status Filter Rule Wizard) to specify the actions to take
when a status message matches the criteria specified in the General tab.

Status Summarizers
Status summarizers provide a high-level, real-time view of the health of the

following four Configuration Manager 2007 features and subsystems, so that you
can quickly identify and resolve problems:
• Components
• Site systems
• Advertisements
• Packages
There is one Component Status summarizer, and one Site System Status
summarizer per site, but only one Advertisement Status summarizer and one
Package Status summarizer per site database, and they cover all the sites in that site
database.
The Status Summarizers are located in the Site Settings/Status Summary container.
Component Status and Advertisement Status Summarizers

These summarizers count the different types of messages generated by
components and advertisements. If too many messages of a certain type occur
within a specific time period, a status message threshold is crossed, and the status
summarizer indicator changes. For example, you can specify that if any component
generates more than five messages a day, its status becomes Warning, and if it
generates more than ten messages a day, its status becomes Critical.
Site System Status and Package Status Summarizers

These summarizers track state changes instead of counting error messages. For
example, the Site System Status summarizer reacts to changes in free disk space on
site systems. If the free space falls below the threshold you set, the Site System
Status summarizer's status indicator changes. The Package Status Summarizer
tracks changes such as how many clients have installed each package.
All the summarizers except Site System Status are event driven—they respond in
real time to changes taking place in Configuration Manager. Only the Site System
Status summarizer polls for its information according to a schedule you can set.
Question: If you wanted to be notified immediately when certain conditions arise

in your Configuration Manager environment, how would you accomplish this?

Lab D: Monitoring and Troubleshooting
Lab Setup
Hyper-V Manager.
domain.
3. If required, connect to the virtual machines. Log on to NYC-DC1 and NYC-
CFG1 as Contoso\Administrator, using the password Pa$$w0rd.

Lab Scenario
You are the network administrator for Contoso,Ltd. Contoso has begun a new

Exercise 1: Using the ConfigMgr Service Manager
Scenario
You have decided that you would like to generate a single log file whenever Active
Directory System Discovery is run. You are concerned that the default log file size
may be too small for your environment, and have decided to increase the size of
the log file.
1. Configure SMS_AD_System_Discovery_Agent logging.
2. Check component status.
3. Start SMS_AD_System_Discovery_Agent.
Task 1: Configure SMS_AD_System_Discovery_Agent logging

1. On NYC-CL1, ensure that the Configuration Manager console is open.
2. Start the ConfigMgr Service Manager from the Configuration Manager
console.
2. Under Components, expand the tree console until you expand NYC-CFG1
under the SMS_AD_System_Discovery_Agent component.
3. Right-click SMS_AD_System_Discovery_Agent.
Question: What options are available?
4. Configure logging for the SMS_AD_System_Discovery_Agent as follows:

• Log file size: 4 MB
Task 2: Check component status

1. Under Servers, click NYC-CFG1.
2. Select and query all of the components.
Question: Which components are not running?

3. Stop a running component, such as the SMS Collection Evaluator.
Question: Did the status of that component change?
4. Query the component.

Question: Did the status change?
5. Right-click the component, and then select Start.
Task 3: Start SMS_AD_System_Discovery_Agent

1. Select SMS_AD_System_Discovery_Agent.
2. Record the time, right-click SMS_AD_System_Discovery_Agent, and then
select Start.
3. Close the ConfigMgr Service Manager.
Results: After this exercise, you should have reconfigured the

SMS_AD_SYSTEM_DISCOVERY_AGENT log file and used the ConfigMgr Service
Manager to manage Configuration Manager components.

Exercise 2: Reviewing Log Files with Trace32
Scenario
Having increased the size of the log file for Active Directory System Discovery, you
must now review the adsysdis.log file for errors.
1. Use the Highlight tool to review a log file.
2. Use the Filter tool to review a log file.
Task 1: Use the Highlight tool to review a log file

1. Start Trace32 from the Configuration Manager 2007 Toolkit.
2. Open the adsysdis.log files on NYC-CFG1.
3. Configure the Highlight tool to highlight the word Starting.
4. Scroll through the log file.
Question: How many times did the service thread start?
Question: Did discovery run when you manually started the

SMS_AD_SYSTEM_DISCOVERY_AGENT? (Hint: Look for the line Starting the
Data Discovery.)
5. Run discovery for the Active Directory System Discovery Agent.

6. Monitor the adsysdis.log in Trace32. Wait a moment for the new lines to
appear.
Question: When you set the polling schedule to run as soon as possible, did
discovery run this time?
7. Configure the Highlight tool to highlight the words INFO: DDR.


Question: How many systems were discovered each time the discovery agent
ran?
9. Configure the Highlight tool to highlight the word ERROR.

Question: How many errors are there?
Question: What caused the error?
Task 2: Use the Filter tool to review a log file

1. Configure the Filter tool to filter when the entry text contains the word
STATMSG.
Question: How many status messages were written?
2. Read the info pane for STATMSG: ID=5203.

Question: What information do you see in the status message?
3. Record the time that status message was generated, as shown in the info pane.
4. Clear the filters.
Results: After this exercise, you should have used the Trace32 Highlighting and
Filtering tools to assist in analyzing a log file.

Exercise 3: Reviewing Discovery Status Messages
Scenario
You have decided that the log files contain many details that you may not need to
review on a daily basis. You want to examine the Active Directory System
Discovery status messages for the information that can be found in them.
• Review the SMS_AD_SYSTEM_DISCOVERY_AGENT status messages.
Task: Review the SMS_AD_SYSTEM_DISCOVERY_AGENT status

messages
1. Under Component Status, right-click
SMS_AD_SYSTEM_DISCOVERY_AGENT, point to Show Messages, and then
click ALL.
2. Find the 5203 Status message that matches the time you recorded in the
previous exercise.
3. Read the 5203 Status message.
Question: How many possible causes and possible solutions are listed?
4. Close the Status Message Details window, and the ConfigMgr Status Message
Viewer for <NYC> <Central Site - New York City>.
Results: After this exercise, you should have reviewed the status messages
generated from the error that was previously logged.

Exercise 4: Configuring Status Messages
Scenario
You have decided that you would like the security team to be notified when Active
Directory System Discovery generates an error caused by a bad computer account
in AD DS, so that the team can take appropriate action. Adding an event log entry
for these status messages will be sufficient since the security team reviews all event
log warnings and errors. Additionally, you would like to designate the number of
issues that the Active Directory System Discover agent logs before the site is placed
in a Warning state.
1. Configure a status filter rule.
2. Configure a status summary threshold.
3. Run Active Directory System Discovery.
4. Verify that the status filter rule was applied.
5. Verify that the site status has changed.
Task 1: Configure a status filter rule

1. In the Configuration Manager console, select the Status Filter Rules node.
2. Create a new status filter rule with the following general information:
• Name: Bad Computers in Active Directory
• Component: SMS_AD_SYSTEM_DISCOVERY_AGENT
• Message ID: 5203
3. Use the following Action:
• Report to the event log
4. Increment the priority of the rule until it reaches the top.

Task 2: Configure a status summary threshold
1. In the Configuration Manager console, click the Status Summary node.

2. Modify the thresholds for the warning messages in the component status
summarizer for the SMS_AD_SYSTEM_DISCOVERY_AGENT.
3. Set the warning threshold to 3.
Task 3: Run Active Directory System Discovery

1. Run discovery for the Active Directory System Discovery Agent.
2. Monitor the adsysdis.log in Trace32. Wait a moment for the new lines to
appear.
Task 4: Verify that the status filter rule was applied

1. Open the Event Viewer and connect to NYC-CFG1.
2. Review the Application log.
Question: Is there a Warning entry with Source SMS Server and Event ID
5203?
Question: Is there an Information entry with source SMS Server and Event ID
4610?
Question: What does the 4610 Event show?
3. Close the Event Viewer
Task 5: Verify that the site status has changed

1. Refresh the system status in the Configuration Manager console.
Question: What does the site status indicator show?
2. Expand Site Status, expand NYC - Central Site - New York City, and then
click Component Status.

3. Right-click SMS_AD_SYSTEM_DISCOVERY_AGENT, point to Reset Counts,
and then click Warnings.
Note: This will clear the Warning status. However, it will take a few minutes to show
the change.
Results: After this exercise, you should have configured and tested a status filter rule
and a status summary threshold.
To prepare for the next module

When you finish the lab, revert the virtual machines back to their initial state. To
do this, complete the following steps:
1. On the host computer, start Hyper-V Manager.
2. Right-click the virtual machine name in the Virtual Machines list, and then
click Revert.
3. In the Revert Virtual Machine dialog box, click Revert.
4. In the Virtual Machines pane, click 6451B-NYC-DC1-B, and then in the
Actions pane, click Start.
5. To connect to the virtual machine for the next module’s lab, click 6451B-NYC-
DC1-B, and then in the Actions pane, click Connect.
6. Wait for NYC-DC1 to start, and then start 6451B-NYC-CFG1-B. Connect to

the virtual machine.
7. Wait for NYC-CFG1 to start, and then start 6451B-NYC-CL1-B. Connect to the
virtual machine.

Review Questions
1. When planning a Configuration Manager 2007 deployment, what are some of
the major decision points that you need to address?
2. Why would you extend the Active Directory schema for Configuration
Manager 2007?
3. What is the difference between status messages and log files?


Common Issues Related to Discovery
Identify the causes for the following common issues related to discovery, and fill in
the troubleshooting tips. For answers, refer to relevant lessons in the module.
Issue Troubleshooting tip

Network Discovery does not Verify that the discovery duration is long enough.
return any results Verify that the agent can resolve the subnet mask
for the resources.
Active Directory discovery Verify that the site system has user access to any
methods return incomplete containers or OUs in question.
results Verify that the discovery method is configured to
search the appropriate locations.
Nonexistent systems are being Verify that removed systems are purged from AD DS
discovered with Active and DNS
Directory System Discovery

1. The IT department for a manufacturing company wants to implement
Configuration Manager 2007 to manage their client systems. Their needs
include keeping their systems secure from external threats, deploying
software, and keeping software up-to-date. What Configuration Manager
systems would you propose they deploy?
2. The Security Department is reluctant to approve the extension of the Active

Directory schema. How would you convince them that extending the Active
Directory schema would be the best way to move forward with Configuration
Manager 2007?
Best Practices Related to Discovery

Supplement or modify the following best practices for your own work situations:
• When using Network Discovery, limit the number of router hops.
• Schedule discovery methods during times of low network usage.
• Limit the scope of an Active Directory discovery.

Tools
Tool Use for Where to find it

SMS Trace • Reading log files http://www.microsoft.com/downloads
/details.aspx?FamilyID=948e477e-fd3b-4a09-
9015-141683c7ad5f&DisplayLang=en
Planning for and Completing Client Deployment 3-1

Module 3
Planning for and Completing Client Deployment
Contents:
Lesson 1: Client Deployment Methods 3-3
Lesson 2: Deploying Clients 3-31
Lab A: Deploying Configuration Manager 2007 Clients 3-45
Lesson 3: Managing Configuration Manager 2007 Clients 3-51
Lesson 4: Using Configuration Manager Reporting with Client Installation 3-64
Lab B: Verifying Client Deployment 3-71

Module Overview
To successfully deploy Microsoft® System Center Configuration Manager 2007

clients, you must understand the installation process, deployment methods, and
configuration options. In this module, you will learn the site system roles necessary
for client deployment. You also will learn about different System Center
Configuration Manager client deployment methods, and how to verify a successful
deployment.
• Determine the most appropriate client deployment method.
• Deploy Configuration Manager 2007 clients.
• Manage and verify Configuration Manager 2007 client deployment.
• Use Configuration Manager reporting to monitor client deployment.

Lesson 1
Client Deployment Methods
Configuration Manager 2007 supports a variety of methods that you can use to
deploy Configuration Manager client components to network resources. To
successfully deploy the client components, you should understand the files that
are used during the installation process. It is also important to understand the
methods that are available for client deployment and their related prerequisites, so
that you can choose the most appropriate method to meet your organizational
requirements.
• Describe the client installation process.
• Identify the Configuration Manager client deployment methods.
• Describe the role that Active Directory® Domain Services (AD DS) plays in the
client deployment process.
• Identify the site systems used for client deployment.

• Prepare for a client push installation.
• Prepare for a software update point installation.

• Prepare for a Group Policy installation.
• Describe additional client installation methods.

The Client Installation Process
Key Points
To manage a network device using Configuration Manager, the device must
become a client by installing the Configuration Manager client components.
Installing the Configuration Manager client involves the following executables that
run during client setup:
• CCMSetup.exe.
• Client.msi.
• CCMSetup.msi.
Note: To manage a device, it must be assigned to a site. Site assignment takes place
after you have installed the client. A client can automatically be assigned to a site if
it is within the boundaries defined for the Configuration Manager site. If you install
clients that are outside of the site boundaries, these clients must be manually
assigned to the site by specifying the site code. More information about site
assignment is provided later in this module.

CCMSetup.exe
Configuration Manager uses CCMSetup.exe to begin the client installation process.

This executable performs the following actions:
• Determines the location from which to download client prerequisites and
installation files. If you have extended the Active Directory schema for
Configuration Manager, most of the client installation properties are published
in AD DS, and the setup process reads the properties automatically to find an
appropriate management point. If you have not extended the Active Directory
schema, CCMSetup searches Windows Internet Naming Service (WINS) for a
management point, or uses a server locator point to discover a management
point to contact. You can also specify a specific management point by
providing the /mp:<ComputerName> property.
• Downloads the client prerequisite files. Files may include the Client.msi file,
Background Intelligent Transfer Service (BITS) installation files, Windows
Installer installation files, and updates for the Configuration Manger client.
• Invokes the startup of the Client.msi file. The Client.msi file installs the
Configuration Manager components on the client.
Client.msi
After Configuration Manager installs the required prerequisites on the intended
client, CCMSetup downloads and runs Client.msi. This Windows Installer file
installs the client on the device.
You can modify the Client.msi installation behavior by providing specific
properties on the CCMSetup.exe command line—or if using the client push
installation method—by specifying the properties on the Client tab of the Client
Push Installation Properties dialog box.
Note: The student companion content provides a full list of properties that you can
use with the Client.msi file.

CCMSetup.msi
Configuration Manager uses this Windows Installer file to publish or assign the
Configuration Manager client to computers using AD DS Group Policy. This file is
located in the <installation directory>\bin\i386 folder on the Configuration
Manager site server. You cannot add properties to this file to modify installation
behavior. You can incorporate properties by extending the Active Directory
schema, or by using the ConfigMgr2007Installation.adm Group Policy template,
which is provided on the Configuration Manager 2007 installation media.
Question: Which executable determines the location of the source files and
downloads them to begin the Configuration Manager client installation process?

Overview of Client Deployment Methods
Key Points
To efficiently deploy the Configuration Manager client components to potential
resources, you need to decide which deployment method to use. You should
consider the details of each installation method, and decide which is best for your
environment.
The client deployment methods are:
• Client push installation. Pushes Configuration Manager client software to
discovered computers that are within the boundaries configured for the site.
This is useful when you want the Configuration Manager client installed as it is
discovered.
• Software update point installation. Allows you to publish the Configuration
Manager client software as a software update to a software update point. This
is useful if Windows Server Update Services (WSUS) is already in use in the
environment.
• Group Policy installation. Uses Group Policy to publish or assign the
Configuration Manager client to computers.

• Manual installation. Manually installs the Configuration Manager client
software on computers by using CCMSetup.exe. Use this method when there

are a small number of workstations that need the client installed.
• Logon script installation. Uses CCMSetup.exe in a logon script to trigger the
client installation. This method ensures that the Configuration Manager client
is installed on all computers that the user has local administrator permissions
to.
• Upgrade installation (software distribution). Allows you to upgrade existing
client software on computers.
• Computer imaging. Allows you to preinstall the Configuration Manager client
software on a master image computer that will be used to build your
enterprise’s computers.
The following table outlines the advantages and disadvantages for the various
client deployment methods.
Client
deployment
method Advantages Disadvantages
Client push • You can use this method to • Can cause high network traffic
installation push to a single computer, a when pushing to large collections.
collection, or to the results • You can use this only on
from a query. computers that Configuration
• You can use it to install the Manager has discovered.
client automatically on • You must specify a Client Push
discovered computers. Installation account, which has
• Uses client-installation administrative rights to the
properties defined on the intended client computer. If you
Client tab of the Client Push do not configure an account,
Installation Properties Configuration Manager will try to
dialog box. use the site system computer
account, which also must have
administrative rights on the target
client.
• You must configure the Windows
firewall on client computers and
all firewalls between the clients
and site server with exceptions to
allow client push installation to
complete.

Client
deployment
Software • Uses your existing software • If the Active Directory schema is
update point updates infrastructure to not extended for Configuration
installation manage the client software. Manager, or the site is not
• Will install the client software published to AD DS, you must use
automatically on new a Group Policy to add client
computers if WSUS is installation properties to your
configured correctly. site’s computers.
• Does not require computers • Can cause high network traffic.
to be discovered before you
can install the client.
• If the Active Directory
schema has been extended,
computers can read
installation properties in AD
DS.
• Will reinstall the client
software if it is removed.
Group Policy • Does not require you to • Can cause high network traffic if
installation discover computers before you are installing a large number
you can install the client. of clients.
• You can use this for new • If the Active Directory schema is
client installations or for not extended for Configuration
upgrades. Manager, or the site is not
• If the Active Directory published to AD DS, you must use
schema has been extended, Group Policy to add client-
computers can read installation properties to
installation properties computers in your site.
published to AD DS.
Manual • Does not require computers • No automation, therefore time-

installation to be discovered before the consuming.
client can be installed. • Only works for local users who are
• Can be useful for testing local admins.
purposes.
• Supports using command-
line properties for CCMSetup.

Client
deployment
Logon script • Does not require computers • Can cause high network traffic if
installation to be discovered before the you are installing a large number
client can be installed. of clients.
• Supports using command- • Requires that the user who is
line properties for CCMSetup. logged on is a local admin for the
computer.
Upgrade • Can leverage the • Can cause high network traffic

installation Configuration Manager when distributing the client to
(software features to upgrade clients large collections.
distribution) organized by collections at a • You can use this only to upgrade
defined time. the client software on computers
• Supports using command- that have been discovered,
line properties for CCMSetup. assigned to the site, and are
existing Microsoft Systems
Management Server (SMS) 2003
or Configuration Manager clients.
Computer • Configuration Manager may • Requires specific infrastructure

imaging. be pre-installed in the image considerations for storing and
and does not require a deploying the computer images.
separate deployment task.
Communication to the
Configuration Manager site
can begin almost
immediately after the image
is deployed.
Question: Which client deployment method will you use for your organization?
Why?

The Role of Active Directory Domain Services in the Client
Deployment Process
Key Points
During the design phase of your Configuration Manager 2007 deployment, one of
the decision points will be whether or not to extend the Active Directory schema.
Extending the Active Directory schema allows you to publish information related
to a number of Configuration Manager features, such as:
• Client installation and site assignment
• Site mode settings
• Port configuration for client-to-server communication
• Global roaming
• Network Access Protection (NAP)
• Secure key exchange between sites
• Verification of a trusted management point

AD DS and Client Installation
After the Active Directory schema has been extended, a number of client
installation properties are published to AD DS. Whenever a new Configuration
Manager client is installed, it can query AD DS to determine which installation
properties to use. Client installation properties that are published to AD DS
include:
• The default management point used to download content for the client
installation.
• The Configuration Manager site code.
• The fallback status point.
• The Hypertext Transfer Protocol (HTTP) port used for client communications
in both mixed mode and native mode, and the Hypertext Transfer Protocol
Secure (HTTPS) port used for client communication in native mode.
• A setting to indicate that the client must communicate in native mode.
• The certificate store name if the default (local computer) is not being used.
• A setting to determine which certificate to use for native mode communication,
if multiple valid certificates exist.
• Installation properties specified in the Client tab of the Client Push
Installation Properties dialog box.
By default, Configuration Manager publishes the site in AD DS. You can modify
this by accessing the Advanced tab on the Site Properties dialog box.
Question: You need to ensure that Configuration Manager uses AD DS to publish

information for your Configuration Manager site. What do you do first?
Question: Which installation method does not use AD DS to obtain installation

properties?

Site Systems Used by Deployment Methods
Key Points
Your planning tasks should include which site systems are required for your
specific installation and deployment method. The following site systems may need
to be in place to simplify or assist in reporting and troubleshooting the deployment
process.
Management Point
A management point is the primary point of contact between Configuration
Manager clients and the site, and is required for managing client computers within
the site. By default, the management point can provide clients with installation
prerequisites, client installation files, and configuration details. However, you can
also install a client manually, and provide an alternate source location for client
files.
Management points are also used to send client policies and receive client
information—such as inventory data, software metering information, and status
and state messages—from clients.
One management point can support 25,000 clients per site.

Note: Clients only communicate with the default management point configured for
the site. You can configure multiple site systems to host the management point site
server role using Network Load Balancing (NLB) to provide high availability, and
then designate a default management point for the site. To configure the default
management point, configure the Management Point Component Properties
dialog box found in the Component Configuration node of the Configuration
Manager console.
During primary site server installation, you are given the option to install the initial
management point. If you did not install a default management point during setup,
or if you need to install the management point site system role on a different
server, you can use the New Site Role Wizard to add and configure the site system.
If you need to add a new site system, you can use the New Site System Server
Wizard or the New Site System Server Share Wizard.
Note: If you have a secondary site, you can install a proxy management point.
Configuration Manager uses the proxy management point to retrieve policy at
secondary sites attached to their assigned primary site. The proxy management
point receives inventory data and status messages, and then sends them to the
secondary site server to be forwarded to the parent site. Proxy management points
can help increase bandwidth efficiency between sites.
Server Locator Point

Configuration Manager uses server locator points to help clients find management
points, and complete client site assignment if site information cannot be obtained
from AD DS. You may need a server locator point in the following cases:
• You have not extended the Active Directory schema to support Configuration
Manager.
• You have disabled a site from publishing to AD DS.
• You have workgroup clients or clients from another Active Directory forest.

Note: You need only one server locator point for the Configuration Manager
hierarchy, even if you have multiple sites. In a multi-site hierarchy, install the server
locator point in the central site. If you install a server locator point in the middle of
the hierarchy, it will have no knowledge of sites above it in the hierarchy.
Use one of the following methods to specify the server locator point for clients:
• Manually publish the server locator point in WINS so that clients can
automatically locate it.
• Assign the server locator point to clients during client installation, using the
Client.msi property SMSSLP=<server locator point name> on the CCMSetup
command line.
Fallback Status Point

A fallback status point is a site system role that helps monitor client deployment
and identify problems encountered during client installation or assignment. It also
helps identify clients that are unmanaged because they have problems
communicating with their management point. This is particularly helpful when the
site is operating in native mode.
When you install the client successfully and it is assigned to a Configuration
Manager site, the client sends a state message to the fallback status point.
Use a fallback status point when:
• You want client computers to report any failures to the site, particularly when
they cannot contact a management point. The fallback status point forwards
state messages to the site on behalf of the client computers.
• You want to utilize the Configuration Manager client deployment reports,
which use data that the fallback status point relays.
• The benefits of using a fallback status point outweigh any security risks
associated with unauthenticated connections and clear text transfers over
HTTP traffic.

Note: The fallback status point and client communication always use HTTP, which
uses unauthenticated connections and sends data in clear text, even when the site is
in native mode. Do not install a fallback status point in the site if the security risks of
running a Web site with unauthenticated connections and clear text transfers
outweigh the benefits of identifying client communication problems.
You can assign fallback status points to Configuration Manager clients using the
following methods:
• If a fallback status point is installed on the site and you use client push
installation, the fallback status point is automatically assigned during the client
push installation.
• If a fallback status point is installed on the site, and the site is publishing to
AD DS, running CCMSetup.exe with no command-line properties will result in
searching for the site's fallback status point in AD DS. If the client belongs to
the same Active Directory forest as the site server's forest, the site's fallback
status point is automatically assigned during client installation.
• If you run CCMSetup.exe manually, you can specify the FSP=<server> property
to directly assign a fallback status point to a client.
Other Site System Roles Used in Deployment Scenarios

There are a number of additional site system roles that you can use for client
deployment tasks, depending on your client installation method and additional
organizational requirements.
Additional site system roles include the following:
• Reporting point. You can use a reporting point to obtain report information
about client deployment tasks.
• Distribution point. You can use software distribution to upgrade existing
Configuration Manager clients. Use a distribution point to store package
source files, and as a contact point for clients to obtain programs and files after
they have received a software distribution advertisement.

• Software update point. The software update point site system role is deployed
on a server that has WSUS 3.0 installed. You can use a software update point
to deploy the Configuration Manager client as a standard update to systems
throughout your network.
• PXE service point\state migration point. The Preboot Execution Environment
(PXE) service point and the state migration point are both site system roles
used for Operating System Deployment tasks. The PXE service point supports
PXE-based system deployments. The state migration point manages the user
state migration from one client to another. You can include the Configuration
Manager client in operating system images, or you can installed it during an
Operating System Deployment task sequence.

Preparing for Client Push Installation
Key Points
Use the client push installation method to deploy the Configuration Manager client
to systems that have been discovered and have a discovery data record (DDR)
registered in the site database.
You can invoke client push installation using two methods, both of which are
available from within the Configuration Manager console:
• Client push installation site setting.
• Client Push Installation Wizard.
Client Push Installation Site Setting

You can configure client push installation at the site level so that client installation
occurs automatically on computers discovered and assigned within the site’s
configured boundaries.

If a client has been assigned to the site, and you have enabled the client push
installation site setting, the site server generates a Client Configuration Request
(CCR) for the discovered resource. As long as the discovered resource matches the
configuration criteria set for the client push installation method, Configuration
Manager processes the CCR and starts client installation.
Note: To help ensure that client push installation works on a specific resource, verify
that the system is assigned to the site. You can do this by looking at the Assigned
column in the details pane of the collection. The Assigned column will list Yes or No.
To configure the site to use client push, do the following:

1. In the Configuration Manager console, expand System Center Configuration
Manager, expand Site Database, expand Site Management, expand <site
code> – <site name>, expand Site Settings, and then expand Client
Installation Methods.
2. Right-click Client Push Installation, and then click Properties.
3. On the General tab, configure the following options:
• Enable Client Push Installation to Assigned Resources. Used to enable
or disable the client push installation setting for the site.
• System Types. You can specify which types of systems will have the client
installed: servers, workstations, and domain controllers. You can also
specify whether or not to include site systems for the client push
installation.
4. On the Accounts tab, configure one or more accounts to use for connecting to
client computers during client software installation. The specified accounts
should have administrative rights on the destination computer. If there are no
accounts listed, then the site server’s computer account is used for the
installation.
5. On the Client tab, specify installation properties to use when installing the
client software. These properties control the installation of the Client.msi file.
If you have also extended the Active Directory schema to support
Configuration Manager, these properties will be published to AD DS so that
they can be used by other systems during client installation.

When you invoke client push installation, the site server automatically attempts to
install the client software to the target computer once every hour for up to 168
hours (one week).
Note: You cannot use CCMSetup.exe properties. For a list of properties that you can
use with Client.msi, refer to The Client Installation Process topic earlier in this lesson.
Client Push Installation Wizard

Use the Client Push Installation Wizard to push the Configuration Manager client
to both assigned clients and to systems outside of the site boundaries (such as to a
secondary site).
To install the Configuration Manager client using the Client Push Installation
Wizard, complete the following steps:
1. In the Configuration Manager console, navigate to the collection that contains
the intended client(s).
2. Right-click either the collection name or the specific computer resource, and
then select Install Client.
3. On the Installation options page, configure the following options:
• Include domain controllers. This option ensures that all domain
controllers that are members of this specific collection are installed with
the Configuration Manager client components.
• Include only clients in this site’s boundaries. By default, this setting is
selected. This ensures that only clients that are within the site boundaries
and are members of the selected collection are installed with the client
components. De-select this option if you want to attempt to install the
client components on collection members that are assigned to a different
site.
• Include subcollections. To provide a more efficient way to advertise to
resources, Configuration Manager allows for subcollections. This option
allows you to control whether a subcollection should also have the client
push installation occur when it runs on the parent collection.
• Always install (repair or upgrade existing client). This option forces a
client reinstallation, even if the target computer already has a previous
installation.

To provide an additional installation account or additional Client.msi installation
properties, specify the settings in the Client Push Installation Properties dialog
box for the site. However, you do not have to enable client push installation for the
site to use the Client Push Installation Wizard.
Note: To successfully install the Configuration Manager client using the client push
installation method, you must add the File and Printer Sharing and Windows
Management Instrumentation (WMI) exceptions to the Windows Firewall on the
target computers. You can do this manually on each individual target computer, or
use Group Policy to configure the exceptions automatically for larger numbers of
systems. You must also configure these firewall exceptions on all firewalls between
the site server and the client.
Question: What is the main difference between the client push installation site
configuration, and the Client Push Installation Wizard?

Preparing for Software Update Point Installation
Key Points
If you use Configuration Manager 2007 to deploy software updates to client
computers, you can then use the same procedures for deploying the Configuration
Manager client as an additional software update. You can use software update
point installation to install new clients or upgrade existing Configuration Manager
clients to newer versions. This method also has the advantage of allowing you to
install the client on computers when users have standard user rights, or when
there is a firewall in place.
In order to use software update point installation, you need to have a WSUS 3.0
server installed and configured with the software update point site sever role.
Note: For detailed information about deploying the software update point site
server role, refer to Module 8: Deploying and Managing Software Updates.

When an existing software update point infrastructure is in place, you need to
enable the client installation method and publish the Configuration Manager client
to the software update point. To enable the software update point client
installation method, complete the following steps:
1. In the Configuration Manager console, navigate to the Client Installation
Methods node.
2. Right-click Software Update Point Client Installation, and then click
Properties.
3. Select the Enable Software Update Point Client Installation check box.
Configuring Clients to Connect to the Software Update Point

If you are upgrading existing Configuration Manager clients, the systems should
already have a policy that lists the software update point sever name and port from
which to receive software updates.
For systems that do not have an installed Configuration Manager client, use Group
Policy to direct the computer to the software update point to obtain software
updates. To configure an appropriate Group Policy object (GPO) to specify the
software update point, complete the following steps:
1. Use the Group Policy Management Console (GPMC) to create a new or modify
an existing GPO.
2. In the Group Policy Management Editor window, expand Computer
Configuration, expand Policies, expand Administrative Templates, expand
Windows Components, and then click Windows Update.
3. Enable the Specify intranet Microsoft Update service location policy option.
4. In the Set the intranet update service for detecting updates field, specify the
exact name of the software update point server. If you are using a non-
standard port for communication, you may also have to provide the port along
with the name of the server.
5. Link the GPO to the appropriate organizational unit (OU) in AD DS.
The software update point client installation method does not allow you to directly
add command-line properties to the installation. However, you can obtain
installation properties from AD DS as long as you have extended the Active
Directory schema to support Configuration Manager.

Note: You can also use AD DS to provision client installation settings to computers.
A Group Policy administrative template called ConfigMgr2007Installation.adm
comes with the Configuration Manager 2007 installation media. You can use this
template when the Active Directory schema was not extended, or if you want to
override client installation properties on specific groups of computers.
Question: What are some of the benefits of using the software update point
installation method?

Preparing for Group Policy Installation
Key Points
You can use Group Policy to deploy the Configuration Manager client to network
systems. To use Group Policy in this capacity, consider the following:
• For Group Policy installation to function, all potential clients must belong to
the Active Directory domain.
• You must use the CCMSetup.msi file that is provided in the <Configuration
Manager installation directory>\bin\I386 folder on the site server. Note that
you cannot add properties to the CCMSetup.msi file to customize the
installation. Other methods must be used, such as using the
ConfigMgr2007Installation.adm Group Policy template, or by publishing
properties to AD DS.
• You should extend the Active Directory schema to support Configuration
Manager and to ensure that the site is publishing to AD DS. This ensures that
all Group Policy-based clients will search AD DS for installation properties
when the Configuration Manager 2007 client is installed.

Group Policy provides two options for deploying software to network clients:
• Assign. You can assign the CCMSetup.msi file, which means that the
Configuration Manager client installs when you start the computer.
• Publish. If you publish the CCMSetup.msi file, the Configuration Manager
client installation is displayed in the Add or Remove Programs dialog box in
Control Panel. Users can then install the client as needed.
Question: Why would you want to assign the Configuration Manager client to a
computer?

Preparing for Additional Installation Methods
Key Points
Configuration Manager 2007 supports several additional installation methods that
you can use to deploy the Configuration Manager client components. The
following sections discuss considerations for each of these additional methods.
Manual or Logon Script-Based Installations

The manual installation method has the most administrative overhead of all
methods, but is used frequently for troubleshooting. Using this method,
CCMSetup.exe downloads all necessary files to complete the client installation
from a specified management point or from a specified source location.
CCMSetup.exe requires administrative rights to the client computer. If the user
running CCMSetup.exe does not have administrative privileges, then the
installation fails.
CCMSetup.exe is located in the Client folder of the Configuration Manager 2007
installation folder on the site server, and also in site’s management point. The
folder is also shared as <site server name>\SMS_<site code>\Client.

Note: For a list of properties that you can use with CCMSetup.exe, refer to The Client
Installation Process topic earlier in this lesson.
The logon script-based installation method is a manual method that uses the
/logon command-line switch. When you specify the /logon installation property
for CCMSetup.exe, client installation does not occur if any version of the client
already exists on the computer. This prevents the client’s reinstallation each time
the logon script runs.
Logon script installation uses the same methods as manual client installation and,
therefore, you can use the same command-line switches for logon script-based
installations. It also means that the same requirements and restrictions—such as
administrative rights—apply.
Software Distribution-Based Installations

You can use the software distribution installation method to upgrade the client
software on computers in your Configuration Manager or SMS 2003 hierarchy.
This method is especially useful after a service pack update, when the
Configuration Manager agent has changed and you need to control the upgrade
roll out.
To use the software distribution-based method, create a standard software
distribution package, and then advertise it to collections within your Configuration
Manager site.
Including the Configuration Manager Client in System Images

You can preinstall the Configuration Manager client software on a reference
computer image that you can then deploy throughout your network environment.
To prepare the reference computer for imaging, complete the following steps:
1. Manually install the Configuration Manager client software on the reference
system computer. Do not specify the client’s site code in the CCMSetup.exe
command-line properties.
2. Ensure that the SMS Agent Host service (Ccmexec.exe) is not running on the
reference computer, by typing net stop ccmexec from a command prompt.

3. Remove any certificates stored on the reference computer. Failure to do so
could allow clients to impersonate each other, and could make it impossible to
verify the data for each client.
4. Use your imaging software to capture the reference system computer’s image.
5. Deploy the image to target computers.

Lesson 2
Deploying Clients
To successfully deploy a client, the system has to be discovered, installed, and then
assigned to a site. For this to occur, you need to ensure that your client systems
meet the hardware and software requirements for management within a
Configuration Manger infrastructure. It is also helpful to know how clients
communicate with the site systems to effectively deploy and troubleshoot the
Configuration Manager client component installation. To help increase security,
you can also configure approval settings to ensure that only approved clients
become members of the site.
• Describe client system requirements for Configuration Manager client
deployment.
• Describe how clients are assigned to sites.

• Describe how clients find the site systems to communicate with during client
installation.
• Configure client approval settings.
• Install the Configuration Manager client using Group Policy.

Client System Requirements for Client Deployment
Key Points
You should be familiar with the client-based hardware and software requirements
for a successful Configuration Manager client installation. Depending on the
Configuration Manager service pack level or release deployed in your organization,
you may have to meet specific requirements to ensure full functionality.
Note: Exceeding minimum hardware and software requirements helps ensure that
you will be ready when you need to deploy a new service pack or release
throughout the Configuration Manager infrastructure.

General Configuration Manager 2007 Client Requirements
The following table lists the minimum hardware requirements for a Configuration
Manager client.
Hardware
component Requirement
Processor 233 megahertz (MHz) minimum; 300 MHz or faster recommended
Random access 128 megabytes (MB) minimum; 256 MB or more recommended;

memory (RAM) 384 MB required for operating system deployment
Free disk space 350 MB minimum; 265 MB minimum for client upgrades
Note: During client installation, the temporary program
download folder automatically increases to 5 gigabytes (GB) as
long as 5 GB or more space is available on the client computer.
Network adapter Client systems must have network connectivity to site systems.
To manage mobile devices, the Mobile Device Client requires 0.78 MB of storage
space to complete installation successfully.
The Configuration Manager 2007 client is not supported on operating systems
prior to Microsoft Windows® 2000 Service Pack 4 (SP4). Specifically, the client
should not be installed on the following:
• Microsoft Windows 95, Windows 98, or Windows Millennium Edition
• Windows XP Media Center or Home Edition (or Windows XP Professional
with less than Service Pack 2 installed)
• Windows Vista® or Windows 7 Starter, Home Basic, or Home Premium
Edition
Note: Windows 7 Professional, Enterprise, or Ultimate editions are only supported

for the Configuration Manager 2007 SP1 client with a hotfix added as described in
Microsoft Knowledge Base article 974236 (http://support.microsoft.com/kb
/974236/). For full Windows 7 support, we recommend that you install Configuration
Manager 2007 SP2.

Note: Windows Server® 2008 and Windows Vista SP2 are only supported for the
Configuration Manager 2007 SP1 client with a hotfix added as described in
Microsoft Knowledge Base article KB970093 (http://support.microsoft.com/kb
/970093).
• Windows CE 3.0
• Windows Mobile Pocket PC 2002 or Windows Mobile Smartphone 2002
The Configuration Manager 2007 client supports installation on x64 or Itanium-

based systems. However, it is 32-bit code running within the 64-bit environment.
Note: To use the Configuration Manager Remote Control and Remote Assistance
features on 64-bit clients, you need to deploy the Configuration Manager SP2 client.
Firewall Settings for Configuration Manager Clients

You may need to configure firewall exceptions on computers that run a client-
based firewall. Depending on the features you intend to use, you may need to
apply the following exceptions:
• File and Printer Sharing and Windows Management Instrumentation (WMI)
to support features such as client push installation, client installation using
Group Policy, and Windows monitoring features.
• TCP ports 2701, 2702, and 135 to support Remote Control and Remote
Desktop usage. You may also need to add the program Helpsvc.exe to the list
of permitted programs and services so that you can use Remote Assistance.
However, if the client initiates a Remote Assistance request, Configuration
Manager will automatically configure Windows Firewall to support Remote
Assistance and Remote Desktop.
Question: Your infrastructure includes Windows Server 2008 R2 servers and

Windows 7 clients. What do you do to ensure your Configuration Manager 2007
environment can support these operating systems?

Overview of Client Assignment
Key Points
A client computer must be assigned to a site before that site can manage the
system. Clients can be assigned to a site during, or after installation. Assigning a
client involves either providing a specific site code, or configuring the client to
assign itself automatically to a site based on site boundaries. If you do not assign
the client to a site during installation, the client installation phase completes, but
Configuration Manager cannot manage the client.
You cannot assign clients to secondary sites. They are always assigned to the
parent primary site, but can reside within the boundaries of the secondary site,
taking advantage of any proxy management point and distribution points at the
secondary site. This is because clients communicate with management points, and
management points must communicate with a site database. Secondary sites do
not have their own site database, but rather use the site database at their parent
primary site.

Using Auto-Site Assignment to Assign Site Codes
During client deployment, clients that you configure to use auto-site assignment
compare their own IP address with the boundaries configured in the Configuration
Manager hierarchy. When the client IP address falls within the boundaries of a
Configuration Manager site, the client is assigned to that site.
Note: If there are multiple sites that the client’s IP address is assigned to, you cannot
control which site is used for assignment. This is referred to as an overlapping
boundary situation, and is not supported.
Manually Assigning a Site Code

You can manually assign clients to a site using the following two methods:
• Specify the site code using a client installation property.
• Specify the site code in Configuration Manager in the computer’s Control
Panel.
Site Compatibility Check

Before site assignment completes, Configuration Manager performs site
compatibility checks. These checks include:
• Ensuring that a Configuration Manager client is not assigned to a SMS 2003
site.
• If the client is running Windows 2000, ensuring that it is not assigned to
native mode site.
For these checks to occur, the client must be able to locate site information from
AD DS or from a server locator point.
Question: Can you assign a client to a Configuration Manager site using the
domain as a boundary?

Finding Site Systems During Client Installation
Key Points
For a system to become a fully managed client, it must be able to locate its default
management point and obtain the site mode settings. This is required so that the
client can download its client policy and send back client information to the site
server.
Note: The information in this topic refers to intranet-based Configuration Manager

clients. For more information about how Internet-based clients communicate with
the site, refer to Module 14: Configuration Manger 2007 Native Mode and Internet-
Based Client Management.

Locating the Default Management Point
Configuration Manager client computers can locate their default management

point using the following methods in the order specified below:
• AD DS. If the Active Directory schema has been extended to support
Configuration Manager, and all sites are configured to publish to AD DS, then
the default management point for each site will be published to AD DS. Clients
must belong to the same Active Directory forest as the management points.
• DNS. A client can use Domain Name System (DNS) to find its default
management point as long as the following two requirements are satisfied:
• The DNS zone containing the service (SRV) resource record for the
management point must contain a host record for the computer assigned
with the management point role.
• Clients must be configured with a DNS suffix.
The DNS method is ideal for clients that cannot use AD DS, such as
workgroup clients, or clients from another forest.
• Server locator point. If a client cannot find its default management point using
AD DS or DNS, then it attempts to use a server locator point. You can use the
SMSSLP Client.msi property to specify the server locator point during client
installation. The client setup process can also locate a server locator point
through AD DS, or you can manually publish the server locator point in WINS.
• WINS. If all other mechanisms fail to locate a default management point, the
client uses WINS to verify that the management point was registered as a
service on the network. If the management point is configured to use WINS
through its TCP/IP configuration, it automatically registers the management
point service to the WINS database.

Locating Site Mode Settings
Intranet-based Configuration Manager clients use site mode settings to determine

whether the client is assigned to a site in mixed mode or native mode. The
Configuration Manager client locates this information using the following
methods:
• AD DS. Clients use AD DS if the Active Directory schema was extended to
support Configuration Manager, and if all sites are published to AD DS. All
systems must also belong to the same Active Directory forest as the site server.
Clients that are in the wrong communication mode automatically change to
match their assigned site modes. Additional settings may also be applied, such
as checking the certificate revocation list if required.
• Server locator point. If site information is not published to AD DS, you can use
a server locator point to provide site mode settings. If a server locator point is
used, you cannot apply automatic settings to reconfigure the client site mode.
In this case, you must manually reinstall the client in the correct site mode
configuration.

Client Approval Settings
Key Points
Configuration Manager 2007 allows you to specify clients that require approval
before they can join a site. If your site is configured in mixed mode, client
computers are not authenticated before they join the site. Client approval provides
an extra layer of security to ensure that only authorized clients connect to the site
and receive policy information.
Note: Approval is not required when you configure the site for native mode,
because public key infrastructure (PKI) certificates authenticate clients to the
management point and other site systems.

The following table describes the options available for client approval:
Approval setting Description
Manually approve • Clients are manually approved after registering with a site.
each computer • Select the Manually approve each computer option on the
Site Mode tab in Site Properties.
• Within a collection, highlight each computer and select
Approve.
Automatically • Clients within a trusted domain are approved automatically.

approve • Select the Automatically approve computers in trusted
computers in domains option on the Site Mode tab in Site Properties.
trusted domains
Automatically • All clients are approved automatically.

approve all • Select the Automatically approve all computers option on
computers the Site Mode tab in Site Properties.
Configure client approval from the properties of the site name in the Configuration
Manager console.

Demonstration: Deploying the Configuration Manager
2007 Client Using Group Policy
Key Points
In this demonstration, you will see how to use Group Policy to deploy the
Configuration Manager client.
Demonstration Steps
Import the Configuration Manager 2007 Group Policy ADM templates

1. Open the Group Policy Management console.
2. Create a new GPO.
3. Edit the GPO, and import the Configuration Manager 2007 Group Policy
templates. You can import two templates: ConfigMgr2007Installation.adm,
and ConfigMgr2007Assignment.adm.

Configure a client deployment GPO
1. In the Group Policy Object Editor, expand Computer Configuration, expand

Policies, expand Administrative Templates, expand Classic Administrative
Templates (ADM), expand Configuration Manager 2007, and then expand
Configuration Manager 2007 Client.
Notice the two settings related to site assignment and client deployment. You
can use the site assignment setting to specify a specific site code for clients
within the scope of this GPO. For this demonstration, the instructor will only
configure the client deployment settings.
2. Double-click the Configure Configuration Manager 2007 Client
Deployment Settings policy. Enable the policy, and provide appropriate
CCMSetup parameters.
3. Create a software installation policy to assign or publish the Ccmsetup.msi file.
4. Link the GPO to the appropriate OU.
Verify the Configuration Manager client installation

• Start the client that is in the management scope for the GPO. You may have to
restart the system so you can apply the software installation policy.
Question: In which scenarios would you import the Configuration Manager ADM
templates into AD DS?
Question: When does the Configuration Manager client installation occur when it
is assigned using the Group Policy installation method?

Lab A: Deploying Configuration Manager 2007
Clients
Lab Setup
2. Ensure that the 6451B-NYC-DC1-B, 6451B-NYC-CFG1-B, and the 6451B-
NYC-CL1-B virtual machines are running.
domain.

Lab Scenario
You are an administrator for Contoso, Ltd. You have received a request to deploy
Configuration Manager 2007 clients within your new Seattle site. Before you
deploy clients, you will enable the system roles that Configuration Manager
requires, and verify that client approval is set to automatically approve computers
in trusted domains. Then you will deploy clients using the client push installation
method.

Exercise 1: Preparing the Site for Client Installation
Scenario
To prepare the site for client installation you must configure a default management
point, server locator point, fallback status point, and a reporting point.
1. Verify the default management point and approval settings.
2. Deploy a server locator point.
3. Deploy a fallback status point.
4. Deploy a reporting point.
Task 1: Verify the default management point and approval settings

1. On NYC-CFG1, open the Configuration Manager console and browse to the
Component Configuration node. Verify that the default management point is
configured as NYC-CFG1.
2. Verify that the site is configured to automatically approve computers in trusted
domains.
Task 2: Deploy a server locator point

1. Browse to the Site Systems node.
2. Create a new server locator point system role for NYC-CFG1 as follows:
• Specify the intranet fully qualified domain name (FQDN) as NYC-
CFG1.Contoso.com.
• Specify Use the site server’s computer account to install this site
system.
• Specify Use the site database and Use the server locator point’s
computer account.

Task 3: Deploy a fallback status point
• From the Site Systems node, create a new fallback status point system role for
NYC-CFG1.
system.
Task 4: Deploy a reporting point

• From the Site Systems node, create a new reporting point system role for NYC-
CFG1.
system.
Results: After this exercise, you should have installed various site system roles that
relate to client deployment tasks.

Exercise 2: Deploying the Configuration Manager Client
Using the Client Push Installation Method

Scenario
Next, you plan to deploy clients using the client push installation method.
1. Enable the client push installation method.
2. Verify Configuration Manager installation.
Task 1: Enable the client push installation method

1. On NYC-CFG1, verify that the Configuration Manager console is open, and
then navigate to Client Installation Methods.
3. Enable the following options:
• Enable client push installation to assigned resources
• Servers
• Workstations
• Domain controllers
• Enable client push installation to site systems
4. On the Accounts tab, add a Client Push Installation account for
Contoso\Administrator using the password Pa$$w0rd.
5. On the Client tab, in the Installation Properties dialog box, enter
SMSSITECODE=NYC SMSSLP=NYC-CFG1 FSP=NYC-CFG1.

Task 2: Verify Configuration Manager installation
1. After approximately 5 to 10 minutes, on NYC-CFG1, click Start, and then click

Control Panel.
2. Click System and Security and then click Configuration Manager (32-bit).
3. Confirm that the computer is assigned to the NYC site.
Results: After this exercise, you should have deployed the Configuration Manager
client using the client push installation method.

Lesson 3
Managing Configuration Manager 2007 Clients
After deploying the Configuration Manger client to network systems, there are
several post-installation tasks that you need to perform. You need to verify that the
intended systems have installed successfully. If some of the potential clients did
not install, you need to determine what has caused the issue. For clients that are
successfully installed, it is important to understand the Configuration Manager
client interface, as well as some of the common settings for configuring the
Computer Client Agent. Finally there may be times that you need to uninstall the
Configuration Manager client in order to remove the client from your management
scope, or for troubleshooting purposes.
• Verify a successful client installation.
• Manage client installation or assignment issues.
• Describe client policy retrieval.

• Describe common configuration settings for the Computer Client Agent.
• Describe the Configuration Manager client interface.

• Describe how to uninstall the Configuration Manager client.

Verifying a Successful Client Installation
Key Points
There are a number of ways to verify the Configuration Manager client’s
installation from both the server side and the client side. Some of the areas to look
at to confirm that the Configuration Manager client installed successfully include
client log files, Control Panel, and status information in collection and status
reports.

The following table describes methods of verifying a successful client installation:
Verification
method Description
Client status Collection status displays information about the clients’ status,
within the such as: site code, client (yes/no), approved, assigned, blocked,
collection client type, obsolete, and active.
Configuration Configuration Manager reports can check client deployment and

Manager reports assignment status. The reports are located in the SMS Site - Client
Information category.
Some useful reports include:
• Client Assignment Detailed Status Report
• Client Assignment Failure Details
• Client Assignment Status Details
• Client Assignment Success Details
• Client Deployment Status Details
• Client Deployment Success Details
• Client Deployment Failure Report
• Computers assigned but not installed for a particular site
Note: Many of the client deployment and assignment reports
require a fallback status point system role deployed within the
environment.
Configuration On each client, you can confirm the client’s status from the
Manager General tab of the Configuration Manager Properties dialog
properties box.
Client logs There are several log files that you can use to verify client
installation. Examples include:
• CCMSetup.log. Records setup tasks that CCMSetup.exe
performs. Can help troubleshoot client installation problems.
• Client.msi.log. Records setup tasks that Client.msi performs.
Can help troubleshoot client installation problems.
• ClientLocation.log. Records site assignment tasks. Can help
troubleshoot scenarios where the client is not assigned to a
Configuration Manager 2007 site.

Managing Client Installation and Assignment Issues
Key Points
Configuring a fallback status point to Configuration Manager clients is one of the
easiest ways to identify client installation or assignment issues. This technique also
helps identify clients that are unmanaged, because they have problems
communicating with their management point.
Some common client-installation issues include the following:
Issue Description
Clients fail to install using client Client installation may fail if you have not
push configured firewall exceptions. Exceptions are most
likely needed in the Windows Firewall. Exceptions
include File and Printer Sharing, and WMI.
Client Installation fails using the CCMSetup may fail if it cannot contact AD DS to
Group Policy installation method retrieve installation properties. Ensure that the
boundaries are correctly defined for the client so
that the site matches the client’s network location.

Issue Description
Clients fail to install using the Software update point installation may fail if
software update point Group Policy is configured to point to the wrong
installation method location, or wrong name of the software update
point.
Clients fail to assign to a site A common reason for clients installing successfully
but failing to assign to a site is that the site
compatibility check has failed. Ensure that clients
have some method available for checking site
compatibility.
Also double-check that there are configured
boundaries, and that there are no overlapping
boundaries.
Clients cannot be managed If a client has successfully installed and is assigned

to a site but cannot be managed, the common
cause is that the site has no default management
point, or clients cannot locate the management
point. Ensure that a mechanism is in place for
clients to find their management point.

Client Policy Retrieval
Key Points
After Configuration Manager successfully assigns a client to a site and starts
communicating with its default management point, the client downloads its client
policy.
The client policy comes from the site server whenever relevant changes are made in
the Configuration Manager console. The site server sends the policy to the
management point. To retrieve policies, all clients that belong to the site poll the
management point for policy updates at specific intervals (by default, every 60
minutes).
Client Policy Architecture

Client policies that the clients retrieve are made up of two primary components:
• Policy assignments. Contains information as to which clients should receive the
policy, and provides URL pointers to the policy body located on the
management point.
• Policy body. Contains the actual policy information to be applied to the client.

After Configuration Manager assigns a client to a site, the client requests full policy
information. Subsequent policy requests only include policy assignments that are
not already downloaded to the client. Some situations may trigger a full policy
download, such as changing the site mode, assigning the client to a new site, and
manually forcing a policy refresh using the Policy Spy tool.
Note: The System Center Configuration Manager 2007 Toolkit includes the Policy
Spy tool, which you can use to review and troubleshoot client policy.
Management Point Policy Storage

Configuration Manager does not cache policy assignment information on the
management point; it always retrieves this information from the site database.
Policy body can remain in the management point cache if the policy is frequently
requested by clients. If it is not requested, the policy body ages out.

Administrative Tasks for Managing Clients
Key Points
Administrative tasks include modifying the Computer Client Agent settings and
blocking Configuration Manager clients in the event that they are no longer
trusted.
Configuring the Computer Client Agent

Computer Client Agent settings allow you to configure client computers to
communicate with Configuration Manager site systems, including settings such as
configuring notification options for users, and specifying client computer
behaviors that require a restart.

The following table outlines the settings available on the Computer Client Agent
Properties dialog box.
Tab Description
General Specifies the Network Access account that client computers use
when an advertised program requires access to network resources
or a distribution point when the computer account and logged-on
user do not have access. The Network Access account is also used
with the Operating System Deployment feature to provide
authentication to distribution points within the Windows PE
environment.
You also can specify the polling interval that client computers use
when checking for new policy from the Configuration Manager
site, and the interval used to send state messages to the
management point.
Customization Specifies the text displayed to clients when deploying software

packages, software updates, and operating systems. This is where
you specify the organization name and task specific subheaders.
Reminders Specifies the reminder behavior for deadlines and mandatory

assignment schedules.
BITS Specifies bandwidth throttling settings to control network traffic

between client computers and Configuration Manager site
systems. By default, throttling is configured only for branch
distribution points, and not normal client activity.
Restart Specifies the site-wide notification settings to use when a program

requires restarting the client computer. Note that final notification
countdown must be less than the restart countdown.
Note: You can configure the policy polling interval and restart settings on a specific
collection. This allows for collection specific settings that may be different than
sitewide settings configured in the Computer Client Agent.
Question: Why would you want to decrease the policy polling schedule time?

Managing the Configuration Manager Client
Key Points
After Configuration Manager client installation, authorized users can use several
Control Panel programs to install, update, or repair Configuration Manager
components. The main program that most users access is a program called
Configuration Manager.
Overview of the Configuration Manager Client Program

Depending on which Configuration Manager features are installed, the
Configuration Manager client program contains the following tabs:
Tab Description
General Displays a list of the client properties that are reported in the
discovery data.
Components Provides a list of the client components currently available, and

that are installed and enabled.

Tab Description
Actions Displays a list of actions to run that are related to installed

components. For example, if you want to retrieve the latest client
policy, select Machine Policy Retrieval & Evaluation Cycle, and
then click Initiate Action.
Advanced Allows a user with Administrative rights to change some of the

client settings—such as assigned site—and the size and location of
the temporary program download folder.
Updates This tab is only shown if you installed a software update point in
the site. This tab allows you to configure a recurring schedule for
updates.
Configurations This tab is only displayed if you enabled the Desired Configuration
Management Client Agent. This tab provides a list of the desired
configuration baselines that have been assigned to this computer.
Internet This tab is only displayed if the client communicates in native

mode. This tab provides information that the client needs to
communicate with its assigned Internet-based management point.

Uninstalling the Configuration Manager Client
Key Points
To uninstall the Configuration Manager client software from a computer, use
CCMSetup.exe with the /Uninstall switch.
If enabled, the Deleted Aged Inventory History site maintenance task deletes all
client data older than the number of days you specify, thereby removing the
uninstalled computers from the database. The default setting is 90 days.
Note: The uninstall process is silent and displays no results on the screen. To verify that
client uninstallation is successful, examine the log file CCMSetup.log in the folder
%windir%\system32\ccmsetup folder on the client computer.

Lesson 4
Using Configuration Manager Reporting with

Client Installation
Configuration Manager provides a number of extensive reporting capabilities that

can help you verify client installation and monitor site communication between
site servers and clients. You can implement these reports in addition to the
standard log files and status information provided with previous editions of SMS
2003 and Configuration Manager.
• Describe Configuration Manager reports.
• Describe how the Report Viewer works.
• Monitor and troubleshoot client deployment.

Note: This lesson provides a high-level look at reports. For full details including
reporting point and reporting services role installations, refer to Module 5: Querying
and Reporting Data.

What Is a Configuration Manager Report?
Key Points
Reports are secured Configuration Manager objects that you create and manage in
the Configuration Manager console. Configuration Manager 2007 SP2 with R2
provides 384 predefined reports in various categories, and you can create
additional reports to fit your needs.
Reports are not propagated up or down the Configuration Manager hierarchy; they
run only against the site database on which you create them. However, because
primary sites contain inventory data from child sites, a report that retrieves data
from a primary site’s database might also include data that was forwarded from a
child site.
You can create custom reports as needed, and use the Report Viewer to view
supplemental reports.

Predefined Reports
You can use a number of predefined reports to gather important information from
the site database. You can create, manage, and secure reports using the
Configuration Manager console. Administrators and other report users, such as
help-desk specialists and business decision makers, can run reports using the
Report Viewer. End users can run reports without accessing the Configuration
Manager console. A number of predefined reports appear on the Computer
Details page in Report Viewer. If you clear the Display in computer details check
box, modify the SQL statement, or modify a report prompt for a predefined report,
the report might not work as intended.
Custom Reports
When predefined reports do not retrieve the desired data, you can create custom
reports by copying and modifying predefined reports, or by creating new reports. If
you reinstall predefined reports from an import or as part of a product upgrade,
you lose your changes. We recommend that you keep the original report intact,
always make a copy of the predefined report, rename it, and then modify the new
report to better meet your needs. To create a new report, you must specify an SQL
statement that determines which records are returned when you run the report.
Supplemental Reports
To extend the site’s reporting capabilities, you can copy reports created outside of
Configuration Manager to a designated folder on a reporting point. These reports
are primarily Active Server Pages (ASP) pages, but they can be any file that you can
display using Windows Internet Explorer® 5.0 or later. Because supplemental
reports are not secured Configuration Manager objects, any user can view them
unless you secure them with Internet Information Services (IIS) security.
Report Categories
There are many report categories that can help you organize reports. Configure
reports for only one report category. You can create new categories by specifying a
unique category name when creating or modifying reports. Report categories are
case sensitive. When you create a new report and an existing report category is
specified, select the category from the drop-down list. You create a new category
when you enter a name in the Category text box that is not identical to an existing
category.

What Is the Report Viewer?
Key Points
The Report Viewer is a browser-based application that uses Internet Explorer to
display reports and provide a number of features such as the ability to print, e-mail,
or export report information. Use the Report Viewer to display information that is
stored in the site database.
To view reports using the Report Viewer, the user must have Read security rights
on the reporting objects to be displayed.
Configuring Report Options for a Site

You can specify whether the reports run from within the Configuration Manager
console, or from a new browser window in Internet Explorer. To configure this
setting, navigate to the Site Database node and then access the Report Options
command from the context menu.

Demonstration: Monitoring Client Deployment
Key Points
In this demonstration, you will monitor client deployment using status messages,
log files, and reports.
Demonstration Steps
View status messages

1. From within the Configuration Manager console, in the Component Status
node, view the SMS_CLIENT_CONFIG_MANAGER component.
2. Note any errors.

View log files
1. On the client computer view the following log files:

• ClientIDManagerStartup.log
• ClientLocation.log
• LocationServices.log
2. Note any errors:
View reports
1. In Configuration Manager console, navigate to the Reports node.
2. View the SMS Site – Client Configuration report.
Note: You may need a fallback status point so that information is available in all
client configuration reports.
Question: Which tool would you use to read log files in real time?
Question: Which monitoring tool would you use to easily find details about client
assignment failures?

Lab B: Verifying Client Deployment
Lab Setup
Hyper-V Manager.
2. Ensure that the 6451B-NYC-DC1-B, 6451B-NYC-CFG1-B, and the 6451B-
NYC-CL1-B virtual machines are running.
domain.
Contoso\Administrator, using the password Pa$$w0rd.

Lab Scenario
You are an administrator for Contoso, Ltd. You have received a request to deploy a
Configuration Manager client within your new site for your Seattle headquarters.
After deploying the client, you want to ensure success by reviewing the status
message, client log files, and reporting.

Exercise: Verifying Client Deployment
Scenario
In this exercise, you will review the status messages, client log files, and reporting
to verify successful client deployment.
1. Review status messages.
2. Review log files.
3. Review reporting.
Task 1: Review status messages

1. On NYC-CFG1, in the Configuration Manager console, navigate to
Component Status.
2. Select SMS_CLIENT_CONFIG_MANAGER, and then click Show Messages.
3. View status message ID 502 or 501.
Note: These status messages might take a few minutes to appear.
4. View the details of the message.

5. Browse through the other listed messages.
Task 2: Review log files

1. On NYC-CL1, open
C:\Windows\System32\Ccm\Logs\ClientIDManagerStartup.log.
2. Find the Site assignment entry.
Question: Did the site assignment change?
3. On NYC-CL1, open C:\Windows\System32\Ccm\Logs\ClientLocation.log.


4. Find the Assigning Client to Site entry.
Question: What is the assigned site for the client?
5. On NYC-CL1, open
C:\Windows\System32\Ccm\Logs\LocationServices.log.
6. Find the Current AD Site entry.
Question: What is the current AD Site?
Task 3: Review reporting

1. On NYC-CFG1, in the Configuration Manager console, navigate to Reports.
2. Run the Client Deployment Success Report.
3. View the report data to identify clients that deployed successfully. It may take
some time before data is available for the report.
4. View other reports based upon the SMS Site - Client Information category.
client installed successfully.

click Revert.
4. In the Virtual Machines pane, click 6451B-NYC-DC1-C, and then in the

DC1-C, and then in the Actions pane, click Connect.
6. Wait for NYC-DC1 to start, and then start 6451B-NYC-CFG1-C. Connect to

7. Wait for NYC-CFG1 to start, and then start 6451B-NYC-CL1-C. Connect to the
virtual machine.

Review Questions
1. You are about to install the Configuration Manager client on a computer with
two hard drives, and you notice that the directory that has %windir% installed
has enough space for the client but not enough for the temporary program
download folder. How can you install the Configuration Manager client but
maintain the temporary program download folder in another location?
2. You have received 2,000 new bare metal computers. You need to efficiently
install Windows Vista Enterprise, the Configuration Manager client, and the
2007 Microsoft Office system. Which Configuration Manager feature and
client installation method would you use?
3. You have been asked to roll out Configuration Manager client to three test
users. These test users sit next to you. Which client installation method would
you use to install these clients, assuming that no discovery agents have been
enabled?

4. There is a problem with one of your client computers. As part of your
troubleshooting, you want to confirm that Configuration Manager is not

causing any issues on this computer, and you want to remove the
Configuration Manager client. How do you remove the Configuration Manager
client?
5. You want to restrict the size of the temporary program download folder to 1
GB on a new client that you are about to install. Which command line would
you use?
6. What is a management point? What is its purpose?

Garth Fort is the systems administrator for Proseware, Inc. Proseware, Inc. has
three Active Directory sites: Carling, Careling, and Wheeler. Garth is in charge of
managing the day-to-day operations of the network and server environment for
two of the three Active Directory sites, Carling and Wheeler. He manages two
Configuration Manager sites, B01 and B02.
Using the information below, answer each of the following questions:
Configuration Manager site code: B01
Location: Building A
AD site name: Carling
IP range: 10.10.10.x
Subnet: 255.255.255.0
Gateway: 10.10.10.1
Configuration Manager site code: B02

Location: Building B
AD site name: Wheeler
IP range: 10.10.50.x
Subnet: 255.255.255.0
Gateway: 10.10.50.254

1. Garth is troubleshooting why a client within Building B will not assign to
Configuration Manager site B02. What is the most likely reason that the client
is not assigned automatically to B02, given the following client information?
Operating system: Windows Vista Enterprise
IP 10.10.10.231
Subnet 255.255.255.0
Gateway 10.10.10.1
2. Garth is troubleshooting why a client within Building A will not assign to

Configuration Manager site B01. What is the most likely reason that the client
is not assigned automatically to B01, given the following client information?
Operating system: Windows XP SP2
IP 10.10.10.31
Subnet 255.255.0.0
Gateway 10.10.10.1
3. Garth has enabled the client push installation method on Configuration

Manager B01, and only for workstations. Using the information below, which
of the following computers will install with the Configuration Manager client?
If any of them will not install the Configuration Manager client, why not?
COMPUTER1
Operating system: Windows XP SP2
IP 10.10.10.131
Subnet 255.255.255.0
Gateway 10.10.10.1
COMPUTER2
Operating system: Windows 2000 SP4
AD site name: Careling
IP n/a
Subnet n/a
Gateway n/a

COMPUTER3
Operating system: Windows Server 2003 R2

IP 10.10.10.123
Subnet 255.255.255.0
Gateway 10.10.10.1
COMPUTER4
Operating system: Windows 98 SE
IP 10.10.10.113
Subnet 255.255.255.0
Gateway 10.10.10.1
Best Practices
Supplement or modify the following best practices for your own work situations:
• Best practices for all site systems
• Use role separation on site systems. You can install all the site system roles
on a single computer, but it is usually not advisable because this creates a
single failure point. However, there are a few exceptions to the concept of
role separation. Preferably, install a dedicated version of Microsoft SQL
Server® on the same computer as the site server, and use that as the site
database server. This configuration allows Configuration Manager the
greatest control of the database configuration, and simplifies the SQL
Server security configuration.
• Do not remove the Admin$ share on site systems. Configuration Manager
requires the Admin$ share on site systems, and you should not disable or
remove it. The Configuration Manager site server uses the Admin$ share
to connect to and perform service operations on site systems.

• Management points
• In a single-site hierarchy that requires trusted root key authentication,

always use a separate management point. If you do not extend the Active
Directory schema, and if Configuration Manager does not have
permissions to publish to AD DS, Configuration Manager clients use the
trusted root key to authenticate management points before
communicating.
• The trusted root key at the central site server signs the management point
certificate. If the central site has to be recovered, clients continue to trust
the management points until a new trusted root key is generated at the
rebuilt central site server. Also, if you have to recover a management point,
clients will trust the new management point as soon as the management
point certificates are signed by the trusted root key. However, if clients are
reporting to a central site server that also functions as the site’s
management point, and you recover that computer, clients will not trust
that management point until you delete the current trusted root key on
the clients and reprovision them with the new trusted root key. To avoid
this situation, extend the Active Directory schema and enable publishing
for the site. If this is not possible, do not assign the management point role
to the central site server if there are clients reporting to the central site.
• Fallback status point
• Do not co-locate any other site system roles with the fallback status point.
The fallback status point is designed to accept unauthenticated
communication from any computer. Co-locating the fallback status point
with any other site role greatly increases the risk to that site role.
• Deploy the fallback status point prior to deploying clients. Deploy a
fallback status point prior to client deployment or, if you are migrating to
native mode, you should deploy it prior to changing the site mode.
Fallback status points are crucial to determining the state of client
deployment or migration. For example, if there is a problem with the
client certificate, the management point refuses all communications from
the client, but the fallback status point always accepts unauthenticated
communication. Without a fallback status point, you might be unaware
that large numbers of clients are not managed due to native mode issues.

Tools

Trace32 • Reading log files http://www.microsoft.com/downloads
/details.aspx?FamilyID=948e477e-fd3b-4a09-
9015-141683c7ad5f&DisplayLang=en
Policy Spy • Review and http://www.microsoft.com/downloads

troubleshoot client /details.aspx?FamilyID=948e477e-fd3b-4a09-
policy 9015-141683c7ad5f&DisplayLang=en
Inventory Collection, Software Metering, and Asset Intelligence 4-1

Module 4
Inventory Collection, Software Metering, and
Asset Intelligence
Contents:
Lesson 1: Overview of Inventory Collection 4-4
Lesson 2: Collecting Hardware Inventory 4-11
Lesson 3: Collecting Software Inventory 4-19
Lesson 4: Managing and Troubleshooting Inventory 4-26
Lab A: Collecting Inventory 4-41
Lesson 5: Asset Intelligence 4-49
Lab B: Using Asset Intelligence 4-71
Lesson 6: Metering Software Usage 4-81
Lab C: Configuring Software Metering 4-94

Module Overview
To manage clients effectively in a network environment, you must be able to

quickly determine specific hardware and software details that will help you
implement many of the more advanced features of Microsoft® System Center
Configuration Manager 2007. In this module, you will learn how to use hardware
and software inventory features to collect a variety of information related to client
computers and files within a Configuration Manager 2007 hierarchy. You also will
learn how to implement software metering to help monitor and collect software
usage data for Configuration Manager clients.
• Describe inventory collection.
• Explain how to collect hardware inventory.
• Explain how to collect software inventory.

• Manage and troubleshoot inventory collection.
• Explain how to configure and use Asset Intelligence.

• Describe how to implement software metering.

Lesson 1
Overview of Inventory Collection
Inventory collection is an important Configuration Manager feature. This lesson

defines the inventory collection process, and describes the benefits of inventory
collection for your organization. This lesson also describes how various
Configuration Manager components work together to collect inventory from client
computers assigned to a site.
• Define inventory collection
• Describe how you can use hardware and software inventory data.
• Describe the inventory collection process.

What Is Inventory Collection?
Key Points
Inventory refers to the information that describes the hardware and software
characteristics related to a specific Configuration Manager client. Inventory
collection is the process of gathering information about the hardware and software
installed on a client computer.
Hardware inventory data includes system information—such as available disk
space, processor type, and operating system—about each computer. Software
inventory data includes information about the software—such as inventoried file
types and versions—present on client computers. Configuration Manager software
inventory can also copy files that you specify from client computers to the site
server.
Although you can enable hardware and software inventory independently of one
another, each is enabled and configured for the entire site. That is, you cannot
configure either hardware or software inventory at the collection level.

Question: You would like to upgrade to 2 gigabytes (GB) of random access

memory (RAM) all computers that have only 512 megabytes (MB) of RAM. Which
inventory feature can assist you with this task?

Uses of Inventory Data
Key Points
You can use hardware and software inventory results as a foundation for many
Configuration Manager features. For example:
• You can build queries that include computers based on their hardware
configuration, or on installed software.
• You can build collections by using queries that include computers based on
their hardware configuration, or on installed software.
• You can use those collections to advertise software packages to specific
computers based on the hardware or software found during inventory.
• You can produce reports that display useful hardware configuration, or
installed software details.
• You can use queries and reports based on inventory information to find
computers that do not meet corporate standards.

• You can use Resource Explorer to view the complete inventory data for
individual computers. This view is especially useful when remotely

troubleshooting computer problems.
• You can use software inventory to collect copies of files from client computers.
Question: How will you use hardware and software inventory in your
environment?

Overview of the Inventory Collection Process
Key Points
Hardware and software inventory collection includes a number of components.
The inventory process is as follows:
1. When you enable the inventory client agents, Configuration Manager updates
the client policy to include the option that you specified. Each client retrieves
the updated policy at their next policy polling interval.
2. After it receives and processes the new policy, the client collects the inventory
information specified in the policy, and creates an inventory report.
3. The client then sends the inventory report to its management point.
4. The management point forwards the inventory information to the site server.
5. The site server updates the site’s database.
6. If the site is a child site, then the site server forwards the inventory information
to its parent site. The parent site server stores the information in its own
database. If the parent site is also a child, then it also forwards the inventory
information to its parent site as well.

Once inventory information for a client has been added to a site’s database, that
data can be viewed using Resource Explorer.

By default, hardware and software inventory runs once every seven days. You can
modify this schedule to meet your organization’s needs.

Lesson 2
Collecting Hardware Inventory
When you are configuring how a site collects hardware inventory, you should
consider the tasks that the Hardware Inventory Client Agent will perform. You may
require enhanced inventory data in addition to the data that the agent collects by
default. This lesson describes the process of hardware inventory, and also details
how you can enhance your organization’s inventory collection process by
modifying related configuration settings.
• Describe how the Hardware Inventory Client Agent collects the hardware
inventory, and describe how to enable it.
• Explain how Configuration Manager 2007 uses Managed Object Format
(MOF) files for hardware inventory.
• Explain how to modify the MOF files used for hardware inventory.
• Configure and extend hardware inventory.

How Does Hardware Inventory Collection Work?
Key Points
Hardware inventory gathers information—such as processor type, network card,
amount of memory, and disk information—about each client in the site.
Configuration Manager stores this data in the site database, where you can then
use the information via queries to generate and view reports, or to build hardware-
specific collections.
When enabled, the Hardware Inventory Client Agent collects detailed hardware
inventory information from the client. The agent collects hardware inventory by
querying several data stores on client computers, such as: the Windows registry,
and Windows Management Instrumentation (WMI) namespace classes.
Note: The Hardware Inventory Client Agent, by default, is enabled and is configured
to run every seven days. You can adjust the schedule as appropriate for your
organization.

Two files on the site server—Configuration.mof and Sms_def.mof—specify which
providers, classes and properties are reported in hardware inventory.

You can include additional information in hardware inventory by using
Management Information Format (MIF) files.The Hardware Inventory Client Agent
initially collects a full hardware inventory. This initial full inventory establishes a
baseline for future inventory collections. Subsequent inventory reports contain
only information that has changed—or delta information—since the previous
inventory collection. Delta inventory reporting greatly reduces network traffic that
client inventory reporting generates, because the delta inventory data is typically a
fraction of a complete inventory collection.
Certain events can cause a client to collect and report full hardware inventory
again. Such events include:
• The client attempts to update inventory data that does not exist on the server.
• The delta inventory information is corrupted.
• The client software is upgraded to a new version.
• An administrator assigns the client to a new site.
Question: What are three items that you can configure within the Hardware
Inventory Client Agent?
Question: How can you change or extend hardware inventory collection?


What Are Managed Object Format Files?
Key Points
Configuration Manager 2007 inventories hardware information about clients based
on the contents of two MOF files that are stored on the primary site server:
Configuration.mof, and Sms_def.mof. These files are located at: <ConfigMgr install
directory>\inboxes\clifiles.src\hinv.
Configuration.mof
The Configuration.mof file defines the data classes that the inventory agent uses,
and also defines and registers the WMI providers used during hardware inventory.
When clients request computer policies as part of their normal policy-polling
interval, the Configuration.mof file is attached to the policy body that clients
download and compile. When you add, modify, or delete data classes from the
Configuration.mof file, clients automatically compile the changes made to
inventory-related data classes the next time they receive an updated computer
policy.

Sms_def.mof
The Sms_def.mof file defines the reporting classes and attributes that are collected
from WMI during inventory. Reporting classes are based on the WMI repository
data classes (and their attributes) that exist on clients by default, or that are added
by customizing the Configuration.mof file. The information in the Sms_def.mof file
is converted into a reporting policy retrieved by clients during their normal
computer policy polling interval.
Note: The Sms_def.mof file is never sent directly to clients. Configuration Manager
2007 clients compile only the policy that the Sms_def.mof file contents generates.
Question: What types of additional information might you want to inventory in

your environment?
Question: You need to enable a number of approved WMI data classes. Which file
would you modify?

Extending Hardware Inventory
Key Points
You can extend hardware inventory by inventorying additional WMI classes,
attributes, registry keys, and other items. You can also reduce the amount of
information reported by clients during hardware inventory, in order to reduce the
network bandwidth and storage space required for inventory.
Edit the MOF files by using Notepad or another text editor.
• Edit the Configuration.mof file to modify the data class information to be
inventoried.
• Edit the Sms_def.mof file to modify the reporting class information to be
inventoried.
Hardware inventory collects classes and properties that have the reporting qualifier
set to TRUE, and ignores those set to FALSE. However, if a class is set to TRUE,
then any class properties with the key attribute are collected, even if the individual
property is set to FALSE.

Demonstration: Configuring and Extending Hardware
Inventory
Key Points
In this demonstration, you will see how to enable the Hardware Inventory Client
Agent and configure an inventory schedule. You will also see how to modify the
Sms_def.mof file to customize hardware inventory collection.
Demonstration Steps
Enable the Hardware Inventory Client Agent

1. In the Configuration Manager console tree, navigate to Site Database (Site),
Site Management, Site, Site Settings, and then select Client Agents.
2. In the results pane, right-click Hardware Inventory Client Agent, and then
select Properties.
3. Select Enable hardware inventory on clients.
4. In the Inventory schedule area, configure a schedule, and then click OK.

Configure an inventory schedule
1. In the Configuration Manager console tree, navigate to Site Database (Site),

Site Management, Site, Site Settings, and then select Client Agents.
2. In the details pane, right-click Hardware Inventory Client Agent, and then
select Properties.
3. In the Inventory schedule area, click Custom schedule, and then click
Customize.
4. Review the Custom Schedule dialog box, and then click Cancel.
5. Click Simple schedule, and then click OK.
Modify the Sms_def.mof file

1. In the Windows Explorer window, navigate to Installation_location \Microsoft
Configuration Manager\Inboxes\clifiles.src\hinv.
2. Right-click the sms_def.mof file, and then select Open With.
3. Select Notepad, and then click OK.
4. Enable classes and/or attributes by changing FALSE to TRUE; disable classes
and/or attributes by changing TRUE to FALSE.
5. Save the file.
Question: Under what circumstances might you choose to run the hardware
inventory using the simple schedule option?

Lesson 3
Collecting Software Inventory
Software inventory gathers files and information about installed programs from
client computers. This lesson describes how to configure software inventory and
how to collect specific files from Configuration Manager clients.
• Describe how the Software Inventory Client Agent collects the software
inventory, and how to enable the Software Inventory Client Agent.
• Explain how to configure software inventory rules.
• Explain how to configure software inventory file collection.

How Does Software Inventory Collection Work?
Key Points
Configuring the Software Inventory Client Agent is a site-wide configuration setting
and affects all clients assigned to the site. When enabled, the Software Inventory
Client Agent collects software inventory data directly from files (such as .exe files)
by inventorying file header information. Configuration Manager 2007 also can
inventory file system details, including those of unknown files (which are files that
do not have detailed information in their file headers). Software inventory also
collects copies of files you specify and stores them on the site server. This is useful
for collecting log or configuration files from network clients.
Note: By default, the Software Inventory Client Agent is enabled during installation
of Configuration Manager 2007, and is configured to run every seven days.

You can use Resource Explorer to view client software inventory information, or
you can include software inventory information in reports.
Question: How will you use software inventory in your organization?


Configuring Software Inventory Rules
Key Points
By default, software inventory is configured with a single rule that reports all .exe
files on all client hard disk drives. This default setting excludes encrypted and
compressed files. You can add other files to software inventory by creating
additional rules. When you create a new software inventory rule, include the
following information:
• File name. You can list a specific file or, by using wildcards, you can specify a
file type. For example, you could specify “*.ps1” to inventory Windows®
PowerShell™ command-line interface scripts.
• Location. You can configure the agent to search for the specified file on all of
the client’s hard disks, or in a specific path. The path can be explicit or based
on a variable, such as %ProgramFiles%.
• Whether to exclude encrypted and compressed files.
• Whether to exclude files in the Windows directory.

Additionally, you can configure whether software inventory collects file system
details for inventoried files, product details from file header information, or both.
These options apply to all software inventory rules.
Question: Which file types would you want to inventory in your organization?

Configuring Software Inventory File Collection
Key Points
By default, software inventory file collection is not enabled. When you specify a file
for collection, the Software Inventory Client Agent searches for it when it runs a file
collection cycle on each of the site’s clients. If the Software Inventory Client Agent
finds a file to collect, it attaches the file to the inventory file, and forwards it to the
site server.
Configuring File Collection

To configure software inventory file collection, complete the following steps:
1. On the Software Inventory Client Agent Properties page, on the File
Collection tab, click the New (star) button to create a new file entry.
2. Specify the name or, by using wildcards, the type of file you want to collect.
For example, you would specify “*.log” to collect log files from all clients.
3. Specify the location. You can configure the agent to search for the specified file
on all of the client’s hard disks, or in a specific path. The path can be explicit,
or can be based on a variable, such as %windir%.

4. Specify whether to exclude encrypted and compressed files.
5. Specify the maximum total file size of files collected for this entry.
Note: The file collection cycle is a separate action from the software inventory cycle.
Question: Which types of files would you collect in your organization?


Lesson 4
Managing and Troubleshooting Inventory
After you enable and configure the Hardware and Software Inventory Client
Agents, clients assigned to the site begin to report inventory results. Several
management tasks enable you to test, use, and manage inventory. These tasks
include initiating off-cycle inventory collection on a client, viewing inventory
results, and troubleshooting the inventory process. This lesson describes these
tasks in more detail, and provides best practices for securing client inventory
reporting.
• Explain how to initiate off-cycle inventory collection on a client.
• Explain how to view inventory results.
• Secure the client inventory collection.
• Troubleshoot client inventory collection.

Initiating Inventory Collection on a Client
Key Points
By default, hardware and software inventory is configured to run once every seven
days. You can change the inventory schedule by setting the time, day, or frequency
that best suits your requirements. However, you may have situations when you
need hardware and software inventory to run immediately on a single client.
You can cause certain client actions—such as policy retrieval and inventory
collection—to occur immediately, independently of scheduled intervals. You can
initiate these client actions on the Actions tab of Configuration Manager in
Control Panel on the client.
To initiate off-cycle inventory collection and reporting, complete the following
steps:
1. On the client computer, open Control Panel.
2. In Control Panel, open Configuration Manager.

3. In Configuration Manager Properties, select the Actions tab.
4. Under Actions, select the inventory action you want to initiate, and then click
Initiate Action.
Question: What are some circumstances when you might need to initiate
inventory collection on a single client?

Viewing Inventory Results
Key Points
After you collect hardware or software inventory information from Configuration
Manager clients, you can view the results using Resource Explorer. When you start
Resource Explorer, a new Microsoft Management Console (MMC) displays the
hardware and software inventory information that was collected from clients. You
can start the Resource Explorer from the Configuration Manager console, or from a
command prompt.

Demonstration: Initiating Inventory Collection on a Client
and Viewing Inventory Results
Key Points
In this demonstration, you will see how to initiate hardware inventory collection
on a client. You will also see how to use the Client Spy utility to monitor inventory
collection, and how to use Resource Explorer to view hardware and software
inventory results.
Demonstration Steps
Initiate inventory collection on a client

1. In Control Panel, double-click Configuration Manager. The Configuration
Manager Properties page will appear.
2. On the Configuration Manager Properties page, select the Actions tab.

3. If you have recently changed options for the Hardware or Software Inventory
Client Agent, or if you have recently modified either the Configuration.mof or

Sms_def.mof files, then in the Actions box, select Machine Policy Retrieval &
Evaluation Cycle, and then click Initiate Action in order to force the client to
update its policy. Wait a few minutes before proceeding.
4. Under Actions, select the inventory action that you want the client to
immediately perform. The inventory actions include File Collection Cycle,
Hardware Inventory Cycle, and Software Inventory Cycle.
5. Click Initiate Action.
Use Client Spy to monitor inventory collection

1. Click Start, click All Programs, click ConfigMgr 2007 Toolkit, and then click
CliSpy.
2. In the SMS Advanced Client Troubleshooting Tool, click Tools, and then
select Inventory.
3. On the Inventory Information tab, expand the Software Inventory, File
Collection, and Hardware Inventory nodes, and review the information
shown.
Note: Nodes will not appear before the first inventory cycle. You can use the F5 key
to refresh the display periodically until the nodes appear.
Use Resource Explorer to view hardware and software inventory

results
1. In the Configuration Manager Console, navigate to Site Database (Site),
Computer Management, Collections, All Systems.
2. In the details pane, right-click the target computer, click Start, and then select
Resource Explorer. Wait for the Resource Explorer to start.

3. In the Resource Explorer console tree, expand the Resource Explorer node,
and expand the Hardware node. Select various nodes within the Hardware
node, and review the information that is displayed in the details pane.
4. Within the Resource Explorer node, expand the Software node. Select
various nodes within the Software node, and review the information that is
displayed in the details pane.
Note: You also can use reports to obtain the hardware and software inventory
information collected from clients. More information about the report feature is
provided later in this course.
Question: You have just made a modification to the inventory schedule for both
hardware and software inventory. If you want to force the change to a specific
client, which action must you initiate from the Configuration Manager Control
Panel application found on the client?
Question: Which tool is used to view hardware and software inventory results?

Securing Client Inventory Collection
Key Points
Although inventory attacks are considered less serious than other types of
malicious attacks on Configuration Manager, you should consider implementing
security measures to protect the inventory process and data. Security
recommendations for client inventory reporting include the following:
• Enable inventory encryption. In native mode, communication between the
client and management point is encrypted by design. In mixed mode, the
client digitally signs—but does not encrypt—the inventory reports and
collected files it sends to the management point. In a mixed mode site, you can
encrypt inventory reports and collected files to management points in order to
prevent attackers from intercepting the data.
• Disable MIF file collection. Although you can extend inventory by collecting
IDMIF and NOIDMIF files, the MIF files collected during hardware inventory
are not validated. Thus, a malicious user could use MIF files to alter data in
your site database by overwriting valid data with invalid data.

• Do not collect critical or sensitive files. The inventory client agent runs with
the rights of the LocalSystem account, which has the ability to collect copies of
critical system files such as the registry or security account database. When
these files are available at the site server, someone with permission to read the
collected files could analyze their contents and possibly discern important
details about the client in order to be able to compromise its security.
• Use an appropriate deletion interval for inventory data and collected files.
Although the data sent from the client to the management point can be
encrypted, the data stored in the site database is not encrypted, even in native-
mode sites. Thus, you should determine how long inventory information and
collected files should be retained in the database and configure the Delete
Aged Inventory History and Delete Aged Collected Files tasks to delete data in
a timely manner.

Troubleshooting Client Inventory Collection
Key Points
If you experience problems with inventory collection, you can use a variety of tools
to help you identify the cause. Some of these tools include:
• Client log files. The log files on the client can help you identify inventory
problems that affect that client. The client log files directly related to inventory
are:

CcmExec.log Records activities of both the client and the SMS Agent
Host service. For inventory, includes high-level events,
such as initialization of the inventory agent queue.
FileSystemFile.log Records inventory agent file system scanning events.
InventoryAgent.log Records activities of the inventory agent, including

creation of discovery data records (DDRs) and inventory
reports.

Mifprovider.log Records events related to .MIF file reporting.
• Site server log files. Log files on the server can help you identify inventory
problems that affect more than one client. The site server log files directly
related to inventory are:
Dataldr.log Processes MIF files and hardware inventory in the

Configuration Manager 2007 database.
Invproc.log Records the processing of delta MIF files for the

Dataloader component from client inventory files.
Sinvproc.log Records client software inventory data processing to the

site database in Microsoft SQL Server®.
• Status messages. Configuration Manager status messages report information

about Configuration Manager component behavior and data flow. Status
messages can be very helpful in troubleshooting Configuration Manager
issues, because many status messages include possible cause and resolution
information.
Status messages are categorized by severity and type. You can view status
messages related to a particular site component or site system role, or by using
built-in or custom status message queries.
A number of factors can affect Configuration Manager. When troubleshooting any

problem in Configuration Manager, you should see if the problem might be caused
by:
• Security settings, such as right and permissions
• Low disk space
• Dependent technology misconfiguration
• Time synchronization problems

Demonstration: Troubleshooting Inventory Collection
Key Points
In this demonstration, you will see how to use log files and status messages to
follow the inventory process from client collection through site database update.
Demonstration Steps
Examine the client log files

1. On the client computer, start Trace32 from the ConfigMgr 2007 Toolkit.
2. If the SMS Trace message box appears, click Yes.
3. In SMS Trace, open C:\Windows\System32\CCM\Logs\
InventoryAgent.log.
4. Find the first occurrence of Action=Hardware.

5. Notice the line that reads:
Inventory: Action=Hardware ReportType=Full
This is the start a full hardware inventory report. Review the next several lines
to see the various namespaces collected during inventory.
6. Find the next occurrence of Temp report.
7. Notice the location of the temporary inventory report. Review the next several
lines and notice the actions performed in reporting inventory.
8. Locate and select the line that begins:
Inventory: Successfully sent report.
In the info pane, notice that the data was sent to the management point as
signed, but not encrypted.
9. Find the first occurrence of Action=Software.
Inventory: Action=Software ReportType=Full
This is the start of a full software inventory cycle. Review the next several lines.
Notice the line that begins:
Inventory: Action completed
This is the end of the software inventory reporting cycle.

11. Find the first occurrence of Action=File.
12. Notice the line that begins:
Inventory: Action=File Collection
This is the start of a file collection cycle. Review the next few lines.
13. Click Tools, and then click Find.
14. Find the first occurrence of ClientLocation.log matched.

15. Notice the line that begins:
File Collection: ClientLocation.log matched.
Notice the Collected Size and Remaining Allowable Size parameters. These are
related to the configured maximum size of collected files.
16. Find each subsequent occurrence of ClientLocation.log until the following
line displays:
File Collection: Attached File:

C:\Windows\System32\CCM\Logs\ClientLocation.log
These lines record the process of identifying, collecting, and sending to the
management point the ClientLocation.log file.
17. Close SMS Trace.
Examine the inventory log files on the site server

1. On the site server, start Trace32 from the ConfigMgr 2007 Toolkit.
2. If the SMS Trace message box appears, click Yes.
3. In SMS Trace, click File, and then open C:\Program Files (x86)\Microsoft
Configuration Manager\Logs\dataldr.log.
4. Find the first occurrence of NYC-CL1.
Processing Inventory for Machine: NYC-CL1
This is the start of inventory processing for the client NYC-CL1. Review the
next several lines to see the various tasks performed by the Inventory Data
Loader while processing client inventory data.
6. Press the F3 key until SMS Trace displays the line that begins:
Done: Machine=NYC-CL1(GUID: ...
This line indicates that the inventory data from the specified client has been
completely processed into the site database.
7. Close SMS Trace.

Examine the inventory-related status messages on the site server
1. In the Configuration Manager console tree, navigate to Status Message

Queries.
2. In the Status Message Queries pane, select All Status Messages from a
Specific Component at a Specific Site.
3. In the Actions pane, click Show Messages.
4. In the All Status Messages from a Specific… dialog box, configure the
following options:
• Component: SMS_INVENTORY_DATA_LOADER
• Site: NYC
• Time: Last six hours
5. In the ConfigMgr Status Message Viewer for (NYC) (Central Site - New York
City) window, double-click the oldest message.
6. In the Status Message Details box, review the details and read the message in
the Description box. Notice the amount of detail provided.
7. Click Previous. The next message is displayed in the Status Message Details
box. Review the details and read the message in the Description box.
8. Repeat the previous step until all messages in the ConfigMgr Status Message
Viewer for (NYC) (Central Site - New York City) have displayed.
9. Close the Status Message Details box.
10. Close the ConfigMgr Status Message Viewer for (NYC) (Central Site - New York
City) window.

Lab A: Collecting Inventory
Lab Setup
2. Ensure that the 6451B-NYC-DC1-C, 6451B-NYC-CFG1-C, and 6451B-NYC-
CL1-C virtual machines are running.
• 6451B-NYC-DC1-C: Domain controller in the Contoso.com domain.
• 6451B-NYC-CFG1-C: Configuration Manager 2007 site server in the
Contoso.com domain
• 6451B-NYC-CL1-C: Windows® 7 client computer in the Contoso.com
domain

3. If required, connect to the 6451B-NYC-CFG1-C and 6451B-NYC-CL1-C

virtual machines.
• Log on to 6451B-NYC-CFG1-C as Contoso\Ed using the password
Pa$$w0rd.
• Log on to 6451B-NYC-CL1-C as Contoso\Andrea using the password
Pa$$w0rd.
Lab Scenario
You are a Configuration Manager administrator for Contoso, Ltd. You need to
configure the Hardware Inventory Client Agent to collect standard hardware
inventory information. You also need to modify the amount of information
collected during hardware inventory. As part of your duties, you also need to
configure software inventory and file collection.

Exercise 1: Configuring and Managing Hardware Inventory
Scenario
configure the Hardware Inventory Client Agent to collect standard hardware
inventory information.
1. Enable and configure the Hardware Inventory Client Agent.
2. Initiate a policy update on the client.
3. Initiate a Hardware Inventory Cycle on the client.
4. View hardware inventory using Resource Explorer.
Task 1: Enable and configure the Hardware Inventory Client Agent

• On NYC-CFG1, ensure that the Hardware Inventory Client Agent is enabled
and configured with the following settings:
• Custom Schedule: Weekly on Friday.
• MIF settings: Not enabled.
Task 2: Initiate a policy update on the client

1. On NYC-CL1, in Control Panel, start the Configuration Manager.
2. Initiate a Machine Policy Retrieval & Evaluation Cycle.
Note: Wait at least two minutes for the policy update to complete before moving to
the next step.

3 Close and reopen the Configuration Manager program.
Note: You must close and reopen the program to update the information displayed.
4. Verify that the ConfigMgr Inventory Agent is installed and enabled.
Task 3: Initiate a Hardware Inventory Cycle on the client

• On NYC-CL1, initiate a Hardware Inventory Cycle.
Note: Wait at least five minutes for the hardware inventory cycle to complete before
moving to the next step.
Task 4: View hardware inventory using Resource Explorer

1. On NYC-CFG1, in the Configuration Manager console, navigate to the All
Systems collection.
2. Right-click NYC-CL1, and then start the Resource Explorer.
3. View information related to the following:
• CD-ROM
• Desktop monitor
• IDE controller
• Workstation status
Results: At the end of this exercise, you will have verified that NYC-CL1 reported
hardware inventory by viewing the information in Resource Explorer.

Exercise 2: Modifying Hardware Inventory Collection
Scenario
modify the amount of information collected during hardware inventory.
1. Modify the Sms_def.mof file on the site server.
2. Verify that the hardware inventory changes were modified successfully.
Task 1: Modify the Sms_def.mof file on the site server

1. On NYC-CFG1, use Notepad to open Sms_def.mof, found at C:\Microsoft
Configuration Manager\inboxes\clifiles.src\hinv\.
2. Search for the first occurrence of the CD-ROM attribute.
3. Change the SMS_Report parameter for the CD_ROM group name to FALSE.
4. Repeat steps 2 and 3 for the Desktop Monitor and IDE Controller attributes.
Task 2: Verify that the hardware inventory changes were modified

successfully
1. On NYC-CFG1, use SMS Trace to view the Dataldr.log file found at
C:\Microsoft Configuration Manager\Logs\.
2. Search for all occurrences of Removing Dataitem.
3. On NYC-CL1, initiate the Machine Policy Retrieval & Evaluation Cycle.
the next step.
4. On NYC-CL1, initiate the Hardware Inventory Cycle.
Note: Wait at least five minutes for the hardware inventory cycle to complete
before moving to the next step.

5. On NYC-CFG1, under the All Systems collection, start the Resource Explorer
for NYC-CL1.
6. Expand Hardware, and notice that the CD-ROM, Desktop Monitor, and IDE
Controller classes are no longer visible.
7. Expand Hardware History. Notice that CDROM Drive History, Desktop
Monitor History, and IDE Controller History are listed.
Results: At the end of this exercise, you will have modified hardware inventory
collection, and verified the changes.

Exercise 3: Configuring and Managing Software Inventory
Scenario
configure software inventory and file collection.
1. Enable and configure the Software Inventory Client Agent.
3. Initiate the Software Inventory Cycle and File Collection Cycle on the client.
4. View software inventory using Resource Explorer.
Task 1: Enable and configure the Software Inventory Client Agent

• On NYC-CFG1, ensure that the Software Inventory Client Agent is enabled
• Custom Schedule: Recur every two weeks on Thursday
• Inventory Collection: *.exe found on the System drive and all
subdirectories
• File Collection:
• Name: ClientLocation.log
• Size: 1024KB

1. On NYC-CL1, in Control Panel, open Configuration Manager..
the next step.

Task 3: Initiate a Software Inventory Cycle and File Collection Cycle on
the client
1. Initiate a Software Inventory Cycle.
2. Initiate a File Collection Cycle.
Note: Wait at least five minutes for the Software Inventory Cycle and File Collection
Cycle to complete before moving to the next step.
Task 4: View software inventory using Resource Explorer

1. On NYC-CFG1, in the Configuration Manager console, navigate to and then
click the All Systems collection.
2. Right-click NYC-CL1, and then start the Resource Explorer.
3. View information related to the following:
• Collected files
• File details
Results: After this exercise, you should have viewed collected files and software

Lesson 5
Asset Intelligence
Asset Intelligence enhances the inventory capabilities of Configuration Manager

2007 by extending hardware and software inventory, and adding license
management functionality. A number of reports help to present the information in
clear and detailed formats.
• Describe Asset Intelligence information.
• Describe the Asset Intelligence catalog.
• Explain how to customize the Asset Intelligence catalog.
• Describe the prerequisites for Asset Intelligence.
• Explain how to configure Asset Intelligence data collection.
• Describe the Asset Intelligence management tasks.

Overview of Asset Intelligence
Key Points
Asset Intelligence enhances the inventory capabilities of Configuration Manager by
extending hardware inventory and adding license management functionality.
Additional hardware inventory WMI classes improve the breadth of information
gathered about hardware and software titles in use.
Some of the components of Asset Intelligence include:
• Asset Intelligence catalog. Asset Intelligence relies upon a set of tables that
contains software identification and categorization information, hardware
requirements for software titles, and processor information. Collectively, these
tables are known as the Asset Intelligence catalog. The Asset Intelligence
catalog tables are stored within the Configuration Manager site database.

• Asset Intelligence synchronization point. In Configuration Manager 2007 SP1
or later, Asset Intelligence supports custom editing of the Asset Intelligence

catalog. Additionally, customers can connect to Microsoft System Center
Online Services to update the Asset Intelligence catalog with the most current
information available. You can manually update the catalog by downloading
the latest information, or you can enable automatic updating by implementing
an Asset Intelligence synchronization point. Additionally, you can help update
the Microsoft System Center Online Services Asset Intelligence catalog by
using the Asset Intelligence synchronization point to upload your catalog
customizations to Microsoft.
• Asset Intelligence home page. The Asset Intelligence home page displays a
summary of Asset Intelligence information, including summaries of the Asset
Intelligence feature status, the Asset Intelligence catalog, and catalog
synchronization status.
• Asset Intelligence reports. More than 50 reports present Asset Intelligence
information in easy-to-use format. Many of these reports link to more specific
reports, which provide you with the ability to query for general information
and drill through to more detailed information.

Asset Intelligence Catalog
Key Points
The Asset Intelligence catalog is a set of database tables that contain information
for over 300,000 software titles and versions, representing nearly 100 families and
almost 2,000 specific categories. These database tables also record hardware
requirements for specific software titles, and cataloged CPU properties
information. The Configuration Manager site database contains the Asset
Intelligence tables.
In Configuration Manager 2007 SP1 and later, the Asset Intelligence catalog
includes the following:
• Support for manually importing software license information for software
titles—both Microsoft and non-Microsoft—in use
• A large collection of known CPU properties
• Hardware requirements for the software titles in the catalog

• Support for local editing of the catalog
• Support for uploading software title information to Microsoft System Center

Online Services for categorization
You can review contents of the Asset Intelligence catalog, and customize certain
elements of the Asset Intelligence node in the Configuration Manager console. The
Asset Intelligence node includes the following Asset Intelligence catalog nodes:
• Customize Catalog. The Customize Catalog node includes most of the catalog
segments that can be updated by administrators. The Customize Catalog node
includes the following:
• Software Categories
• Software Families
• Custom Labels
Note: You can modify and delete only the custom data you add to the Asset
Intelligence catalog. The pre-defined data in the catalog and updated data received
from Microsoft System Center Online Services are read-only.
• Inventoried Software Titles. The list of inventoried software titles includes

information about software reported by the Hardware Inventory Client Agent.
Note: Because inventoried software title information is obtained through client

hardware inventory reports, all information except for software category and
software family information is read-only, and cannot be modified.
• Processor Properties. The Processor Properties node contains a list of known

processors and their respective characteristics. The processors displayed in the
Configuration Manager console are retrieved from the Asset Intelligence
catalog. The list is not based on hardware inventory information from

Note: Processor property information is read-only and cannot be modified. You can
download additional CPU information from Microsoft System Center Online Services
during future catalog updates.
• Hardware requirements. You can use Asset Intelligence hardware

requirements to verify that computers meet the hardware requirements for
software titles before they are targeted for software deployments. The
hardware requirements displayed in the Configuration Manager console are
retrieved from the Asset Intelligence catalog; the list is not based on
inventoried software title information from Configuration Manager clients.
Custom hardware requirements for software titles not stored in the Asset
Intelligence catalog can be added, modified, or deleted. However, existing, non-
custom hardware requirement information stored in the Asset Intelligence catalog
is read-only and cannot be deleted.
Question: Which versions of Configuration Manager support updating and

customizing the Asset Intelligence catalog?

Customizing the Asset Intelligence Catalog
Key Points
You can customize your Asset Intelligence catalog by creating, renaming, and
deleting custom catalog information. You can add the following types of
information to the Asset Intelligence catalog:
• Software categories
• Software families
• Custom labels
• Hardware requirements
Pre-defined information in the Asset Intelligence catalog is read-only; it cannot be

modified or deleted. Updates to Asset Intelligence catalog information received
from Microsoft System Center Online Services are also read-only and cannot be
modified or deleted. However, administrators can modify and delete any custom
information added to the Asset Intelligence catalog.

Important: You can update the Asset Intelligence catalog only at the highest site in
the hierarchy for which you enable Asset Intelligence. Editing or creating new
objects for replicated Asset Intelligence catalog information at child sites is not
supported.

Prerequisites for Asset Intelligence
Key Points
Configuration Manager gathers Asset Intelligence information from a variety of
providers. Thus, you must configure different prerequisites depending on which
Asset Intelligence reports you want to use. Asset Intelligence has dependencies
within Configuration Manager in addition to external dependencies.
The prerequisites for Asset Intelligence include the following:
• Client agent prerequisites
• Hardware inventory file modification prerequisites
• Site maintenance task prerequisites
• Windows event log setting prerequisites

Client Agent Prerequisites
The Asset Intelligence reports depend on client inventory information reported by

the Hardware and Software Inventory Client Agents. If you want use all Asset
Intelligence reports, both agents must be enabled.
The following Asset Intelligence reports depend on the Software Metering Client
Agent to provide data:
• Software 07A - Recently Used Executables by Number of Computers
• Software 07B - Computers that Recently Used a Specified Executable
• Software 07C - Recently Used Executables on a Specific Computer
• Software 08A - Recently Used Executables by Number of Users
• Software 08B - Users that Recently Used a Specified Executable
• Software 08C - Recently Used Executables by a Specified User
Hardware Inventory File Modification Prerequisites

Some Asset Intelligence reports require that certain reporting classes be enabled in
the Sms_def.mof file on the site server computer. Other reports require that certain
data classes be enabled in the Configuration.mof file.
Site Maintenance Task Prerequisites

You can configure two site maintenance tasks associated with Asset Inventory CAL
information:
• Summarize Client Access License Weekly Usage Data
• Delete Aged Client Access License Data Properties
The Summarize Client Access License Weekly Usage Data task establishes
summaries of usage over time, and directly supports the Asset Intelligence license
management report, License 11A - Historical Client Access License (CAL)
Utilization.
The purpose of the Delete Aged Client Access License Data maintenance task is to
periodically delete aged CAL data from the site database that is no longer needed.
This task is not necessary for data collection, but you should enable it to prevent
unnecessary data accumulating in the site database.

Windows Event Log Setting Prerequisites
The following Asset Intelligence reports rely on collected Windows security event
log information:
• Hardware 3A - Primary Computer Users
• Hardware 3B - Computers for a Specific Primary Console User
• Hardware 4A - Shared (Multi-user) Computers
• Hardware 5A - Console Users on a Specific Computer
To enable the Hardware Inventory Client Agent to inventory the information

required to support these reports, you must modify the Windows security event
log settings on clients to log all Success logon events.
Question: Which Configuration Manager client agents must you enable if you
want to use all Asset Intelligence reports?

Configuring Asset Intelligence Data Collection
Key Points
Configuring Asset Intelligence consists of a number of tasks. These tasks include:
• Enabling Asset Intelligence. To enable Asset Intelligence in sites running
Configuration Manager 2007 SP1 and later, you can use the Asset Intelligence
Reporting Class Settings dialog box to enable the required hardware
inventory reporting classes that Asset Intelligence reports rely on.
• Enabling success logon event logging. To enable data to be collected for Asset
Intelligence console usage and client access license (CAL) reports, CAL data
collection must be enabled in the Configuration.mof file, and computer
security policy logon settings must be configured to enable auditing of success
logon events.
• Importing software license information. Use the License Import Wizard to
import Microsoft and non-Microsoft licensing information into the Asset
Intelligence catalog.

• Installing an Asset Intelligence synchronization point. The Asset Intelligence
Synchronization point site system role connects Configuration Manager 2007

SP1 and later sites to Microsoft System Center Online Services to synchronize
Asset Intelligence catalog information.
Note: In Configuration Manager 2007 SP1 sites, you must obtain an authentication
certificate (.pfx) file from Microsoft System Center Online Services before installing
this site role.
The Asset Intelligence synchronization point can only be installed on a site

system that is located in the central site of a Configuration Manager hierarchy.
The Asset Intelligence synchronization point also requires Internet access to
synchronize with Microsoft System Center Online Services using Transmission
Control Protocol (TCP) port 443.
• Connecting to Microsoft System Center Online Services. To connect to
Microsoft System Center Online Services, an Asset Intelligence
Synchronization point site system role must be installed. You must ensure that
the Asset Intelligence Synchronization Point has a connection to the Internet
before connecting to Microsoft System Center Online Services.
• Enabling Asset Intelligence synchronization. To perform scheduled Asset
Intelligence catalog synchronizations with Microsoft System Center Online
Services, the Asset Intelligence synchronization point must be enabled, and a
synchronization schedule must be specified on the Asset Intelligence
Synchronization Point Properties Schedule tab.
• Configuring Asset Intelligence object security. Asset managers need—as a
minimum—to have the View Asset Intelligence right for the Asset
Intelligence class. This right can be added to new or existing Configuration
Manager administrators in the Security Rights\Users node of the
Configuration Manager console.
Question: Once Asset Intelligence information has been reported, how would you
analyze the collected information?

Demonstration: Enabling Asset Intelligence Data Collection
Key Points
In this demonstration, you will see how to:
• Enable Asset Intelligence.
• Enable logon event success logging by using an Active Directory® domain
security policy.
• Import software license information into the Asset Intelligence catalog.
• Connect to Microsoft System Center Online Services.
• Install an Asset Intelligence synchronization point.
• Enable the Asset Intelligence synchronization point.
• Add a new Asset Intelligence asset manager.

Demonstration Steps
Enable Asset Intelligence
Note: This procedure requires Configuration Manager 2007 SP1 or later.
1. In the Configuration Manager console, navigate to Site Database (Site), click

Computer Management, and then click Asset Intelligence.
2. Right-click Asset Intelligence, and then click Enable Asset Intelligence.
3. In the Asset Intelligence Reporting Class Settings dialog box, either select
Enable all Asset Intelligence reporting classes, or select Enable only the
selected Asset Intelligence reporting classes. Select the specific classes that
you want to enable, and then click OK.
4. In the Asset Intelligence Reporting Class Settings Modification dialog box,
click Yes.
Note: Asset Intelligence reports that depend on the hardware inventory classes
enabled using this procedure will not display data until clients have performed
hardware inventory using the new hardware inventory reporting policy based.
Enable logon event success logging by using an Active Directory

domain security policy
1. On a domain controller computer, click Start, click All Programs, click
Administrative Tools, and click Domain Security Policy.
2. Navigate to Security Settings, click Local Policies, and then click Audit
Policy.
3. In the results pane, double-click Audit logon events, ensure that Define these
policy settings and Success are selected, and then click OK.

Import software license information into the Asset Intelligence catalog
1. In the Configuration Manager console, navigate to Site Database (Site),

expand Computer Management, and then select Asset Intelligence.
2. Right-click Asset Intelligence, and then click License Import Wizard.
3. On the Welcome page of the License Import Wizard, click Next.
4. On the Import page, click Browse to specify the location of a valid XML–
formatted or CSV–formatted licensing information file stored on a standard
network shared folder.
Note: The shared folder should be properly secured to prevent unauthorized access
to the licensing information file. Also, the computer account of the computer that
the wizard is being run on must have full control permissions to the share containing
the license import file.
5. On the Summary page, review the information you have specified to ensure
that it is correct, and then click Next.
6. After the file has been imported, click Close.
Connect to Microsoft System Center Online Services

2. Right-click Asset Intelligence, and then click Connect to Microsoft System
Center Online Services.
Note: The remaining steps require Internet access. You cannot complete these steps
from the classroom virtual machines.
3. On the Microsoft System Center Online Services home page, click the
Microsoft Volume Licensing Service (MVLS) Web site link.
4. Log in to the Web site and complete the necessary requirements to obtain a
Microsoft System Center Online Services authentication certificate.

5. Save the Microsoft System Center Online Services authentication certificate
(.pfx) file in a network share location. Security should be configured on the

network share location so that the certificate is accessible only by the account
that will be used to import the certificate when installing the Asset Intelligence
synchronization point site system role from within the Configuration Manager
console.
Install an Asset Intelligence synchronization point

expand Site Management, expand Site, expand Site Settings, and expand Site
Systems.
2. Right-click the site server name, and click New Roles to start the New Site Role
Wizard.
Note: If the Configuration Manager console Actions pane is displayed, you can also
start the New Site Role Wizard by clicking New Roles in the Actions pane.
3. In the New Site Role Wizard, on the General page, verify the existing site
server settings, and then click Next.
4. On the System Role Selection, select Asset Intelligence Synchronization
Point, and then click Next.
5. On the Asset Intelligence Synchronization Point Connection Settings page,
specify the path to the Microsoft System Center Online Services authentication
certificate (.pfx) file, and then click Next. This step is not necessary for
Configuration Manager 2007 SP2 and later sites, because the connection
certificate is automatically provisioned during site role installation.
6. On the Proxy Server Settings page, configure any necessary proxy server
settings, and then click Next.
Note: Because Microsoft System Center Online Services accepts network traffic only
over TCP port 443, the port settings cannot be configured on this page of the
wizard.

7. On the Asset Intelligence Synchronization Point Schedule page, specify
whether or not to enable synchronization on a schedule. If you select to enable

scheduled Asset Intelligence catalog synchronization with Microsoft System
Center Online Services, you can also specify a simple or custom
synchronization schedule. Click Next.
8. On the Summary page, review the settings you have specified to ensure they
are correct before continuing, and then click Next.
9. After the wizard completes the role configuration, click Close.
Enable the Asset Intelligence synchronization point

2. Right-click Asset Intelligence, and then click Schedule Catalog
Synchronization.
3. On the Asset Intelligence Synchronization Point Schedule page, select the
Enable synchronization on a schedule option to enable the Asset Intelligence
Synchronization point. After enabling the Asset Intelligence Synchronization
point, you can also specify a simple or custom synchronization schedule for
the site system to synchronize the Asset Intelligence catalog with Microsoft
System Center Online Services.
4. Click OK.
Add a new Asset Intelligence asset manager

expand Security Rights, and then expand Users.
2. Right-click Users, and then click Manage ConfigMgr Users.
3. In the ConfigMgr User Wizard, on the Welcome page, click Next.
4. On the User Name page, select the Add new user option, and either type the
domain login information for the asset manager, or click Browse and then use
the Select User, Computer, or Group dialog box to find the domain logon
information for the asset manager.
5. On the User Rights page, select Add another right or modify an existing
one, and then click Next.

6. On the Add Right page, select Asset Intelligence from the Class drop-down
list, select the Manage Asset Intelligence option in the Rights box, and then
click Next.
7. On the User Rights page, click Next.
8. On the Summary page, click Next.
9. After the wizard has finished applying the new rights, click Close.

Managing Asset Intelligence
Key Points
Maintaining and managing Asset Intelligence involves a number of tasks,
including:
• Viewing Asset Intelligence information that is collected from clients. You can
run Asset Intelligence reports to view the most detailed information collected
by the Asset Intelligence feature. The types of Asset Intelligence reports are
described in the following table.
Type of Asset
Intelligence report Description
Hardware reports Provide information about hardware assets within your
organization, including age and upgrade readiness.
License management Provide information about licensing, including number

reports of licenses in use, sales channel, and time until
expiration.

Type of Asset
Intelligence report Description

Software reports Provide information about software families, categories,
and specific software titles installed on computers
within your organization.
• Updating the Asset Intelligence catalog. If you do not want to schedule

automatic synchronization of the Asset Intelligence catalog, you can manually
request catalog synchronization with Microsoft System Center Online Services.
Additionally, you can manually update the Asset Intelligence catalog by
downloading and installing the latest catalog update.
• Requesting software categorization. You can submit uncategorized software
title information for research and categorization. After a customer submits an
uncategorized software title, researchers identify, categorize, and then make
the software title categorization information available to all customers using
Microsoft System Center Online Services.
• Resolving software details conflicts. If an Asset Intelligence catalog
categorization value conflicts with information downloaded from Microsoft
System Center Online Services, a software details conflict occurs. You can use
the Asset Intelligence Software Details Conflict Resolution dialog box to
select a conflict resolution action.
Question: How can you update the Asset Intelligence catalog if your site systems
are connected to a highly secure network that does not have Internet access?

Demonstration: Using Asset Intelligence Reports
Key Points
In this demonstration, you will see how to run Asset Intelligence reports.
Demonstration Steps:
Run Asset Intelligence reports

1. In the Configuration Manager console, expand Site Database (Site), expand
Computer Management, expand Asset Intelligence, and select Asset
Intelligence Reports.
2. In the details pane, right-click the report you want to run, and then click Run.
3. If the Report Options dialog box appears, select the reporting point that you
want to use, and select whether you want to open the report viewer in a new
Windows Internet Explorer® window.

Lab B: Using Asset Intelligence
Lab Setup
Contoso.com domain
• 6451B-NYC-CL1-C: Windows 7 client computer in the Contoso.com
domain

virtual machines.
• Log on to NYC-DC1 as Contoso\Administrator using the password
Pa$$w0rd.
• Log on to NYC-CFG1 as Contoso\Ed using the password Pa$$w0rd.
• Log on to NYC-CL1 as Contoso\Andrea using the password Pa$$w0rd.
Lab Scenario
You are implementing Asset Intelligence in Contoso, Ltd’s Configuration Manager
site. You need to configure all prerequisites, and configure the polling interval for
Client Access License information. You also need to configure Asset Intelligence
data collection, implement an Asset Intelligence synchronization point, and
configure Asset Intelligence catalog synchronization. You need to customize the
Asset Intelligence catalog, import license data, and test Asset Intelligence data
reporting by initiating an inventory cycle on a client. Finally, you need to review
the Asset Intelligence information reported by the client.

Exercise 1: Configuring Asset Intelligence Prerequisites
Scenario
You are implementing Asset Intelligence in Contoso, Ltd’s Configuration Manager
site. You need to configure all prerequisites for Asset Intelligence. For testing
purposes, you also want to configure a very short polling for Client Access License
information.
1. Verify that Hardware and Software Inventory Client Agents are enabled.
2. Modify the Configuration.mof file on the site server.
3. Configure the Asset Intelligence site maintenance tasks.
4. Configure Windows event log settings.
Task 1: Verify that Hardware and Software Inventory Client Agents are
enabled
• On NYC-CFG1, verify that the Hardware Inventory Client Agent and
Software Inventory Client Agent are enabled.
Task 2: Modify the Configuration.mof file on the site server

1. On NYC-CFG1, open in Notepad the Configuration.mof file located at
C:\Microsoft Configuration Manager\inboxes\clifiles.src\hinv\.
2. Locate the CCM_CALTrackConfig section.
3. Edit the settings in CCM_CALTrackConfig section by using the following
settings:
• CALCollectionType = 3
• CALCollectionFrequencyDays = 0
• CALCollectionFrequencyMinutes = 5
4. Save the file and exit Notepad.

Task 3: Configure the Asset Intelligence site maintenance tasks
1. On NYC-CFG1, configure the Summarize Client Access License Weekly

Usage Data task using the following settings:
• Enabled
• Schedule:
• Start after: 10:00 AM
• Latest start time: 10:30 AM
• Days: Tuesday
2. Configure the Delete Aged Client Access License Data task. Use the following
values:
• Enabled
• Days: Saturday, Sunday
Task 4: Configure Windows event Log settings

1. On NYC-DC1, modify the Default Domain Policy by using the following
settings:
• Policy location: Computer Configuration\Policies\Windows
Settings\Security Settings\Local Policies\Audit Policy
• Policy: Audit logon events
• Define these policy settings: Enabled
• Audit these attempts: Success
2. On NYC-CL1, run GPUpdate /force at an elevated command prompt.
Results: At the end of this exercise, you will have configured the prerequisites for
Asset Intelligence.

Exercise 2: Configuring Asset Intelligence
Scenario
You are testing Asset Intelligence. You have configured all prerequisites. You need
to configure Asset Intelligence data collection and Asset Intelligence catalog
synchronization.
1. Enable Asset Intelligence data collection.
2. Configure an Asset Intelligence synchronization point.
3. Configure an Asset Intelligence catalog synchronization schedule.
Task 1: Enable Asset Intelligence data collection

• On NYC-CFG1, in the Configuration Manager console, right-click Asset
Intelligence, and enable Asset Intelligence.
• Enable all Asset Intelligence reporting classes
Task 2: Configure an Asset Intelligence synchronization point

• On NYC-CFG1, add a new site system role. Use the following values:
• Role: Asset Intelligence synchronization point
• Synchronization schedule: None

Task 3: Configure an Asset Intelligence catalog synchronization
schedule
1. On NYC-CFG1, right-click the Asset Intelligence node, and select Schedule
Catalog Synchronization.
2. Configure the following schedule:
• Schedule: Custom
• Date: June 1, 2010
• Time: 1:00 PM
• Recurrence: Custom interval
• Recur every: 1 Days
Results: After this exercise, you should have enabled Asset Intelligence, configured
an Asset Intelligence synchronization point, and scheduled synchronization.

Exercise 3: Customizing Asset Intelligence
Scenario
You are testing Asset Intelligence. You have configured Asset Intelligence data
collection. You need to customize the Asset Intelligence catalog, import license
data, and initiate Asset Intelligence data reporting by initiating an inventory cycle
on a test client.
1. Customize the Asset Intelligence catalog.
2. Import licensing data.
4. Initiate a Hardware Inventory Cycle on the client.
5. Initiate a Software Inventory Cycle on the client.
Task 1: Customize the Asset Intelligence catalog

1. Create a new software category.
• Category name: Contoso developed
• Description: Software developed in-house by Contoso
2. Create a new software family.
• Family name: Custom Software
• Description: Special-use, custom application software
3. Create a new custom label.
• Label name: Unsupported
• Description: Software not supported by Contoso IT
Task 2: Import licensing data

• Import a custom license information file.
• File name: \\NYC-CFG1\Labfiles\Licenses\LicenseData.csv

1. On NYC-CL1, in Control Panel, open Configuration Manager.

the next step.

• On NYC-CL1, initiate a Hardware Inventory Cycle.
Task 5: Initiate a Software Inventory Cycle on the client

• On NYC-CL1, initiate a Software Inventory Cycle.
Note: Be sure to wait several minutes before proceeding to the next exercise.
Results: After this exercise, you should have customized the Asset Intelligence
catalog, imported licensing information, and initiated inventory reporting on a
client.

Exercise 4: Viewing Asset Intelligence Reports
Scenario
You are testing Asset Intelligence. You have configured Asset Intelligence and
initiated Asset Intelligence data reporting. You need to review the data collected.
1. Review reported Asset Intelligence information in the Configuration Manger
console
2. Run Asset Intelligence reports
Task 1: Review reported Asset Intelligence information in the

Configuration Manager console
• Review the data reported in the following Asset Intelligence nodes in the
Configuration Manger console:
• Unidentified and Not Pending Online Identification
• Inventoried Software Titles
Task 2: Run Asset Intelligence reports

1. Run the Hardware 03A - Primary computer users report by using the
following parameter:
• Collection: All Systems
2. Run the License 15A - General License Reconciliation Report by using the
following parameter:

3. Run the Software 01A - Summary of installed software in a specific
collection report by using the following parameter:

• Number of rows to return: 100
• Publisher: (none)
Results: After this exercise, you should have reviewed Asset Inventory data both in
the Configuration Manager console, and by using reports.

Lesson 6
Metering Software Usage
Software metering provides the ability to monitor and collect software usage data
on clients assigned to a Configuration Manager site. You can use this data to
determine how your organization uses programs. This lesson describes software
metering, and how you can configure software metering rules to begin monitoring
your environment’s software usage.
• Describe software metering.
• Describe the software metering functionality.
• Describe the process for configuring and enabling software metering.
• Describe software metering maintenance tasks.

What Is Software Metering?
Key Points
Software metering allows you to monitor program usage on Configuration
Manager client computers. Software metering data can be summarized to produce
useful reports that can help you plan your organization’s software purchases.
Software metering can collect the following detailed information:
Collected information Description

Program usage Program usage information includes values such as:
information • Start time
• End time
• Meter data ID
• Resource ID
• User name
• Users of Terminal Services sessions
• Whether it is still running

Collected information Description
File information File information includes the following:

• File ID
• File name
• File version
• File description
• File size (in KB)
Program information Program information includes the following:

• Company name
• Product name
• Product version
• Product language
Question: Which types of applications would you want to meter in your

organization?
Question: Describe various scenarios where software metering can help determine
software usage.

How Software Metering Works
Key Points
Software metering uses two main components to perform data collection tasks: the
Software Metering Client Agent, and software metering rules. When enabled, the
Software Metering Client Agent reports software metering data based on the site’s
software metering rules. You must configure software metering rules before
program usage data collection starts.
Note: By default, the Software Metering Client Agent is enabled during

Configuration Manager 2007 installation, and is configured to send software
metering data to the management point every seven days. However, there are no
default rules configured.

The software metering process occurs as follows:
1. The Software Metering Client Agent examines each program running on the
client and determines if the program file’s header information matches a
specified software metering rule that the administrator configures. The agent
collects usage data each time a monitored program runs on the client,
regardless of whether the client is connected to the network.
2. The agent uploads the data to the management point on its next Software
Metering Usage Report Cycle. If the client is not connected to the network, the
data remains on the client and is uploaded to the site the next time the client
connects to the network.
3. The management point forwards the data to the site server.
4. The site server adds the data to the site database.
You can use Client Spy to review the software metering rules that the client has
received from the management point in policy.
Question: Which two components do you need to configure for software metering
to function?
Question: How does software metering work for portable computers that are often
not connected to the network?

Configuring Software Metering
Key Points
You can configure three elements of software metering: the Software Metering
Client Agent, software metering rules, and automatic generation of software
metering rules.
Configuring the Software Metering Client Agent

When enabled, the Software Metering Client Agent collects usage data for
programs specified in software metering rules. If the agent was not enabled during
installation of Configuration Manager 2007 (typically, the agent is enabled, by
default), or if the agent has been disabled, you can enable the agent in the
Configuration Manager console. You can also customize the software metering
data reporting schedule used by the agent. The New Software Metering Rule
Wizard leads you through the process of creating a new software metering rule for
your Configuration Manager 2007 site.

Configuring Software Metering Rules
After ensuring that the Software Metering Client Agent is enabled, the next step is
to configure software metering rules. You must create and configure software
metering rules to specify the applications that you want the Software Metering
Client Agent to monitor.
Automatic Software Metering Rules

Configuration Manager 2007 provides the ability to generate software metering
rules automatically based on recent usage inventory data. If Configuration Manager
automatically generates a software metering rule, that rule will be disabled. You
must enable that rule if you want to clients to report usage of the software specified
in the automatically-generated rule. Additionally, you might want to disable a
software metering rule while still keeping the rule for later use.
To enable or disable a software metering rule:
Computer Management, and select Software Metering.
2. Right-click one or more software metering rules, and then click Enable or
Disable.
Question: How can you ensure that programs are being monitored even if the file
name has changed?

Demonstration: Configuring Software Metering
In this demonstration, you will see how to configure the Software Metering Client
Agent. You will also see how to configure a software metering rule, and how to
configure automatic software metering rule generation.
Demonstration Steps:
Configure the Software Metering Client Agent

Site Management, expand Site, expand Site Settings, and select Client
Agents.
2. Right-click Software Metering Client Agent, and then click Properties.
3. On the General tab, select Enable software metering on clients.
4. On the Schedule tab, click Schedule.
5. On the Custom Schedule page, configure a schedule for uploading software
metering data to the management point.

6. Click OK to close the Custom Schedule page.
7. Click OK to close the Software Metering Client Agent Properties page.
Configure a software metering rule

2. Right-click Software Metering, point to New, and then click Software
Metering Rule.
3. On the General page, provide the following information:
• Name. Type the rule name to display in the Configuration Manager
console.
• File name. Specify the name of the executable file you want to meter. To
ensure you configure the correct file, click Browse to display the Open
dialog box, and then select the executable file. This is the recommended
option, although you can type the file name into the box.
• Original file name. Specify the name of the executable file you want to
meter.
Note: Wildcard characters are not permitted in either the File name or Original file
name fields.
• Version. Specify the version of the executable file that you want to meter.
You can use the wildcard character (*) to represent any string of
characters or the wildcard character (?) to represent any single character.
If you want to meter for all versions of an executable file, use the default
value (*).
• Language. Specify the language of the executable file to meter. The default
value is English (United States).
• Site code. Specify the site code to which the software metering rule will
apply.
• Apply the rule to child sites, if applicable.
4. Click the Finish button.

Configure automatic software metering rule generation

2. Right-click the Software Metering node, and then click Properties.
3. In the General tab of the Software Metering Properties dialog box, specify
the following, and then click OK:
• Enable the option to Auto-create disabled metering rules from recent
usage inventory data.
• Specify the percentage of computers in a Configuration Manager 2007 site
that must use a particular executable before a software metering rule for
that executable is automatically created. The default value is 10 percent.
• Specify the number of rules after which no new software metering rules
will be automatically created. The default value is 100 rules.
Question: What is the default percentage that must be reached before rules are
auto-created?
Question: Which component configuration should you modify in order to

configure clients to report software metering usage data more frequently?

Software Metering Maintenance Tasks
Key Points
Configuration Manager 2007 includes a number of maintenance tasks to help you
manage the usage data collected by software metering. These tasks are responsible
for summarizing software metering data and deleting aged software metering data.
Summarize Software Metering Tasks

The summarize software metering tasks perform the data summarization to
compress the amount of data in the Configuration Manager 2007 site database.
Data summarization runs daily, and runs only against usage data that is older than
12 hours. Data summarization is required for all Configuration Manager 2007
software metering reports to display meaningful data. Software metering reports
will display the message No matching records could be found if they are run
before software metering data is summarized.

Note: You can use the RunMeterSumm.exe tool to initiate an off-cycle

summarization of software metering data. The RunMeterSumm.exe tool is located in
the installation media Tools folder.
You should know when summarization last occurred in order to understand what
data is contained in the most current set of summary data. You can refer to the
Software metering summarization progress report in Configuration Manager to
determine when summarization last occurred.
• Summarize Software Metering File Usage Data. The Summarize Software
Metering File Usage Data task condenses software metering file usage data
from multiple records into one general record. This record provides
information about the program name, version, language, and number of
distinct users over intervals of 15 minutes and one hour. This process
compresses and optimizes the amount of data stored in the Configuration
Manager 2007 site database.
• Summarize Software Metering Monthly Usage Data. The Summarize Software
Metering Monthly Usage Data task condenses detailed software metering
usage data from multiple records into one general record. This record provides
information about the program name, program version and language, program
running times, number of usages, last usage, user name, and computer name.
Data summarization helps compress the amount of data in the Configuration
Manager 2007 site database. Monthly software usage data is sent to the central
site.
The summarization information includes the number of times each matching
software program ran on a particular computer and by a particular user during
the month. By default, the task is scheduled to run daily, and the
summarization period is one month. Software monthly usage data is replicated
to the parent site.

Delete Software Metering Data Tasks
The following maintenance tasks remove old software metering data and
summarized data from the Configuration Manager 2007 site database:
• Delete Aged Software Metering Data. The Delete Aged Software Metering Data
task deletes all summarized software metering data that is older than the
number of days specified.
By default, the task is scheduled to run every day, and to delete software
metering data that is older than five days. You can configure the number of
days to be any number from 2 through 255.
• Delete Aged Software Metering Summary Data. The Delete Aged Software
Metering Summary Data task deletes summarized software metering summary
data that is older than the number of days specified.
By default, the task is scheduled to run every Sunday, and to delete software
metering summary data that is older than 270 days.
Question: How can summarization help maintain the size of the Configuration
Manager site database?

Lab C: Configuring Software Metering
Lab Setup
Contoso.com domain
• 6451B-NYC-CL1-C: Windows 7 client computer in the Contoso.com
domain

virtual machines.
• Log on to NYC-CFG1 as Contoso\Ed using the password Pa$$w0rd.
• Log on to NYC-CL1 as Contoso\Andrea using the password Pa$$w0rd.
Lab Scenario
You are a Configuration Manager administrator for Contoso, Ltd. You are
implementing software metering within Contoso’s Configuration Manager site. You
need to test the feature with common, built-in applications.

Exercise: Configuring Software Metering
Scenario:
You need to implement software metering and test it with common, built-in
applications. You have decided to meter Windows Calculator and Notepad to
complete the test.
1. Enable and configure the Software Metering Client Agent.
2. Create a software metering rule to meter Windows Calculator.
3. Configure software metering rule auto-creation.
5. Create test data on the client.
6. Initiate a usage report on the client.
7. Verify software metering on the client.
8. Initiate metering summarization.
9. View a software metering report.
Task 1: Enable and configure the Software Metering Client Agent

• On NYC-CFG1, ensure that the Software Metering Client Agent is enabled
• Schedule: Every 3 days.
Task 2: Create a software metering rule to meter Windows Calculator

1. In the Configuration Manager console, under Computer Management, click
Software Metering.
2. Create a new software metering rule with the following settings:
• Name: CalcRule
• File name: Click Browse, and then browse to
C:\Windows\system32\Calc.exe.

• Version: * (wildcard character)
• Language: – Any –
Task 3: Configure software metering rule auto-creation

1. Right-click Software Metering, and then click Properties.
2. Configure the following auto-creation settings:
• Auto-create disabled metering rules from recent usage inventory data:
Enabled
• Percent: 5
• Rules threshold: 25

3. Verify that the ConfigMgr Software Metering Agent is installed and enabled.
the next step.
Task 5: Create test data on the client

• On NYC-CL1, start the Calculator and Notepad several times. This will
generate test metering data in the log files.

Task 6: Initiate a usage report on the client
1. On NYC-CL1, in Control Panel, open the Configuration Manager program.

2. Initiate a Software Metering Usage Report Cycle.
Note: Wait at least two minutes for the cycle to complete before moving to the next
step.
Task 7: Verify software metering on the client

1. On NYC-CL1, browse to C:\Windows\system32\CCM\logs\, and then
double-click mtrmgr.log. Maximize the SMS Trace window.
2. Search for metering events related to calc.exe and notepad.exe.
Task 8: Initiate metering data summarization

1. On NYC-CFG1, open a command prompt.
2. Change directory to C:\Microsoft Configuration Manager\bin\i386.
3. Run the following command:
E:\Labfiles\ConfigMgrSP2\Tools\RUNMETERSUUMM.EXE SMS_NYC.
Note: The RunMeterSumm tool must be run as specified in this task. It must be run
from the directory specified. The database name parameter is case sensitive.
Task 9: View a software metering report

1. On NYC-CFG1, in the console tree, browse to the Reporting node.
2. Under Reports, sort the view by Category.
3. Take note of all of the reports related to software metering.

4. Run the Computers that have run a specific metered software program
report, and view the results. Use the following information to run the report:
• Rule: CalcRule
• Month: <current month>
• Year: <current year>
Results: After this exercise, you should have viewed software metering information
by using a report.

1. On the host computer, start Microsoft Hyper-V™ Manager.
click Revert.
4. In the Virtual Machines pane, click 6451B-NYC-DC1-D, and then in the
DC1-D, and then in the Actions pane, click Connect.
Important: Start the 6451B-NYC-DC1-D virtual machine first, and ensure that it is
fully started before starting the other virtual machines.
6. Wait for NYC-DC1 to start, and then start 6451B-NYC-CFG1-D. Connect to

7. Wait for NYC-CFG1 to start, and then start 6451B-NYC-CL1-D. Connect to the
virtual machine.

Review Questions
1. How can hardware and software inventory assist in software distribution?
2. A user in your organization is having intermittent problems with their desktop

computer. How can you use hardware and software inventory to troubleshoot
the problem?
3. How does inventory data pass from a client to the central site server?
4. A department in your organization has deployed a user application with

expensive per-user licenses. How can you use software inventory and software
metering to help ensure that your organization is getting the most value from
this application?

5. In what situation would you modify each of the following inventory files?
• Sms_def.mof
• Configuration.mof
6. You have enabled software metering and have just deployed a new application
throughout your network. By default, how long will it take before an automatic
disabled software metering rule is created?
Common Issues Related to Inventory, Metering, and Asset Intelligence

1. When the Software Inventory Client Agent begins an inventory cycle, it first
determines whether enough resources are available. If resources are limited,
the agent might skip file collection or not run at all. The client must have the
following minimum resources for the Software Inventory Agent to complete an
inventory cycle successfully:
• 3 MB of free virtual memory
• 500 KB of free disk space
• Hard disk storage capacity of 210 percent of all the files that are to be
collected, because the agent makes a copy of each file it collects.
2. When performing hardware inventory, the Hardware Inventory Client Agent
retrieves information about installed computer hardware by reading WMI data
classes. If specific data classes do not exist on a particular client (such as the
case between Windows XP and Windows Vista® clients), no status messages
are sent to the site server. To determine whether a client is attempting to
inventory a nonexistent WMI data class, you can review the client’s
InventoryAgent.log file for information specifying non-existent classes.

3. It is possible that CAL data will not be collected on some servers in the
following circumstances:
• The server site code is different than the current site code. This scenario
assumes that the client is roaming. In this situation, data actually is
collected; however, it is not reported to the site until the client can access
the management point for its assigned site.
• The server does not have the Configuration Manager client installed.
• The Asset Intelligence data collection cycle has not yet inventoried the
server.
4. CAL data collection depends on IP addresses to identify devices. Consider the
following situations related to CAL inventory:
• A computer that has more than one Network Interface Card (NIC) will be
counted as one device CAL for each IP address. This potentially can result
in an increased CAL count.
• A computer that has changed IP addresses can be counted as one device
CAL for each IP address. This potentially can result in an increased CAL
count.
• When a computer has been assigned an IP address that was previously
assigned to another computer, the two computers may be counted as a
single CAL. This potentially can result in a decreased CAL count.
• Multiple computers that access servers using a single IP address because
of Network Address Translation (NAT) will be counted as a single CAL.
This potentially can result in a decreased CAL count.
• In general, any situation that increases or decreases the number of IP
addresses associated with one or more computers will influence the count
of CALs represented in the CAL usage reports.

Tools

Hardware • Enabling/disabling • Click Start, click Microsoft
Inventory Client hardware inventory, and System Center, click
Agent for configuring when Configuration Manager 2007,
hardware inventory runs. and then click ConfigMgr
• Configuring MIF collection. Console.
• Browse to Site Management,
click Site, click Site Settings,
and then click Client Agents.
Software • Enabling/disabling • Click Start, click Microsoft

Inventory Client software inventory, and for System Center, click
Agent configuring when software Configuration Manager 2007,
inventory and file and then click ConfigMgr
collection runs. Console.
• Configuring inventory • Browse to Site Management,
collection and file click Site, click Site Settings,
collection rules. and then click Client Agents.
• Specifying inventory
names.
Software • Enabling/disabling • Click Start, click Microsoft

Metering Client software metering, and for System Center, click
Agent setting the data collection Configuration Manager 2007,
schedule. and then click ConfigMgr
Console.
• Browse to Site Management,
click Site, click Site Settings,
and then click Client Agents.
Querying and Reporting Data 5-1

Module 5
Querying and Reporting Data
Contents:
Lesson 1: Introduction to Data and Status Message Queries 5-4
Lesson 2: Managing Queries 5-11
Lab A: Creating Queries 5-20
Lesson 3: Configuring and Deploying a Reporting Point 5-28
Lab B: Creating a Reporting Point 5-39
Lesson 4: Managing Reports 5-44
Lab C: Managing Reports 5-59
Lesson 5: Creating and Using Dashboards 5-67
Lab D: Working with Dashboards 5-74
Lesson 6: SQL Reporting Services in Configuration Manager 2007 R2 5-77
Lab E: Using SQL Reporting Services 5-92
Lesson 7: Client Status Reporting in Configuration Manager 2007 R2 5-98
Lab F: Installing and Using Client Status Reporting 5-114

Module Overview
You can create and run queries to locate objects in a Microsoft® System Center
Configuration Manager 2007 site database. Queries are most useful for extracting
information related to resource discovery, inventory data, and status messages. In
addition to queries, you can use reports to easily organize and display information
about the computers that System Center Configuration Manager manages.
Configuration Manager 2007 R2 and above supports SQL Reporting Services, and
Configuration Manager 2007 R2 introduced the Client Status Reporting tool.
• Describe data and status message queries.
• Manage queries.
• Configure and deploy a reporting point.

• Manage reports.
• Create and use dashboards.

• Install and use SQL Reporting Services in Configuration Manager 2007 R2.
• Use client status reporting in Configuration Manager 2007 R2.

Lesson 1
Introduction to Data and Status Message

Queries
A Configuration Manager query consists of a specific set of instructions that extract

information about a defined set of site database objects. By running a query, you
search the database for information about the objects that match the query criteria.
• Describe queries.
• Describe Configuration Manager attributes and object types.
• Describe required query elements.
• Describe optional query elements.
• Discuss how to design queries.

What Is a Query?
Key Points
You can create and run queries to locate objects in a Configuration Manager 2007
site that match your query criteria. These objects include items such as specific
types of computers or user groups. Queries return most types of Configuration
Manager objects, including sites, collections, packages, and saved queries
themselves. However, queries are most useful for extracting information related to
resource discovery, inventory data, and status messages. In general, the primary
purpose of data queries is to build collections, and the primary purpose of status
message queries is to locate stored status messages.
Question: What can you find using queries in Configuration Manager 2007?

Configuration Manager Attributes and Object Types
Key Points
When you create a Configuration Manager query, you are searching the site
database for the set of database objects that match one or more attributes of a
Configuration Manager database object type. An object type is defined by a set of
attributes that represents the properties of that database object, such as a client, a
package, an advertisement, or a user group. All objects of a specific type—such as
clients, packages, or users—are labeled and grouped together. Each object type has
one or more attributes that describe the object. For example, clients have
processor-type attributes, but user groups do not.

Queries search against only one object type at a time. By default, Configuration
Manager queries the System Resource object type. The following object types are
also available for queries.
Object type Description
Advertisement A single attribute class with attributes representing the data

in a Configuration Manager advertisement.
Software Metering Rules A single attribute class with attributes representing the data
in a Configuration Manager software metering rule.
Package A single attribute class with attributes representing the data

in a Configuration Manager package.
Program A single attribute class with attributes representing the data

in a Configuration Manager program.
Site A single attribute class with attributes representing a

Configuration Manager site.
System Resource Many attribute classes that together characterize the

discovery data and inventory data of a system resource.
Discovery data is characterized by a single attribute class
called System, and the inventory data is characterized by
the other classes of the System Resource object type—for
example, Logical Disk.
User Resource A single attribute class representing the discovery data for
User objects. This object type represents users in a
Configuration Manager site hierarchy.
User Group Resource A single attribute class representing the discovery data for
User Group objects.
When you create a query you are only required to specify the object type for your
query. Configuration Manager returns all attributes classes and attributes. If you
want to limit the attributes returned, click the Edit Query Statement button, and
then configure the General tab of the Query Statement Properties dialog box.
You can then specify the attribute classes and attributes for your query. You can
modify the Query Statement Properties dialog box either during the creation of
the query, or afterwards.
Question: What is the relationship between object types and attributes?


Required Query Elements
Key Points
Configuration Manager 2007 queries are composed of several different elements
that make up the query criteria. The complexity of the query depends on which
elements are used and how they are applied. There are certain elements that all
queries require.
To create a valid query, you must include the following elements:
• A unique query name that identifies the query
• Object type
• Attributes class
• Attribute
Use the General tab in the Query Properties dialog box and the General tab in
the Query Statement Properties dialog box to add these elements.

Optional Query Elements
Key Points
Configuration Manager may return a large number of objects when you create a
query with only the required elements. To refine your query results, you can use
the optional query elements available on the Criteria tab and the Joins tab in the
Query Statement Properties dialog box to add the following elements:
• Criterion types
• Logical operators
• Group parentheses
• Attribute class join
Question: When creating a query to discover all the Windows® 7 computers with a
CD burner and a specific video card, would you need to create any attribute class
joins?

Discussion: Designing Queries
Key Points
Discuss the following issues.
Question: Which Configuration Manager object type provides information about

CPUs?
Question: Which Configuration Manager object types can you query?


Lesson 2
Managing Queries
Configuration Manager provides many predefined queries that you can use or
modify to help make administrative decisions. You also can create your own
queries. While Data queries and Status Message queries are similar in many
regards, they provide different types of data and retrieve information from different
tables in the Configuration Manager database. This lesson provides an overview of
the administrative tasks available for managing Configuration Manager queries.
• Create and use data queries.
• Create and use Status Message queries.
• Create queries.
• Run queries.

Managing Data Queries
Key Points
In the Configuration Manager console, manage data queries by expanding System
Center Configuration Manager, expanding Site Database, expanding Computer
Management, and then expanding Queries. You can create new queries or folders,
export or import queries, and select an individual query to modify or delete.
Creating Data Queries

If you are unfamiliar with creating Configuration Manager queries, we recommend
that you use an existing query as the basis for a new query. If you want to use an
existing query as the basis for a new query, in the Query Properties dialog box,
click Import Query Statement to locate and select the existing query. The new
query will inherit the properties of the existing query, which you can then modify.

You create and edit query statements by:
• Using the General, Criteria, and Joins tabs located in the Query Statements
Properties dialog box when you select the Show Query Design view.
• Typing a WMI query language (WQL) query statement into the Query
Statement box, which is located in the Query Statements Properties dialog
box when you select the Show Query Language view.
Modifying and Deleting Queries

You can modify an existing query by opening the Query Properties dialog box.
From this point, the process is the same as creating a new query.
Deleting a query does not remove the objects returned by the query.
Exporting and Importing Queries

From the Queries node, you can use the Export Objects Wizard to export one or
multiple queries. Additionally, you can select an individual query and use the
Export Objects query. Exported queries are stored in a Managed Object Format
(MOF) file.
From the Queries node, you can also use the Import Objects Wizard to import any
previously exported queries or properly formatted MOF files.
Question: What programming language do you use to create queries?


Managing Status Message Queries
Key Points
In the Configuration Manager console, you manage status message queries by
expanding System Center Configuration Manager, expanding Site Database,
expanding System Status, and then expanding Status Message Queries. You can
create new status message queries, and you can select an individual status message
query to modify or delete.
You can use status message queries to start Status Message Viewer. After you run a
query, Status Message Viewer displays only the messages that match the query
criteria.
Note: Because a Configuration Manager site database can store tens of thousands
of status messages, we recommend that you restrict the number of messages you
view at one time. This option is available within the Status Viewer Options dialog
box on the General tab.

Creating Status Message Queries
When creating status message queries, consider the following:

• You must have Create rights for the Query Security object class to perform this
procedure.
• To create a status message query, use the Status Message Query Properties
dialog box to enter a name for the query, specify the attributes that the query
results return, and determine how the details pane of the Configuration
Manager console displays the results.
• After Status Message Viewer runs, all messages that match the query criteria
you specify will appear in the Status Message Viewer window.
Important: Site database queries are different from status message queries. Do not
paste text from a standard query into a status message query.
Question: Why are there fewer options for creating status message queries than
data queries?

Running Queries
Key Points
When you run a data query or status message query, Configuration Manager
searches the site database for objects that match the query criteria. The query’s
results appear in the Configuration Manager console’s results pane.
Guidelines for Modifying the Results Layout of a Data Query

When running a data query, you can:
• Modify how results are displayed by using the General tab of the Query
Statement Properties dialog box. You must have Modify permissions for the
Query Security object class to modify query properties.
• Modify how query results are displayed by moving the query attributes up or
down in the table. The order of the attributes—from top to bottom and left to
right—are the order in which they are displayed within the query results
columns. In other words, the first attribute listed in this table is displayed in
the first column on the left, and the last attribute listed in this table is
displayed in the last column on the right.

• Modify how query results are sorted. The sort order determines the order in
which Configuration Manager displays the results within the columns. Choose
from ascending, descending, or unsorted. To modify the sort order, highlight a
query attribute, and then click Properties.
• Rearrange the result columns in the details pane after a query runs.
Configuration Manager saves the rearranged order as a user preference across
sessions.
Note: Some invalid queries do not generate errors. Therefore, if a query does not
return data, it might be invalid. Review the query to ensure that, for example, it is
not querying a resource for a value that it does not possess.
Guidelines for Running a Status Message Query

All messages that match the specified status message query criteria appear in the
Status Message Viewer window. Status Message Viewer is the primary tool for
viewing status messages that a site database stores. Status Message Viewer is
similar to Event Viewer, but it has additional capabilities.
You do not need rights to run a query or status message query, but query results
are limited to the security objects for which you have Read permissions. The Status
Message Viewer allows you to:
• Export and print status messages.
• Start multiple viewers to compare messages for troubleshooting.
• Select multiple rows of messages to create your own grouping.
• Copy messages to the Clipboard (with tab-delimited columns) to support
pasting to applications such as Microsoft Office Excel® and Microsoft Office
Word.
• Delete status messages (if you have permission to do so).
• Find, filter, or sort on each column.
• Specify which columns are displayed, and their order and width.
• Select the Status Message Viewer’s font.
• Select additional startup and refresh options, which are saved automatically
when you exit Status Message Viewer.

Demonstration: Creating and Running Queries
Key Points
In this demonstration, you will review how to create and run a data query and a
status message query.
Demonstration Steps
Create a query
1. Open the Configuration Manager console to the Queries node.
2. Create a new folder named My Queries.
3. Create a new query with the following information on the General tab:
• Name: All Windows 7 Systems
• Comment: Query to find all discovered Windows 7 Systems
• Import query statement: All Systems

4. Edit the query with the following information:
• Criterion type: Simple Value

• Attribute class: System Resource
• Attribute: Operating System Name and Version System
• Operator is equal to value: Microsoft Windows NT Workstation 6.1
Run a query and view the results

• Click the All Windows 7 Systems query.
Create a status message query

1. Navigate to the Status Message Queries node.
2. Create a new status message query with the following information:
• Name: Inventory Resynchronization Requests
• Comment: Query for Inventory Resynchronization requests
3. Edit the query with the following information:
• Criterion type: Simple Value
• Attribute class: Status Message
• Attribute: Message ID
• Operator is equal to value: 2715
Run the status message query

• Right-click Inventory Resynchronization Requests, and then click Show
Messages.
Question: When creating a new data query, why would you want to import an
existing data query?
Question: When creating a status message query, why were there fewer attribute
classes to choose from than when creating the data query?

Lab A: Creating Queries
Lab Setup
2. Ensure that the 6451B-NYC-DC1-D and 6451B-NYC-CFG1-D virtual
machines are running.
domain.
3. Log on to NYC-CFG1 as Contoso\Ed, using the password Pa$$w0rd.
4. Log on to NYC-DC1 as Contoso\Administrator, using the password
Pa$$w0rd.

Lab Scenario
Configuration Manager 2007 comes with over 15 preconfigured data queries, and
over 60 preconfigured status message queries. As network administrator of
Contoso, Ltd, you often need to create custom queries to meet your needs.

Exercise 1: Creating and Running a Query
Scenario
You have decided to create a query to find any Windows 7 systems that have not
yet installed the Configuration Manager client.
1. Create a query.
2. Run a query and view the results.
Task 1: Create a query

1. On NYC-CFG1, open the Configuration Manager console, expand Site
Database, expand Computer Management, and then click Queries.
2. Right-click Queries, point to New, and then click Query.
3. Complete the General page with the following information:
• Name: All Windows 7 Systems
• Comment: Query to find all discovered Windows 7 Systems
4. Click Import Query Statement, select All Systems, and then click OK.
5. Click Edit Query Statement, click the Criteria tab, and then click the New
(star) button.
6. Complete the Criterion Properties page with the following:
• Criterion Type: Simple value
7. Click Select, and in the Select Attribute dialog box, set the following
attributes:
• Attribute: Operating System Name and Version
8. On the Criterion Properties page, set the operator to is equal to, and then
click Value.
9. Select Microsoft Windows NT Workstation 6.1.
10. Complete the New Query Wizard using defaults.

Task 2: Run a query and view the results
• Double-click the All Windows 7 Systems query.

Question: What results are shown in the results pane?
Results: After this exercise, you should have created and run a query to find all
discovered Windows 7 systems.

Exercise 2: Creating and Running a Complex Query
Scenario
You often need to create queries that filter for several different criteria. You may
need to create custom queries to meet your needs.
1. Create and edit a complex query.
2. Run the query and view the results.
Task 1: Create and edit a complex query

• Name: All Windows 7 Systems without the ConfigMgr Client
• Comment: Query to find all discovered Windows 7 Systems without a
Configuration Manager client
3. Click Import Query Statement, select All Windows 7 Systems, and then click
OK.
(star) button.
5. Complete the Criterion Properties page with the following:
• Criterion Type: Null Value
6. Click Select, and then in the Select Attribute dialog box set:
• Attribute: Client
7. On the Criterion Properties page, set the operator to is NULL.
8. Complete the New Query Wizard using defaults.

Task 2: Run the query and view the results
• Double-click the All Windows 7 Systems without the ConfigMgr Client

query.
Results: After this exercise, you should have run a query to find all discovered
Windows 7 systems that have not yet had the client installed.

Exercise 3: Creating and Running a Status Message Query
Scenario
You have decided to use the status messages to verify that clients are sending full
inventories as scheduled.
1. Create a status message query.
2. Run the status message query.
Task 1: Create a status message query

1. In the console tree, expand System Status, and then click Status Message
Queries.
2. Right-click Status Message Queries, and then select New Status Message
Query.
• Name: Inventory Resynchronization Requests
• Comment: Query for Inventory Resynchronization requests.
(star) button.
5. Complete the Criterion Properties page with the following information:
• Criterion Type: Simple value
6. Click Select, and then in the Select Attribute dialog box, set the following
attributes:
• Attribute class: Status Message
• Attribute: Message ID
7. On the Criterion Properties page, set the operator to is equal to, and then set
the value to 2715.
8. Complete the query with defaults.

Task 2: Run the status message query

Messages.
Question: How many resynchronization requests are shown?
Question: What does the resynchronization request indicate?
Question: Does this indicate an error?
Results: After this exercise, you should have created and run a status message
query.

Lesson 3
Configuring and Deploying a Reporting Point
Before you can display Configuration Manager reporting objects in Report Viewer,
you must install and configure a reporting point, and also consider the
configuration settings for other reporting components.
• Describe reporting points.
• Describe the requirements for reporting point deployment.
• Create a reporting point.
• Describe the best practices for securing reporting points.

What Is a Reporting Point?
Key Points
A reporting point is a Configuration Manager site system role that hosts the files
that Configuration Manager uses to display database information in Report Viewer.
Configuration Manager does not enable the reporting point site system role
automatically. You must enable all reporting points as required to provide access
to your site’s reports.
Reporting points communicate only with the local site database. Therefore, you
implement reporting points only in primary sites, not secondary sites. Large
organizations with numerous report users should consider planning for multiple
reporting points. With multiple reporting points, you can provide different
reporting point access URLs to different sets of users for accessing reports.
The SMS Reporting Users group controls access to the Configuration Manager
Reports Web site. Any user who is not an administrator, but who needs to access
reports at that reporting point, must be a member of this group. Members of the
Administrators group automatically have the required permissions to view the
reports and do not need to be added to this group.

The SMS Reporting Users group is created automatically on any computer running
the reporting point role.
Question: Must you install a reporting point on the primary site server?

Requirements for Reporting Point Deployment
Key Points
To add the reporting point site role to a site system computer, the following
components must be available:
• The site system computer must have Internet Information Services (IIS)
installed and enabled.
Note: IIS 6.0 Metabase and WMI Compatibility features are required for IIS 7.0 or
above.
• Active Server Page (ASP) pages must be installed and enabled. This is ASP, not
ASP.NET.
Note: When you install ASP.NET on a Windows Server® 2008 operating system
reporting point, you must also manually enable Windows Authentication.

• Microsoft Internet Explorer® 5.01 Service Pack 2 (SP2) or later must be
installed on any server or client that uses Report Viewer.

• To use graphs in reports, Office Web Components must be installed.
Note: Office Web Components is not supported on 64-bit operating systems. If you
want to use graphs in reports, use 32-bit operating systems for your reporting
points.
Question: Why do you need to install Office Web Components on the reporting
point site server?

Creating a Reporting Point
Key Points
In the Configuration Manager console, you create a reporting point by expanding
System Center Configuration Manager, expanding Site Systems, and then adding
the reporting point role to an existing or new server with the appropriate
prerequisites installed.
Note: To create and enable a reporting point, you must have Modify permissions for
the Configuration Manager site.
Question: When would you configure a reporting point to use Hypertext Transfer
Protocol (HTTPS)?

Best Practices for Securing Reporting Points
Key Points
Malicious users usually try to gather as much information about a company as
possible in an attempt to find vulnerabilities. A malicious user might attempt to
gain access to Configuration Manager reports to find information about the
network environment. For example, if a malicious user can view a report showing
software update compliance, then the malicious user can use specific attacks
against computers that are not updated against those attacks.
Attacks against Configuration Manager reporting are usually lower risk than
attacks against the site server, site database server, software distribution, and
remote tools.

Restrict Queries and Reports to Authorized Viewers
Use the principle of least privilege when assigning permissions to queries and
reports. You can run reports from the Configuration Manager console or through a
report viewer, such as Internet Explorer. Only queries viewed in the Configuration
Manager console are subject to Configuration Manager object security. When you
run Configuration Manager queries, you must have Configuration Manager object
security permissions on the objects included in the query. Additionally, when you
create a query, the Values option on the Query Statement Properties dialog box
Criteria tab returns no data if you do not have Read and Read Resource
permissions to the Collections class.
You can limit a query to particular collections, so that users can query data only for
resources in collections they are authorized to use. Even when the user does not
specify collection limiting when creating a query, Configuration Manager applies
collection limiting if the user is not authorized to view all resources. If someone
requires access to information, verify that they will not be restricted by collection
limiting.
Use the Reporting Users Group to Control Access to the Reporting Point
By default, all members of the Administrators and Reporting Users groups have
access to the Reporting Point Web site. If users need access to reports on the
reporting point, add them to the Reporting Users local groups on each required
reporting point. By default, the Reporting Users group does not have any
members.
The Reporting Users group does not have Configuration Manager object security
rights configured by default. This group needs Read security rights on the Report
SMS class so that members of the group can access reports even though they do
have access to the Reporting Point Web site.
Manage Security for Users Who Connect Directly to the SQL Server
Computer
If you use reporting mechanisms other than the Configuration Manager console
and Configuration Manager reporting, WMI security and Configuration Manager
object security are not in effect. If you choose to use reporting mechanisms that
access SQL Server views directly—such as using an Open Database Connectivity
(ODBC) driver or scripting—you must implement security controls to restrict data
access to authorized users.

Note: Accessing data directly in the tables is not supported. The only supported way
to access the data is by using the SQL Server views.
Enable HTTPS Access for Reporting Points

When you configure the reporting point role on a site system, you should
configure the reporting point to launch the Report Viewer using HTTPS.
Intercepting the session state or credentials in unencrypted HTTP traffic is a
relatively easy security attack. Stealing the session state could give a malicious user
full access to the reporting point. This setting does not obtain the certificate or
configure IIS to use Secure Sockets Layer (SSL). Complete these configurations
before you configure the reporting point for HTTPS access.
Note: Configuring HTTPS on the reporting point is completely separate from native
mode configuration. Even in native mode, reporting points default to using HTTP
access.
Question: By default are users allowed to directly query the SQL Server database?

Demonstration: Creating a Reporting Point
Key Points
In this demonstration, you will review how to install the prerequisites for a
reporting point, and then install a reporting point.
Demonstration Steps
Install IIS
1. Use the Server Manager to add the Web Server (IIS) Role.
2. Add the following role services:
• ASP.NET
• Required Role Services
• ASP

Add a new site system
1. Open the Configuration Manager console to the Site Systems node.

2. Right-click Site Systems, click New, and then click Server.
3. In the New Site System Wizard, create the Reporting Point role.
Open the Report Viewer and view the report

1. Open http://<servername>:80/SMSReporting_NYC.
2. In the reports pane, click Upgrade Assessment - Windows 7.
3. Click Windows 7 Upgrade Assessment - Hardware summary for all systems
in a collection.
4. Under Report Information, click Values.
5. Select the All Windows Workstation or Professional Systems collection.
6. Click Display.
Question: Why did we not install Office Web Components in the demonstration?
Question: When is the SMS Reporting Users group created?


Lab B: Creating a Reporting Point
Lab Setup
2. Ensure that the 6451B-NYC-DC1-D , 6451B-NYC-CFG1-D, 6451B-NYC-
SVR2-D virtual machines are running.
domain.
• NYC-SVR2: Server in the Contoso.com domain.
3. Log on to NYC-SVR2 as Contoso\Administrator using the password
Pa$$w0rd.

4. Log on to NYC-CFG1 as Contoso\Ed using the password Pa$$w0rd.

Pa$$w0rd.
Lab Scenario
You are the network administrator for Contoso, Ltd. The Configuration Manager
2007 database contains a lot of information, and not all of it is in an easily readable
format. To allow easy access to the information in the Configuration Manager
database, you have decided to implement a reporting point.

Exercise 1: Installing Reporting Point Prerequisites
Scenario
You are installing a reporting point on a new server. Before you can do this, you
must install IIS.
• Install IIS.
Task: Install IIS

1. On NYC-SVR2, use the Server Manager to add the Web Server (IIS) Role.
2. Add the following role services:
• ASP.NET
• Required Role Services
• ASP
3. Log off NYC-SVR2.
Results: After this exercise, you should have installed IIS with the components to
support a reporting point.

Exercise 2: Adding a Site System with the Reporting Point
Role
Scenario
Once the prerequisites are installed on a server, you can proceed to add the server
as a site system, and install the reporting point role.
• Add a new site system.
Task: Add a new site system

1. On NYC-CFG1, open the Configuration Manager console to the Site Systems
node.
3. Create the following site system:
• Name: NYC-SVR2
• Intranet FQDN: NYC-SVR2.Contoso.com
• Install site system with: Contoso\Administrator with the password of
Pa$$w0rd.
• Install the reporting point role.
Results: After this exercise, you should have added a new site system with the
reporting point role.

Exercise 3: Using the Report Viewer in a Web Browser
Scenario
The Report Viewer can be used within Internet Explorer as well as within the
Configuration Manager console. You will now use Internet Explorer to view a
report from the reporting point role that you just installed.
• Open the Report Viewer and view a report
Task: Open the Report Viewer and view a report

1. From NYC-CFG1, open Internet Explorer, and then provide the following
address: http://NYC-SVR2:80/SMSReporting_NYC.
2. In the reports pane, click Upgrade Assessment - Windows 7.
3. Click Windows 7 Upgrade Assessment - Hardware summary for all systems
in a collection.
5. Select All Windows Workstation or Professional Systems.
6. Click Display.
Results: After this exercise, you should have viewed a report through Internet
Explorer.

Lesson 4
Managing Reports
Configuration Manager reports are secured Configuration Manager objects that

you can create and manage in the Configuration Manager console. Configuration
Manager provides many predefined reports, and you can create additional
customized reports to fit your needs. You can use the Object Wizard to import
reports that were created at another site, or to export report object definitions to a
MOF file. You can run reports with Report Viewer.
• Create reports.
• Describe prompted reports.
• Describe linked reports.
• Describe supplemental reports.

• Use the Reporting Web site.
• Run a report.
• Manage reports.

Creating Reports
Key Points
You can create new reports by specifying the report properties, or by cloning an
existing report and using the properties from the source report to create the new
report.
Reports have three required components:
• Unique name
• Category
• SQL statement
To create a new report by cloning an existing report:

1. Choose a report that is similar to the new report to be created.
2. Clone the report, giving it a unique name.
3. Edit the report properties.

Question: When creating a new report, why would you want to clone an existing
report?

What Are Prompted Reports?
Key Points
A report prompt is a property that you can configure when you create or modify a
report. You create prompts to limit or target the data that a report retrieves. A
prompted report can contain more than one prompt as long as the prompt names
are unique, and contain only alphanumeric characters that conform to the SQL
rules for identifiers.
When you run a report, the prompt requests a value for a required parameter and,
based on the value, retrieves the report data. For example, the Computer
information for a specific computer report prompts the user for a computer name,
and then retrieves information for that specific computer. Report Viewer then
passes the specified value to a variable that the report’s SQL statement defines.
Provided that the SQL statement is configured properly, the report returns
computer information data for only the specified computer.

Prompt Properties
You can configure the prompt to display a default value. You also can configure the
prompt to display a list of appropriate values from which you can choose. You do
this by using a SQL statement, which is separate from the report’s primary SQL
statement. For example, you can configure a SQL statement that allows users to
select from a list, rather than typing in a computer name from memory. When the
user clicks Values in the Prompt dialog box, a list displays the items returned from
the SQL statement. To allow the use of the percent (%) symbol wildcard to limit
the values returned, you must use the @_filterwildcard variable in the SQL
statement.
Question: When would you use a prompted report?


What Are Linked Reports?
Key Points
Use report links in a source report to provide users with ready access to additional
data, such as more detailed information about source report items. For example,
you might link a report that lists all site codes to another report that lists all recent
error messages for a given site code. The source report passes a specific site code to
the target report based on which source-report line item the user chooses. You can
configure a linked report with only one link, and that link can connect to a single
target resource.

Link Types
Source reports can use any one of the link types listed in the following table.
Link type Description
Link to another report Provides a link to a predefined or custom report. If the

target report requires one or more prompts to run, the
source report must contain a column with the
appropriate values for each prompt. You must specify the
column number that will provide the value for the
prompt. For example, you might link a report that lists
computers that were discovered recently, to a report that
lists the last messages that were received for a specific
computer. When the link is created, you might specify
that column two in the source report contains computer
names, which is a required prompt for the target report.
When the source report is run, link icons appear to the
left of each row of data. When you click the icon on a
row, Report Viewer passes the value needed for the
prompt to display the target report.
Link to computer details Provides a link to the Computer Details page, which is a
specialized page within Report Viewer. A source report
must contain a computer name value in one of its
columns to link to the Computer Details page. You
specify the column with the computer name values when
you configure the link to Computer Details. When the
source report runs, link icons appear to the left of each
data row. When you click the icon on a row, the
Computer Details page opens and displays computer
information about the specific computer.
Link to status message Provides a link to the Status Message Details page, which
details is a specialized page within Report Viewer. You access this
page only from a report that contains status messages.
You can use the Status Message Details page to display
information about a specific status message, based on the
RecordID property for the message. The source report
must contain a column with RecordID values. When you
create the link, you specify the column that contains the
appropriate RecordID. When the source report runs, link
icons appear to the left of each data row. When you click
an icon on a row, the Status Message Details page opens
and displays information about the specific status
message.

Link type Description
Link to URL Provides a link to a supplemental report or to any file that

HTTP supports. To create the link, specify the target’s
URL, which can be either an absolute or a relative URL.
You also can configure a URL link to pass column
information from the source report as a parameter to the
target report.
To do this, you specify column values in the URL, as in the
following example:
CustomReport.asp?MachineName=<3>&Network=<5>
In the URL example, the value from column three replaces

<3> and the value from column five replaces <5>. You
must configure the target page to accept the data that
Report Viewer passes to it. Report Viewer does not
perform syntax checking. The URL that you specify in the
report properties can be a maximum of 1,024 characters.
When a report user clicks the link and the source report
data is inserted into the URL, the target URL can be up to
2,048 characters.
Question: Can you link reports to any URL?


What Are Supplemental Reports?
Key Points
Supplemental reports in Configuration Manager 2007 are reports that are created
outside of Configuration Manager, and are added to the supplemental folder on a
reporting point. If there are multiple reporting points, the supplemental report
must be copied to the folder on each of the reporting points from which users need
access to the report. Supplemental reports do not appear in the Configuration
Manager console; they appear only in Report Viewer. However, the Supplemental
Reports item does not appear in the Report Viewer tree until you install at least one
supplemental report file on the reporting point.
Supplemental reports can be ASP files, or any other file that you can display by
using Internet Explorer 5.0 or later, such as HTML files, Microsoft Office files, or
text files. You can run supplemental reports directly from Report Viewer, or from a
link configured in a report, using the URL for the supplemental report as the
target.

Supplemental reports are not Configuration Manager database objects, and
therefore are not backed up routinely by the Configuration Manager backup

service. You must back up these files manually. If a reporting point is disabled,
Configuration Manager automatically copies any supplemental reports to the root
drive on the reporting point site system computer. If the reporting point is re-
created on the computer, Configuration Manager automatically moves the
supplemental reports from the folder to the designated supplemental reports
folder on the reporting point.
Installing a Supplemental Report File

To install a supplemental report file, complete the following steps:
1. On a reporting point site server computer, navigate to <Installation
drive>:\Inetpub\wwwroot\<Report folder name>\Supplemental.
2. Copy the supplemental report file to the Supplemental folder.

Using the Reporting Web Site
Key Points
You can use the Report Viewer to display Configuration Manager information in a
Web browser. When you create a reporting point site system role, Configuration
Manager installs Report Viewer files on the site system computer. You can then
open reports in Report Viewer from the Configuration Manager console, or from a
Web browser.
When you open Report Viewer in a Web browser, you will see the following
reporting objects:
• Reports. Provides a list of reports organized by category, and sorted
alphabetically.
• Dashboards. Provides a list of dashboards that are sorted alphabetically.

• Computer Details. Opens the Computer Details page, which lists all reports
that provide information about individual computers, and that have been
configured to appear on this page.
• Supplemental Reports. Provides a list of supplemental reports. This object only
appears if at least one supplemental report was created on the reporting point.
Users must have Read security rights on the reporting objects for them to display
in Report Viewer.
Question: What is an advantage to using Report Viewer in the Web browser as

opposed to in the Configuration Manager console?

Demonstration: Creating and Running a New Report
Key Points
In this demonstration, you will review how to create and run a new report.
Demonstration Steps
Create a report that lists computers by NetBIOS name, user ID, and
manufacturer
1. Open and copy the contents of the E:\Labfiles\Reports\List.sql file.
2. Open the Configuration Manager console to the Reports node.
3. Create a new Report with the following info:
• Name: Computers by Manufacturer
• Category: Contoso
4. Click Edit SQL Statement.

5. In the Report SQL Statement dialog box, in the SQL statement field, highlight
all text, paste the copied text from List.sql, and then click OK.
6. Exit the New Report Wizard.
Review the list report

1. Open http://NYC-SVR2:80/SMSReporting_NYC.
2. In the reports pane, click Contoso, select Computers by Manufacturer, and
then click Display.
3. Review the results, and then close all open windows.
Question: Can you link the report you create in this demonstration to the
Computer Details report?

Lab C: Managing Reports
Lab Setup
2. Ensure that the 6451B-NYC-DC1-D, 6451B-NYC-CFG1-D and 6451B-NYC-
domain.
Pa$$w0rd.

Lab Scenario
You are the network administrator for Contoso, Ltd. The nontechnical managers
that access reports have expressed concern that information they need is not
available in any of the current reports. You need to create reports to deliver this
information.

Exercise 1: Creating a List Report
Scenario
Configuration Manager 2007 contains many preconfigured reports. However, you
will often find it beneficial to create custom reports to meet your specific needs. In
the interest of saving time you will use a preconfigured SQL statement.
1. Create a report that lists computers by NetBIOS name, user ID, and
manufacturer.
2. Review the list report.
Task 1: Create a report that lists computers by NetBIOS name, user ID,
and manufacturer
1. On NYC-CFG1, open E:\Labfiles\Reports\List.sql in Notepad, and then copy
the contents. You may need to change the file type to All files.
• Name: Computers by Manufacturer
4. Edit the SQL statement to use the text in the List.sql file as your SQL
statement.
Task 2: Review the list report

1. Open http://NYC-SVR2:80/SMSReporting_NYC.
2. In the reports pane, click Contoso, select the Computers by Manufacturer
report, and then click Display.
3. Review the results, and then close the report window. Minimize Internet
Explorer.
Results: After this exercise, you should have created and viewed a list report.

Exercise 2: Creating a Filter Report
Scenario
Once you have created a custom report, you can edit the report to include
additional report functionality. You need to edit the report you created earlier, so
that it is a prompted report.
1. Edit the list report.
2. Review the filter report.
Task 1: Edit the list report

1. Open and copy the contents of the E:\Labfiles\Reports\Filter.sql file.
3. Open the Properties dialog box for the Computers by Manufacturer report.
4. Edit the SQL statement for the Computers by Manufacturer report.
5. In the Report SQL Statement dialog box, click Prompts, and then click New.
6. Complete the Prompt Properties dialog box with the following information,
and so that it provides a SQL statement:
• Name: Manufacturer
• Prompt text: Enter Name of Manufacturer
7. Edit the SQL statement to use the text in the Filter.sql file as your SQL
statement, and then click OK twice.
8. In the Linked Reports and Dashboards dialog box, click Yes.
9. In the Report SQL Statement dialog box, in the SQL Statement field, replace
‘Microsoft Corporation’ with @Manufacturer.
10. Click OK twice.

Task 2: Review the filter report
1. Restore the Internet Explorer window that is open to the View ConfigMgr
Reports page. Refresh the page.
2. Under Contoso, select the Computers by Manufacturer report.
3. Under Report Information, click Values, select Microsoft Corporation, and
then click Display.
4. Review the results, and then close the report window.
5. Minimize the Internet Explorer window that is open to the View ConfigMgr
Reports page.
Results: After this exercise, you should have created and viewed a filter report.

Exercise 3: Creating a Count Report
Scenario
For a meeting, you need to create a basic report that you can use to create a chart.
1. Create a count report.
2. Review the filter report.
Task 1: Create a count report

1. Open and copy the contents of the E:\Labfiles\Reports\Count.sql file.
• Name: Count of PCs by Manufacturer
4. Edit the SQL statement to use the text in the Count.sql file as your SQL
statement, and then click OK.

Reports page.
2. Right-click in the window, and select Refresh.
3. In the reports pane, click Contoso, select Count of PCs by Manufacturer, and
then click Display.
4. Review the results, and then close the Report window.
Reports page.
Results: After this exercise, you should have created and viewed a count report.

Exercise 4: Enabling a Link in a Report
Scenario
When viewing a report, it is often desirable to take a closer look at a particular
detail in that report. Reports can be linked to other reports to allow you to take a
closer look at some details. You need to edit the report you created earlier to
include links to another report.
1. Edit the Contoso reports.
2. Review the linked reports.
Task 1: Edit the Contoso reports

1. Switch to the Configuration Manager console, and then click Reports.
2. Right-click Computers by Manufacturer, and then click Properties.
3. In the Computers by Manufacturer Properties dialog box, click the Links
tab.
4. In the Link type list, click Link to Computer Details, and then click OK.
5. Right-click Count of PCs by Manufacturer, and then click Properties.
6. In the Count of PCs by Manufacturer Properties dialog box, click the Links
tab.
7. In the Link type list, click Link to another report.
8. Click Select, and in the Select Report dialog box, click Computers by
Manufacturer.
9. Click OK, and then click OK again.
Task 2: Review the linked reports

Reports page.
2. Right-click in the window, and select Refresh.
then click Display.

4. Click the arrow next to Microsoft Corporation. Notice that Microsoft
Corporation is entered automatically in the Computers by Manufacturer

report, and that the report displays.
5. Click the arrow next to NYC-CFG1. Note that NYC-CFG1 is entered
automatically in the Computer Details report, and that the report displays.
6. Click Hardware – Processor, and then click Processor information for a
specific computer.
7. Review the results, and then close the report windows.
Reports page.
Results: After this exercise, you should have created and viewed linked reports.

Lesson 5
Creating and Using Dashboards
Dashboards in Configuration Manager 2007 display multiple reports on a single

page. You can create dashboards to monitor information about related hardware or
software, or to group the reports that you use most frequently. You can create new
dashboards by specifying the dashboard properties, or by cloning an existing
dashboard.
• Describe dashboards.
• Create and access dashboards.
• Use dashboards.

What Is a Dashboard?
Key Points
A dashboard is a Configuration Manager component that allows you to display
multiple reports in a grid on a single Report Viewer page. You can use dashboards
with the preconfigured Configuration Manager reports and any custom reports
that you create. Dashboards do not support reports that use prompts.
Administrators use dashboards commonly to:
• Retrieve information about a variety of topics.
• Compare results of related reports.
• Group commonly used reports on a single page.
• Group reports that show related types of information about the hardware or
software of managed computers.

• Group reports that provide data for an end-to-end process, such as the scan
state, deployment evaluation state, and deployment installation state for

software updates.
Question: Can you use all the available reports for dashboards?

Creating and Accessing Dashboards
Key Points
Like reports, you manage dashboards in the Configuration Manager console.
However, you view dashboards using Report Viewer. You can view dashboards
from any computer that has access to a reporting point. Dashboards are not subject
to Configuration Manager object security; however, users must have Read security
rights to the reports that are displayed in a dashboard. After running a dashboard,
you can:
• Print the dashboard results.
• Add the dashboard to the list of favorites.
• Open the individual reports in a separate window.
• Open a target for an individual report in a separate window.

Each report that is displayed in a dashboard has a link icon on the left side of the
title bar. To display the individual report in a separate Report Viewer window, click
the link icon. If a dashboard displays a report that has links, you can also click the
link icons in that report to display the target in a separate Report Viewer window.
You can configure individual reports to refresh automatically at a regular interval.
This feature can be especially helpful for reports that you include in a dashboard.
Question: Can you use the Export Object Wizard to export a dashboard?

Demonstration: Creating and Using Dashboards
Key Points
In this demonstration, you will review how to create and run a dashboard.
Demonstration Steps
Task 1: Create a dashboard and add reports

1. Open the Configuration Manager console to the Dashboards node.
2. In the Actions pane, click New Dashboard.
3. In the New Dashboard Wizard, on the General page, in the Name field, type
Contoso, and then click Next.
4. On the Reports page, highlight Row 1 and Column 1, and then click
Properties.
5. In the Select Report dialog box, highlight Count of PC by Manufacturers,
and then click OK.

6. Create three more reports as follows:
• Row 1, Column 2: All software companies

• Row 2, Column 1: Count operating systems and service packs,
• Row 2, Column 2: Computers that may share the same SMS Unique ID
Task 2: Open the dashboard and display reports

1. On the View ConfigMgr Reports page, scroll down to the Dashboards
section, select Contoso, and then click Display.
2. Review the results, and then close the dashboard window.
Question: What is the minimum number of dashboard cells?


Lab D: Working with Dashboards
Lab Setup
domain.
Pa$$w0rd.

Lab Scenario
As the team lead responsible for Configuration Manager, you want a quick way to
determine the overall status of your Configuration Manager environment. You
want to view the following reports every time you start your Web browser:
• Count of PCs by manufacturer.
• Client deployment status details.
• Count of operating systems and service packs.
• Computers that may share the same SMS Unique ID.
You decide to create a dashboard and add the URL to your Web browser.

Exercise: Creating and Using a Dashboard
Scenario
You need to create a dashboard that contains four reports that will help you
monitor the overall status of your Configuration Manager environment.
1. Create a dashboard.
2. Use the dashboard.
Task 1: Create a dashboard

1. Open the Configuration Manager console to the Dashboards node.
2. Create a new Dashboard called Contoso with the following reports:
• Row 1, Column 1: Count of PCs by Manufacturers
• Row 1, Column 2: All software companies
• Row 2, Column 1: Count operating systems and service packs,
• Row 2, Column 2: Computers that may share the same SMS Unique ID
Task 2: Use the dashboard

Reports page.
2. Right-click in the window, and then select Refresh.
3. Display the Contoso dashboard.
4. Review the results, and then close the dashboard window.
5. Close the Internet Explorer window that is open to the View ConfigMgr
Reports page.
Results: After this exercise, you should have created and used a dashboard.

Lesson 6
SQL Reporting Services in Configuration

Manager 2007 R2
The Configuration Manager 2007 R2 SQL Reporting Services feature provides a set
of tools and resources that help you use the advanced reporting capabilities
provided by Microsoft SQL Server Reporting Services. You can manage these
services from the Configuration Manager console.
• Describe SQL Reporting Services.
• Describe the prerequisites for SQL Reporting Services.
• Plan for SQL Reporting Services deployment.
• Configure SQL Reporting Services.
• Use SQL Reporting Services.

Overview of SQL Reporting Services
Key Points
Using the SQL Reporting Services feature within Configuration Manager 2007 R2
provides the following advantages:
• Uses an industry-standard reporting system to query the Configuration
Manager 2007 database.
• Offers higher performance, availability, and scalability over existing reporting
in Configuration Manager 2007.
• Enables users who are not familiar with Configuration Manager 2007
reporting to generate reports according to their needs.
• Enables users to subscribe to reports. For example, a manager could be
automatically e-mailed a report each day, detailing the status of a software
update rollout.
• Simplifies the creation of SQL-based reports in Configuration Manager 2007
R2.
• Enables users to export reports in a variety of popular formats.

You can create reports in SQL Reporting Services using a number of methods,
including the following:

• By importing existing Configuration Manager 2007 reports into SQL
Reporting Services using the Copy Reports to Reporting Services Wizard.
• By creating new reports using the Create Report Wizard.
• By using Microsoft Report Builder, which is included with SQL Server.
Question: In your workplace will you use SQL Reporting Services or

Configuration Manager reports?

Prerequisites for SQL Reporting Services
Key Points
The SQL Reporting Services feature has both external dependencies and
Configuration Manager 2007 dependencies.
Dependencies External to Configuration Manager 2007

The following table describes the external dependencies for SQL Reporting
Services running in Configuration Manager 2007 R2.
Important: Because of schema changes in SQL Server 2008, you cannot deploy
report models created using this version to the Configuration Manager console. If
you have created report models using SQL Server 2008, you must access them using
your SQL Reporting Services Web site.

Dependency More information
A SQL Server 2005 Reporting Services Before you can use SQL Reporting
reporting server or newer must be Services integration in Configuration
installed and configured in the site Manager 2007 R2, you must configure
hierarchy. SQL Server Reporting Services on a SQL
Server installation in your network.
SQL Reporting Services requires IIS 6.0 or For more information about installing IIS,
newer for the Reporting Services Web site. see your Windows Server documentation.
Report model authoring requires the SQL

Server Business Intelligence Development
Studio component of SQL Server.
Configuration Manager 2007 Dependencies

The following table describes the dependencies within Configuration Manager
2007 for running the SQL Reporting Services feature.

The site server must be running The SQL Reporting Services feature requires
Configuration Manager 2007 R2. Configuration Manager 2007 R2.
Remote Configuration Manager For SQL Reporting Services features to be

consoles must be upgraded to displayed in remote Configuration Manager
Configuration Manager 2007 R2. consoles, You must run Configuration Manager
2007 R2 setup to upgrade the Configuration
Manager consoles.
An existing reporting services You must configure a reporting services point site
point site system role must be system role before you can use SQL Reporting
configured. Services.

Planning for SQL Reporting Services Deployment
Key Points
When configuring the SQL Reporting Services feature, consider the following:
• Location of SQL Reporting Services installation. Configuration Manager 2007
R2 supports locating the SQL Reporting Services reporting server on either the
site server or on a remote computer. However, for performance reasons, you
should locate the server and the Reporting Services point on a remote site
system.
• Unattended report processing. To use report subscriptions, you must
configure one of the following to allow reports to run unattended:
• An execution account. This account must be a Windows® user account. If
you configure this account with a password expiration date, or if you
change its information in Active Directory® Domain Services (AD DS), you
must also update this information in SQL Reporting Services. For this
account, you should set read-only permissions to reports.
• Configure the Credentials stored securely in the report server option on
the Report Server Properties dialog box Data Source Authentication tab.

• Credentials options when configuring the connection to the Configuration
Manager database. Use the Credentials are not required option in the Report
Server Properties dialog box Data Source Authentication tab for testing
purposes only. This setting is not recommended for a production
environment.
Question: Must SQL Reporting Services be installed on a SQL Server?


Configuring SQL Reporting Services
Key Points
Before you can create, modify, and display SQL Reporting Services reports in the
Configuration Manager console, you must perform a number of configuration
tasks.
• Configure SQL Server for SQL Reporting Services. Before you can use the SQL
Reporting Services feature in Configuration Manager 2007 R2, you must
configure SQL Reporting Services on a SQL Server installed in your network.
The configuration steps used might vary depending on the SQL Server version.
See your SQL Server documentation for details.
• Create a Reporting Services point for SQL Reporting Services. Before you can
use SQL Reporting Services in Configuration Manager 2007, you must
configure a Reporting Services point. The Reporting Services point is a site
system role that must be configured on a server running SQL Server with the
Reporting Services component installed.

• Select the default reporting server for SQL reports. If you have selected the
option Use Reporting Services Reports for Admin console report links in
the Report Options dialog box, and if you have more than one Reporting
Services point in your Configuration Manager 2007 R2 site hierarchy, you can
set the default reporting server that will be used when displaying SQL
Reporting Services reports that are run from links in the Configuration
Manager console.
• Configuring properties for the Reporting Services point. Use the General tab
of the Configuration Manager 2007 R2 Report Server Properties dialog box to
view details about the report folder on the selected reporting server. This tab
contains the following settings:
Setting Description
Server Name Displays the name of the report server for which you are
viewing properties.
Report Folder Displays the name of the report folder on the selected report
server.
Status Displays the status of the report folder on the selected report
server.
Size Displays the size of the report folder on the selected report
server.
Contains Displays the number of reports and the number of folders on

the selected report server.
Question: Which database should the SQL Reporting Services use?


Managing SQL Reporting Services
Key Points
To use SQL Reporting Services in Configuration Manager 2007 R2, you must
complete a number of configuration and management tasks.
• Copy Configuration Manager reports to SQL Reporting Services. In
Configuration Manager 2007 R2, you can copy standard reports to a SQL
Reporting Services reporting server by using the Copy Reports to Reporting
Services Wizard. You can copy existing Configuration Manager reports to SQL
Reporting Services as follows:
• Use the Create Report Wizard in Configuration Manager 2007 R2 SQL
Reporting Services to create a new SQL-based report.
• Use the Create Report Wizard in Configuration Manager 2007 R2 SQL
Reporting Services to create a new model-based report. Model-based
reporting allows you to interactively choose the items you want to include
in your report.

• Create report folders in SQL Reporting Services. When you create a report
using SQL Reporting Services in Configuration Manager 2007 R2, it must be

assigned to a report folder. Report folders provide a method of sorting and
filtering reports stored on the report server. Report folders are particularly
useful when you have a high number of reports to manage.
Note: Report folders are automatically created from the Configuration Manager
2007 report category when you use the Copy Reports to Reporting Services Wizard
to copy Configuration Manager 2007 reports into SQL Reporting Services.
• Configure report subscriptions in SQL Reporting Services. Report

subscriptions in SQL Reporting Services enable you to configure the automatic
delivery of specified reports by e-mail or to a file share at scheduled intervals.
Use the Create Subscription Wizard in SQL Reporting Services to configure
report subscriptions.
Note: You can also configure other types of report subscriptions, such as data-
driven subscriptions from the Web interface included with Microsoft SQL Server
Reporting Services. For more information, see your SQL Server documentation.
• View SQL Reporting Services reports from the Configuration Manager console.
In the Configuration Manager console, expand System Center Configuration
Manager, expand Site Database, expand Computer Management, expand
Reporting, expand Reporting Services, and then expand <reporting services
point name>. Right-click the report you want to view, and then click Run.
Note: By default, the report opens in the Configuration Manager console. If you
want the report to open in a separate window, select Open reports in a new
window in the Report Options dialog box.
Question: After importing the Configuration Manager reports into SQL Reporting
Services, can you continue to create reports in Configuration Manager?


Demonstration: Using SQL Reporting Services
Key Points
In this demonstration, you will review how to install and use the SQL Reporting
Services feature.
Demonstration Steps
Verify SQL Reporting Services

1. Click Start, click All Programs, click Microsoft SQL Server 2008, and then
click Configuration Tools.
2. Click Reporting Services Configuration Manager, and verify the server
connection.

3. Verify the following settings:
Configuration Setting
Service Account Use built-in account: Local System
Web Service URL Virtual Directory: ReportServer

IP Address: All Assigned
TCP Port: 80
SSL Certificate: (Not Selected)
Database SQL server: NYC-CFG1

Database name: ReportServer
Report Server Mode: Native
Report Manager URL Virtual Directory: Reports

URLs: http://NYC-CFG1:80/Reports
Install the Reporting Services point

1. In the Configuration Manager console, expand to the Site Systems.
2. Right-click the server, and then select New Roles.
3. On the General page, click Next.
4. On the System Role Selection page, check Reporting Services point, and then
exit the wizard.
Configure the Reporting Services point

1. In the Configuration Manager console, expand to the Reporting Services
node.
2. Right-click the server, and then click Properties.
3. Complete the Data Source Settings tab as follows:
• Server Name: NYC-CFG1
• Database field: SMS_NYC
4. Click Test, and then click OK.

Copy the Configuration Manager reports to the Reporting Services
point
1. Right-click the server, and then click Copy Reports to Reporting Services.
2. Complete the Copy Reports Wizard for all reports.
Use SQL Reporting Services to view a report

1. Open Internet Explorer, and type http://NYC-CFG1:80/Reports.
2. Click ConfigMgr_NYC, click Upgrade Assessment - Windows 7, and then
click Windows 7 Upgrade Assessment - Hardware summary for all systems
in a collection.
3. In the Collection ID list, click All Windows Workstation or Professional
Systems.
4. Click View Report.
Question: What differences did you notice between SQL Reporting Services
reports and Configuration Manager reports?

Lab E: Using SQL Reporting Services
Lab Setup
domain.
Pa$$w0rd.

Lab Scenario
You are the network administrator for Contoso, Ltd. You want to take advantage of
the database administrators’ knowledge of the SQL language to create queries for
Configuration Manager 2007, and have decided to install a Reporting Services
point.

Exercise 1: Installing the Reporting Services Point Role
Scenario
You need to install a Reporting Services point to allow you to use SQL Reporting
Services in your Configuration Manager 2007 environment.
1. Verify SQL Reporting Services.
2. Install the Reporting Services point.
Task 1: Verify SQL Reporting Services

1. On NYC-CFG1, click Start, click All Programs, click Microsoft SQL Server
2008, click Configuration Tools, and then click Yes at the prompt.
2. Connect to NYC-CFG1, and report server instance MSSQLSERVER.
3. Verify the following settings:
Configuration Setting
Service Account Use built-in account: Local System
Web Service URL Virtual Directory: ReportServer

IP Address: All Assigned
TCP Port: 80
SSL Certificate: (Not Selected)
Database SQL server: NYC-CFG1

Database name: ReportServer
Report Server Mode: Native
Report Manager URL Virtual Directory: Reports

URLs: http://NYC-CFG1:80/Reports

Task 2: Install the Reporting Services point
1. On NYC-CFG1, open the Configuration Manager console, and then expand to

the Site Systems node.
2. Add the Reporting Services Point role to NYC-CFG1.
Results: After this exercise, you should have installed a Reporting Services point.

Exercise 2: Managing the Reporting Services Point
Scenario
Now you need to configure the Reporting Services point and import the existing
reports for use in your environment.
1. Configure the Reporting Services point.
2. Copy the Configuration Manager reports to the Reporting Services point.
Task 1: Configure the Reporting Services point

the Reporting Services node.
2. Open the Properties dialog box for NYC-CFG1.
3. Set the Data Source Settings as follows:
• Database field: SMS_NYC
Task 2: Copy the Configuration Manager reports to the Reporting

Services point
1. Right-click NYC-CFG1, and then click Copy Reports to Reporting Services.
2. Complete the Copy Reports Wizard for all reports. Use integrated security for
the Data Source Authentication.
Results: After this exercise, you should have configured the Reporting Services
point, and copied the existing reports from the reporting point to the Reporting
Services point.

Exercise 3: Viewing SQL Reporting Services Reports
Scenario
You have generated a report, and now you want to view it.
• Use the SQL Reporting Services to view a report.
Task: Use SQL Reporting Services to view a report

1. Log on to NYC-CFG1 as Contoso\Administrator with the password of
Pa$$w0rd
2. Open Internet Explorer, type http://NYC-CFG1:80/Reports, and then press
ENTER.
3. Click ConfigMgr_NYC, and then open the Windows 7 Upgrade Assessment -
Hardware summary for all systems in a collection report.
Systems.
Question: How does this compare to the Report Viewer version of the report?
6. Close Internet Explorer.
Results: After this exercise, you should have viewed a report on the Reporting
Services point.

Lesson 7
Client Status Reporting in Configuration

Manager 2007 R2
Client status reporting in Configuration Manager 2007 R2 provides up-to-date

information on the status of client computers in a Configuration Manager 2007
hierarchy.
• Describe client status reporting.
• Describe the prerequisites for client status installation.
• Plan for client status reporting.
• Install and configure client status reporting.
• Use client status reporting reports.

Overview of Client Status Reporting
Key Points
Configuration Manager 2007 R2 offers many methods for monitoring the status of
client computers on your Configuration Manager 2007 R2 site. These methods are
largely based on the date of the latest discovery, and inventory data received from
the client. Configuration Manager 2007 reports can help you examine the
following data for monitoring purposes:
• Clients that have not responded in a specified number of days
• Computers that were not discovered in a specified number of days
• Computers that were not inventoried in a specified number of days

Although these reports can assist you in the diagnosis of potential problems, the
reasons why an active client might not have reported discovery or inventory data
include the following:
• Data might be queued on a Configuration Manager 2007 site system that is
backlogged.
• Data might be queued on a Configuration Manager 2007 site system that is
offline.
• Network problems might be preventing the discovery or inventory data from
reaching the site database.
• The client computer might be offline (for example, when a user is on
vacation).
Client Status Reporting Improvements

Client status reporting in Configuration Manager 2007 R2 provides up-to-date
information about clients in a Configuration Manager 2007 hierarchy. You can use
this information to identify individual client problems, and to maintain a more
accurate site database. Client status reporting can also help you increase software
distribution success rates.
Client status reporting in Configuration Manager 2007 R2 provides the following
improvements over existing methods for diagnosing the status of Configuration
Manager 2007 clients:
• Identifies clients that are online but are not requesting policy.
• Provides a number of reports that detail the status of clients on your site.
• Identifies clients that are online but have nonfunctioning client components.
• Identifies clients that are online but do not have up-to-date discovery or
inventory records.
• Identifies clients that are offline.
• Does not depend on Configuration Manager 2007 site systems. For example,
client status reporting is not affected by problems with backlogged site
systems that could cause traditional reporting mechanisms to generate
inaccurate results.

• Uses a number of data sources for its analysis, including data from the
Configuration Manager 2007 site database—such as inventory, discovery, and

heartbeat data. Additionally, client status reporting components gather and
analyze policy request log files from management points, and can also check
the status and activity of Configuration Manager 2007 client components.
• Retrieves data from the Configuration Manager 2007 database, such as
inventory and Heartbeat Discovery data records for clients. It compares the
dates of these records to specified client status reporting periods. Clients that
have records within these client status reporting periods are categorized as
active clients. Clients that have their obsolete bit set to 1 are specified as
obsolete clients.
• Categorizes clients that do not have records within the client status reporting
periods as inactive clients.
• Uses client pulse and client ping to retrieve information about the status of the
client. Clients that are categorized as inactive are then further examined. Client
ping then returns further information from the client computer, such as
whether a client component might be malfunctioning, or whether the client is
offline.
Client Status Reporting Limitations

Client status reporting has the following limitations:
• Client status reporting is a reporting tool only. It cannot repair problems
found with the Configuration Manager 2007 client.
• Client status reporting cannot always determine the exact cause of a problem.
• The client status diagnosis is based on the assumption that all Configuration
Manager 2007 site systems are working correctly. If a server is offline, an
otherwise active client might be incorrectly diagnosed as inactive.
Question: What is the primary advantage of using client status reporting?


Prerequisites for Client Status Reporting Installation
Key Points
Client status reporting in Configuration Manager 2007 R2 has both external
dependencies, and Configuration Manager 2007 dependencies.
Dependencies External to Configuration Manager 2007

External dependencies for client status reporting are described in the following
table.
The client status reporting host The client status reporting host system is the
system must be running Microsoft computer on which the client status reporting
.NET Framework 2.0. feature is installed.
The client status reporting host Client status reporting will run on any
system must be running a supported platform supported by the Configuration
operating system. Manager 2007 R2 client.

To view charts in reports, the Some reports for client status reporting are
Configuration Manager 2007 designed to be viewed as a chart. To use
reporting point site system must have charts in reports, Office Web Components
Office Web Components installed. must be installed on the Configuration
Manager 2007 site reporting point.
Note: Office Web Components is not supported on 64-bit operating systems. If you
want to use graphs in reports, use 32-bit operating systems for your reporting
points.
Configuration Manager 2007 Dependencies

Configuration Manager 2007 dependencies for client status reporting are
described in the following table.
The site must be running Client status reporting is not compatible with
Configuration Manager 2007 R2. Configuration Manager 2007 releases prior to R2.
There must be a reporting point The reporting point site system role must be
site system. installed before you can display client status
reporting reports.
The site must contain clients. Client status reporting requires at least one
Configuration Manager 2007 client in the site
database.
Question: Does client status reporting depend on SQL Reporting Services?


Planning for Client Status Reporting
Key Points
Consider the following when installing the Configuration Manager 2007 R2 client
status reporting feature:
• Deployment scope
• Client status reporting host system
• Network bandwidth
Deployment Scope
You can specify only one SQL Server and one Configuration Manager 2007 site
database for each installed client status reporting instance. Only one client status
reporting instance can be installed on a computer.

Client Status Reporting Host System
The client status reporting host system is the computer on which you install client
status reporting. Consider the following when designating the client status
reporting host computer:
• You can install client status reporting on any Configuration Manager 2007 site
system. However, this is not a requirement. You can also install client status
reporting on any server or workstation with network connectivity to your
Configuration Manager site.
Note: For performance reasons, we recommend installing client status reporting on

a server other than the server hosting the Configuration Manager 2007 site
database.
• It is recommended that the client status reporting host system be located in

close proximity on the network to the site server of the monitored site.
• If you want to monitor the status of client computers in a Configuration
Manager 2007 secondary site, you must configure client status reporting to
report to the database of the parent site.
• Client status reporting might use considerable computer resources on the
client status reporting host system. For this reason, we recommend that you
do not install client status reporting on a computer that is running other
resource-intensive applications.
• The Client Status Reporting Service Account requires administrator privileges
and the "logon as a service" right on the client status reporting host system
computer.
• To query the Configuration Manager 2007 client service on client computers
by using client ping, the Client Status Reporting Service Account must have
administrator permissions on the client computers.

Network Bandwidth
If you have slow network connections between Configuration Manager 2007 sites
in your hierarchy, the available bandwidth might not be sufficient to support using
client ping and collect policy request log files. In this case, consider installing a
client status reporting instance at each primary site in your hierarchy.
Note: Client status reporting does not consolidate reports for multiple instances of
the feature.
Question: Does the Client Status Reporting Service Account require any special
rights?

Installing and Configuring Client Status Reporting
Key Points
Client status reporting is not automatically installed when you install
Configuration Manager 2007 R2. You can install client status reporting on any
Windows server or workstation that meets the necessary prerequisites. This
computer is designated as the client status reporting host system.
To install and configure client status reporting, complete the following steps:
1. On the designated client status reporting host system, access the
Configuration Manager 2007 R2 installation media, open the Client Status
Reporting folder, and then run ClientStatusReporting.msi.
2. From the Start menu, navigate to Microsoft Configuration Manager 2007 R2
Client Status Reporting, and then click Configure Client Status Reporting.
Question: Do you need to install client status reporting on a Configuration

Manager site system?

Demonstration: Installing and Configuring Client Status
Reporting
Key Points
In this demonstration, you will review how to install and use client status
reporting.
Demonstration Steps
Install client status reporting

1. Open the E:\Labfiles\ConfigMgrR2\Client Status Reporting folder.
2. Run the ClientStatusReporting.msi file.
3. Install client status reporting to the C:\Microsoft ConfigMgr Client Status
folder.

Configure client status reporting
1. Click Start, click All Programs, click Microsoft Configuration Manager 2007
R2 Client Status Reporting, and then click Configure Client Status
Reporting.
2. Complete the configuration with the following settings:
Tab Settings
Site Settings ConfigMgr SQL server and instance: NYC-CFG1

ConfigMgr site database: SMS_NYC
Use the local system account on this server
Options Update Configuration Manager 2007 site database with

inactive client information
Schedule Check Collect policy request information from

management points
Click Apply, and then click OK
Click Run Now for Collect policy request information from
management points
Check Ping inactive clients
Click Apply
Click Run Now for Ping inactive clients
Question: Can you install client status reporting in a Configuration Manager 2007
site that has not been upgraded to R2?

Using Client Status Reporting Reports
Key Points
Before you can use the reports for client status reporting, you must first import
them into your Configuration Manager 2007 R2 site. To do this, complete the
following steps:
1. Locate the ClientStatusReports.mof file in the folder
%ProgramFiles%\Microsoft ConfigMgr Client Status\Reports on the client
status reporting host system. Save this file to a location that is accessible to
your Configuration Manager 2007 site server.
2. In the Configuration Manager console, expand System Center Configuration
Manager, expand Site Database, expand Computer Management, expand
Reporting, and then expand Reports.
3. Import the ClientStatusReports.mof file.

To use a report for client status reporting, in the Reports node, right-click the
report, and then click Run.
Note: You might need to refresh the node’s display before you can view the reports.
Question: Can you create custom reports for client status reporting?

Demonstration: Installing and Displaying Client Status
Reporting Reports
Key Points
In this demonstration, you will review how to install and use the client status
reporting reports.
Demonstration Steps
Install the client status reporting reports

1. In the Configuration Manager console, click the Reports node.
2. Use the Import Object Wizard to import the C:\Microsoft ConfigMgr Client
Status\Reports\ClientStatusReports.mof file.

Copy the client status reporting reports to the Reporting Services
point
1. In the Configuration Manager console, expand to the Reporting Services
node.
3. Complete the Copy Reports Wizard for the client status reports.
View the client status report

1. Open Internet Explorer, and type http://NYC-CFG1:80/Reports into the
address bar.
2. Click ConfigMgr_NYC, click Client Status, and then click Client Status
Detail for a Specific Computer.
3. In the Computer Name list, click NYC-CL1.

Lab F: Installing and Using Client Status
Reporting
Lab Setup
domain.

3. Log on to NYC-CFG1 as Contoso\Administrator, using the password
Pa$$w0rd.
Pa$$w0rd.
Lab Scenario
You are the network administrator for Contoso, Ltd. You have decided to
implement client status reporting to more closely monitor the clients in your
Configuration Manager environment.

Exercise 1: Installing and Configuring Client Status
Reporting
Scenario
Before you can use client status reporting, you must first install it in your
environment.
1. Install client status reporting.
2. Configure client status reporting.
Task 1: Install client status reporting

1. On NYC-CFG1, open the E:\Labfiles\ConfigMgrR2\Client Status Reporting
folder.
2. Run the ClientStatusReporting.msi file.
3. Install client status reporting to the C:\Microsoft ConfigMgr Client Status
folder.
Task 2: Configure client status reporting

Reporting.
2. Complete the configuration with the following settings:
Tab Settings
Site Settings ConfigMgr SQL server and instance: NYC-CFG1

ConfigMgr site database: SMS_NYC
Use the local system account on this server
Options Update Configuration Manager 2007 site database with

inactive client information
Schedule Select Collect policy request information from

management points
Click Apply, and then click OK

Tab Settings
Click Run Now for Collect policy request information

from management points
Select Ping inactive clients
Click Apply
Click Run Now for Ping inactive clients
Results: After this exercise, you should have Installed and configured client status
reporting.

Exercise 2: Installing and Viewing Client Status Reporting
Reports
Scenario
Client status reporting is report-based, and you must install the reports manually
before you can use them.
1. Install client status reporting reports.
2. View a client status report.
Task 1: Install client status reporting reports

the Reports node.
2. Use the Import Object Wizard to import the C:\Microsoft ConfigMgr Client
Status\Reports\ClientStatusReports.mof file.
Task 2: View a client status report

1. Open Internet Explorer, and then open http://NYC-
SVR2:80/SMSReporting_NYC.
2. In the reports pane, click Client Status.
3. Click Client Status Detail for a Specific Computer.
5. Select NYC-CL1, and then click Display.
Question: When was the last DDR received?
Question: When was the last hardware scan?
Results: After this exercise, you should have installed and viewed a client reporting
status report.

1. On the host computer, start Hyper-V™ Manager.
click Revert.
DC1-D , and then in the Actions pane, click Connect.
Important: Start the NYC-DC1 virtual machine first, and ensure that it is fully started
6. Wait for NYC-DC1 to start, and then start 6451B-NYC-CFG1-D . Connect to


Review Questions
1. You have enabled hardware and software inventory. You can browse inventory
using Resource Explorer, but you discover that you cannot run reports from
the Reports node. What is most likely the cause of the problem?
2. When you are designing your dashboard, why is the list of selectable reports
considerably less than the total number of reports?
3. Reporting points require which Windows services?
4. What are some of the benefits of using SQL Reporting Services for
Configuration Manager reports?
5. Name some advantages of using client status reporting?


1. The management team wants a daily report on how many computers have
been migrated during the migration process from Windows Vista® to Window
7. Since your team is responsible for the migration, you are looking for a
simple way to provide the migration results.
2. Your security office has notified you that there is a security incident. During
the review of this security incident, it was determined that your antivirus
software was missing from a few workstations. You have been asked to
automate a process to ensure that all workstations within the Configuration
Manager environment have antivirus software installed. Your company uses
Windows Server 2003 and Windows Vista, and Configuration Manager
installs all software.
3. Your service desk has purchased several plasma screens to display statistical
information for all service desk technicians. On one of the screens, they would
like to display Configuration Manager advertisement status and client
installation status.
Distributing Software Using Microsoft® System Center Configuration Manager 2007 6-1

Module 6
Distributing Software Using Microsoft® System
Center Configuration Manager 2007
Contents:
Lesson 1: Overview of the Software Distribution Process 6-4
Lesson 2: Preparing for Software Distribution 6-13
Lesson 3: Overview of Distribution Points 6-23
Lab A: Preparing for Software Distribution 6-35
Lesson 4: Creating and Populating Collections 6-40
Lesson 5: Configuring Collections 6-53
Lab B: Creating and Configuring a Collection 6-61
Lesson 6: Creating and Configuring Packages and Programs 6-65
Lab C: Creating a Package and Configuring Programs 6-79
Lesson 7: Distributing Packages 6-84
Lesson 8: Advertising Programs 6-90
Lesson 9: Monitoring and Troubleshooting Software Distribution 6-103
Lab D: Deploying Applications by Using Software Distribution 6-119

Module Overview
Software distribution is one of the most important and popular features of

Microsoft® System Center Configuration Manager 2007. The concepts and
processes employed in software distribution also form the foundation for other
features, such as software updates and Operating System Deployment. In this
module, you will learn how to set up the infrastructure that you need to
successfully deploy and launch applications, scripts, or executables using software
distribution.
• Describe the software distribution process.
• Explain how to prepare a site for software distribution.
• Describe how distribution points work.
• Explain how to create and populate collections for targeting software
distribution.

• Explain how to configure collections for targeting software distribution.
• Explain how to create and configure packages and programs.

• Explain how to configure objects for software distribution.
• Explain how to distribute packages and advertise programs.
• Explain how to monitor and troubleshoot the software distribution process.

Lesson 1
Overview of the Software Distribution Process
Software distribution automates delivery of application programs to System Center

Configuration Manager 2007 clients. The delivered programs can perform tasks on
the client computers, such as installing software, or scanning for viruses.
• Describe the Configuration Manager software distribution feature and its
benefits.
• Describe software distribution-specific objects.
• Describe the software distribution process.
• Describe the client role in software distribution.

Benefits of Software Distribution
Key Points
Configuration Manager software distribution helps organizations reduce the total
cost of ownership (TCO) for application deployment in a number of ways.
Software distribution:
• Eliminates the need to distribute to users CDs, DVDs, or other removable
media, along with programs and instructions.
• Allows you to control how and when software is distributed to clients.
• Offers a variety of ways to control how software is distributed.
For example, by automating program distribution, you eliminate user errors
such as entering incorrect values in prompts, running incorrect programs, or
entering incorrect arguments. Users can run programs successfully, and install
software without needing to know how to run these programs, or which setup
options are best for them.
• Provides users the ability to install software without requiring administrative
rights.

• Offers a mechanism for running any executable program file or command on
the client.
Configuration Manager can cause any executable file to run on the client.
However, it is important to understand that Configuration Manager does not
actually package the executable program or source files. Configuration
Manager is the delivery mechanism that gets the software or the command to
the client, but the command must run on the client independently of
Configuration Manager. If a command cannot run directly on a computer, then
that command will not run if Configuration Manager software distribution is
used to deploy it.

Software Distribution Concepts
Key Points
Software distribution relies on a variety of objects that you configure in the
Configuration Manager console. The software distribution objects include:
• Packages. Package objects represent the actual files that the targeted client
needs in order to run a program that is advertised by using Configuration
Manager. For example, a package could contain the installation files used to
install an application on the client computer. Alternatively, a package might
not contain any files if it will be used only to run an executable that is already
present on the target client.
• Programs. Programs include the commands that the client runs during
software distribution. For example, a package used to install an application
will include a program that runs the command—such as setup.exe—that installs
the application.

A package must contain at least one program before you can distribute it to
clients. You can create multiple programs for a package. For example, you
could create in a package one program that installs an application silently, and
another program that installs the same application by using the standard
installation wizard.
• Advertisements. Advertisements associate a program, and the package in
which it is defined, with a target collection. That is, advertisements tell the
members of a collection to retrieve a package, and to run a specified program
in that package.
Software distribution also involves a number of other components and concepts,

including:
• Distribution points. Distributions points are site systems that store the package
files that clients retrieve when running an advertised program. When you
create a new package, you must put the package on at least one distribution
point so that clients can access it and run any of the programs in the package.
• Package definition files. Package definition files specify package properties,
such as name and version, and one or more program definitions. Program
definitions in package definition files include the program command and can
include other properties, such as disk space requirements and supported
client processors and operating systems. You do not necessarily need to create
all packages and programs manually. Some applications include, in their
source media, package definition files that allow you to automatically create
packages and their respective programs.
• Package Access accounts. By default, a distribution point’s local Users group
has granted Read permission to all packages on the distribution point. If you
need to restrict access, you configure which accounts or groups have
permission to access a package in that package’s Access Accounts node.
• Task sequences. You can configure task sequences to cause a computer to
automatically perform multiple actions without manual intervention. Task
sequences—typically employed during operating system deployment—can
include running software distribution programs. Thus, you can configure a
task sequence that deploys an operating system, and then installs a number of
applications, automatically.
Question: What is the purpose of the program software distribution object?


Overview of the Software Distribution Process
Key Points
You must perform several administrative tasks to prepare for software distribution
within your site.
The following table describes the software-distribution administrative tasks.
Task Description
Prepare the site for • Create distribution points.

software distribution • Set up client agent.
Create the • Create the collection (if necessary).
Configuration Manager • Create the package.
software distribution
objects
• Create the program.
• Distribute the package.
• Advertise a program from the package.

Task Description
Configuration Manager • Client polls for policies, which might include software
client runs software advertisements.
distribution • Client runs the advertised program.
Monitor software and • Review status messages.
troubleshoot • Review advertisement reports.
distribution

Overview of the Client Role in Software Distribution
Key Points
The Advertised Programs Client Agent facilitates client software distribution by
sending out new advertisements to clients when new programs are available. The
Advertised Programs Client Agent runs on the client computers, and enables
clients to receive and run programs that you advertise.
The following steps describe the client’s participation in software distribution:
1. The Advertised Program Client Agent determines which advertised programs
are appropriate for the client or the user.
2. The client finds an advertisement, indicating that a program is ready to run.
a. The Advertised Programs Client Agent connects to an available
distribution point to transfer or run the program.
b. The client executes the advertised program with any appropriate
command-line switches.

3. The client returns status results to the management point, which forwards the
status message to the site server.
Question: Can you change how often clients check for new advertisements?

Lesson 2
Preparing for Software Distribution
You must prepare your Configuration Manager site for successful software
distribution. In this lesson, you will learn how to create one or more distribution
points, configure the software distribution component, and enable and configure
the Advertised Programs Client Agent.
• Describe the prerequisites for software distribution.
• Explain the site configuration tasks that support software distribution.
• Describe the configuration options for the software distribution components.
• Describe the Advertised Programs Client Agent.

Software Distribution Dependencies
Key Points
Configuration Manager has no external prerequisites for the software distribution
feature. However, the feature has a number internal dependencies that you need to
configure. These dependencies include:
• Software Distribution component. In the Software distribution Properties,
you can configure settings for copying packages from the site server to
distribution points. Some of these settings affect the package locations on the
site server, the number of packages that can be simultaneously copied to
distribution points, and the retry settings.
• Advertised Programs Client Agent. Software distribution requires that the
Advertised Programs Client Agent be enabled. If the agent was not enabled
during site installation, then you must enable it. Additionally, you can
configure other agent settings, such as how users are notified that new
advertised programs are available for installation.

• Distribution points. You must configure at least one distribution point in order
to use software distribution. Although by default the site server is configured

as a distribution point during installation, for best performance, you should
move this role to another server.
Storage Considerations
You should consider certain storage issues before configuring software distribution
components. These include:
• File System. If you will be storing compressed versions of your packages, then
you must designate a drive formatted by using the NTFS file system as the
storage location for packages on the site server.
• Disk Space. You must also ensure that the site server and distribution points in
your site—in addition to those in child sites—have sufficient disk space for
storing packages.
Distribution Point Prerequisites

Although the software distribution feature does not have external prerequisites,
specific types of distribution points do. These prerequisites include:
• Background Intelligent Transfer Service (BITS)-enabled distribution points
require Internet Information Services (IIS).
• Branch distribution points require:
• The Configuration Manager 2007 client must be installed.
• Remote Differential Compression (RDC) must be installed.
• At least one BITS-enabled, standard distribution point must be available.

Site Configuration Tasks for Software Distribution
Key Points
One of the first steps in preparing for software distribution is to configure site
settings, which includes three required steps:
• Designate one or more servers as distribution points.
• Configure the software distribution component.
• Configure the Advertised Programs Client Agent.
In addition to the required steps, you can perform these optional steps while
preparing the site for software distribution:
• Designate one or more computers as branch distribution points.
• Configure one or more accounts for package access.

Configuring the Software Distribution Component
Key Points
The Software Distribution component settings affect where packages are stored on
the site server, and how they are transferred to distribution points.
When you create a package that contains source files, Configuration Manager must
copy those files from the source media to the site server before the files can be
copied to distribution points. The Drive on site server setting specifies the drive
on the local site server where package source files are stored. If you want to create
a compressed copy of the package source files, then the drive you specify must be
formatted with the NTFS file system, because the file allocation table (FAT) or
FAT32 file systems will not store the compressed files properly.
Note: The package source folder located on the site server is not the same as the
package source folder located on distribution points.

Configuration Manager uses threads to deploy packages to distribution points and,
by default, generates a status notification if a package fails to deploy to distribution

points within 50 hours (100 retries * half an hour between retries). By increasing
the number of threads and packages that Configuration Manager can deploy
simultaneously, you help reduce any failures that might occur if connections take
abnormally long to complete.
If a package fails to deploy, a status message is generated to indicate that the
package-deployment failure occurred. The system status then changes to a critical
state, thereby alerting the Configuration Manager administrator to the deployment
failure. You can change the retry settings to better fit the conditions of your
network.
Note: The multicast retry settings on the Distribution Points tab affect the
multicast transmission of image files from distribution points to clients during
operating system deployment. All other settings on this tab affect only the transfer
of packages from the site server to distribution points.

Configuring the Advertised Programs Client Agent
Key Points
You configure the Advertised Programs Client Agent in preparation for software
distribution. The Advertised Programs Client Agent runs on client computers, and
allows clients to receive and run programs that you advertise. When you select the
Enable software distribution to clients check box in the Advertised Programs
Client Agent Properties dialog box in Site Settings, Configuration Manager
enables the Advertised Programs Client Agent on all computers within the site.
Before you perform software distribution, you should examine the configuration of
the Advertised Programs Client Agent, and make adjustments as necessary. You
adjust the configuration using either the General tab or the Notification tab in the
Advertised Programs Client Agent Properties dialog box.
Note: Checking for new advertisements is now part of the client polling interval
configured within the Computer Client Agent.

Question: Is it possible to provide an audible cue to users when a new software

deployment is available?

Demonstration: Configuring the Software Distribution
Component and Advertised Programs Client Agent
Key Points:
• Configure the Software Distribution component.
• Configure the Advertised Programs Client Agent.
Configure the Software Distribution component

1. In the Configuration Manager console, expand Site Database (site), expand
Site Management, expand Site_code – Site_name, expand Site Settings, and
then click Component Configuration.
2. Right-click Software Distribution, and then click Properties.
3. In the Software Distribution Properties dialog box, configure the settings on
the General and Distribution Points tabs, and then click OK.

Configure the Advertised Programs Client Agent

then click Client Agents.
2. Right-click Advertised Programs Client Agent, and then click Properties.
3. On the General tab, verify that Enable software distribution to clients is
selected. Configure the other settings.
4. On the Notification tab, configure the settings, and click OK.
Question: In the Advertised Program Client Agent, what is the default countdown
length?

Lesson 3
Overview of Distribution Points
Configuration Manager distribution points store the package files necessary for
clients to run advertised programs. Distribution points allow clients to download
packages so that they can run advertised programs.
• Describe distribution points.
• Describe standard and branch distribution points.
• Describe protected distribution points.
• Discuss guidelines for configuring distribution points.

Planning Distribution Points
Key Points
You can use the software distribution feature to cause clients to run commands or
executables that already reside on the client, in which case no files need to be
distributed to the client computer. However, if you want to deploy new
applications or cause the client to run commands or programs that require new
files, you must place the necessary packages on a server so the client can access
them.
Distributing software over your network can consume large amounts of
bandwidth. Thus, planning the types, configuration, and placement of your
distribution points is important.
You can configure a distribution point as either a standard or branch distribution
point. Branch distribution points are often used in small offices that do not have a
server.

Note: Standard and branch distribution points will be discussed in detail later in this
module.
Bandwidth Control
The transfer of packages from the site server to standard distribution points in the
same site is not subject to any bandwidth control. Thus, you should perform
distribution of large packages to distribution points at a time when such transfers
will not adversely impact other network operations.
The transfer of packages between sites is controlled by configuring the address that
is used to connect to the site. Configuration Manager uses BITS to transfer
packages to branch distribution points, thus conserving network bandwidth. You
can also conserve bandwidth by using BITS to transfer packages from standard
distribution points to clients.
Note: BITS-enabled client transfer will be discussed later in this module.
Distribution Point Groups

You can configure distribution point groups in order to simplify distribution points
selection when deploying packages. However, if you add a new member to a
distribution point group, you must still add to the distribution point any packages
that you want stored on it. If you want to add several packages simultaneously, you
can use the Copy Package Wizard.
Question: How is network bandwidth conserved when transferring packages to

branch distribution points?

Standard and Branch Distribution Points
Standard Distribution Points

Standard distribution points provide the ability for any of the site’s clients to
download (if necessary) and run deployed software. Using multiple distribution
points allows the workload to be distributed among all distribution points. This
also allows clients to connect to alternate distribution points if a distribution point
is unavailable. Distribution points can be BITS-enabled to help control network
bandwidth. There are specific configurations for distribution points that support
mobile devices and Internet-based clients.
Site System Shares

If you choose to use the site system share—sometimes known as common package
share—on distribution points when creating a package, Configuration Manager
creates a hidden SMSPKGx$ (where x is the drive letter) share on the distribution
point server drive with the most free disk space. If that share does not exist,
Configuration Manager creates it. Configuration Manager could feasibly create
different drives for each package that you distribute because, after the previous
package was distributed to a specific drive, it might no longer be the drive with the
most free space.

Note: If you want to prevent the installation of a distribution point share on a

specific drive on a distribution point, create an empty file named
no_sms_on_drive.sms in the root of the drive.
Branch Distribution Points

Branch distribution points function like standard distribution points, but they
receive packages in a different way. Branch distribution points are, by design, also
Configuration Manager clients. As such, they use BITS to download packages from
a BITS-enabled, standard distribution point. (If no such standard distribution point
is available, then the branch distribution point will not be able to retrieve packages
for distribution.) This method of package transfer conserves considerable network
bandwidth, which makes branch distribution points ideal for smaller office
locations that have limited bandwidth to the site’s main location.
Branch distribution points can also be deployed on the Windows® XP, Windows
Vista®, and Windows 7 operating systems. However, because such workstation
operating systems permit only 10 simultaneous client connections, using a
workstation-based branch distribution point in a location with more than 10
computers may result in software distribution delays and failures. In such
situations, you can configure multiple branch distribution points in the same
location. However, each branch distribution point will retrieve packages from a
BITS-enabled standard distribution point, and thus, consume additional network
bandwidth in doing so.
Note: The branch distribution point role is the only site system role that can be
installed on a workstation-class operating system.
Question: How can you limit the network bandwidth consumed when packages
are transferred from distribution points to clients?

Protected Distribution Points
Key Points
Protected site systems are designed to allow administrators to better manage
network connections between clients and site systems. If you configure a site
system—such as a distribution point—as protected, then only clients located within
the boundaries you specify will be able to access the distribution point. Any clients
outside those boundaries will be unable to access packages from that distribution
point. This does not prevent clients from accessing distribution points not within
the protected boundaries. However, clients within the boundaries of a protected
distribution point will only access an unprotected distribution point if a protected
distribution point is unavailable, and only if the advertisement is configured to
allow fallback to unprotected distribution points.

Important: Branch distribution points obtain packages from BITS-enabled, standard

distribution points. If you protect your standard distribution points, then you must
ensure that any branch distribution points are included in the boundaries that are
permitted to access the protected, BITS-enabled, standard distribution point.
Question: Can a client access an unprotected distribution point if it is within the

boundaries assigned to a protected distribution point?

Discussion: Distribution Point Usage
Scenario
You are the administrator of a single Configuration Manager site for Contoso, Ltd.
Contoso has the following offices:
• Corporate office in Winnipeg (7,000 staff, 20 information technology (IT)
staff, and 40 servers)
• Sales office in Ottawa (50 staff, two IT administrators, and five servers)
• Branch office in Virden (six staff, and no IT administrators or servers)
Bandwidth between offices is limited. As such, you have been asked to minimize
bandwidth usage.
Question: Which type of distribution point would you use in each location, and
why?

Best Practices for Configuring Distribution Points
Key Points
Clients downloading software packages have the potential to significantly increase
your network traffic. To distribute this load efficiently, you need to ensure that
enough distribution points have been assigned at the correct locations to
accommodate the traffic that application distributions generate on the local
network or over the wide area network (WAN). You should be aware of the
approximate size of the packages that you are distributing. Excessively large
packages may overload the network. You should plan for this while you are
designing your Configuration Manager installation and configuration.

Follow these guidelines when configuring a site system to be a distribution point:
• Place distribution points close to clients.

• Enable BITS on the distribution points.
• Designate protected distribution points.
• Designate branch distribution points.
Question: Where should distribution points be located?


Demonstration: Configuring Distribution Points
Key Points
• Configure a new distribution point.
• Add a distribution point to a new distribution point group.
Configure a new distribution point

then select Site Systems.
2. Right-click Site Systems, point to New, and then click Server or Server Share,
depending on which you want to create.

3. If you are creating a new server, use the New Site System Server Wizard to
create the site system server, and then select the Distribution point check box
from the Available Roles on the System Role Selection page to designate this
server as a distribution point.
Add a distribution point to a new distribution point group

then select Site Systems.
2. Expand Site Systems, select the distribution point site system that you want to
add to the new group, in the details pane, right-click ConfigMgr distribution
point, and then click Properties.
3. Under Group Membership, click the New (star) icon.
4. Type a name in the Distribution point group name box.
5. Verify that the Include this site system in the distribution point group check
box is selected.
6. Click OK to close the Distribution Point Group dialog box.
7. Click OK to close the ConfigMgr distribution point Properties dialog box.

Lab A: Preparing for Software Distribution
Lab Setup
• 6451B-NYC-DC1-D: Domain controller in the Contoso.com domain.
• 6451B-NYC-CFG1-D: Configuration Manager 2007 R2 primary site server
in the Contoso.com domain.
3. If required, connect to the 6451B-NYC-CFG1-D virtual machine.
• Log on to 6451B-NYC-CFG1-D as Contoso\Ed using the password
Pa$$w0rd.

Scenario
As the Configuration Manager administrator for Contoso, Ltd, you need to prepare
the site for software distribution by configuring the software distribution
component, the Advertised Programs Client Agent, and a distribution point.
Estimated time: 10 minutes

Exercise 1: Configuring the Software Distribution
Component
Scenario
You need to configure the software distribution component to store packages on a
specific drive on the site server. Because the Contoso Configuration Manager
hierarchy resembles the Contoso WAN topology, you also need to configure the
Software Distribution component to transfer packages from the nearest site in the
hierarchy.
The main task for this exercise is to configure the Software Distribution
component.
Task: Configure the Software Distribution component

1. On NYC-CFG1, open the Configuration Manager console, and then navigate to
Component Configuration.
2. Open the Software Distribution Properties dialog box.
3. On the General tab, in the Location of stored packages box, type E:\.
4. On the Distribution Point tab, select Send package from the nearest site in
the hierarchy.
Note: Leave the Configuration Manager console open.
Results: After this exercise, you should have configured the software distribution
component.

Exercise 2: Configuring the Advertised Programs Client
Agent
Scenario
You need to enable the Advertised Programs Client Agent on all clients so that new
software can be deployed during an upcoming project.
The main task for this exercise is to configure the Advertised Programs Client
Agent.
Task: Configure the Advertised Programs Client Agent

1. In the Configuration Manager console, navigate to Client Agents.
2. Open the Advertised Programs Client Agent Properties dialog box.
3. Select Enable software distribution to clients.
Results: After this exercise, you should have enabled the Advertised Programs Client
Agent.

Exercise 3: Configuring a Distribution Point
Scenario
You need to configure the distribution point to use BITS in order to minimize the
network bandwidth consumed by communication between clients and the
distribution point.
The main task for this exercise is to configure the distribution point.
Task: Configure a distribution point

1. In the Configuration Manager console, navigate to Site Systems, and then
expand \\NYC-CFG1.
2. Open the ConfigMgr distribution point Properties dialog box.
3. Select Allow clients to transfer content from this distribution point using
BITS, HTTP, and HTTPS (required for device clients and Internet-based
clients).
4. Verify that Allow intranet-only client connections is selected.
Results: After this exercise, you should have configured a BITS-enabled distribution
point.

Lesson 4
Creating and Populating Collections
After preparing the site for software distribution, you can create software
distribution objects. In Configuration Manager, software distribution is always
targeted to a collection. In this lesson, you will learn how to create and manage
collections.
• Describe the collections.
• Explain how to create a collection.
• Explain how to populate collection membership.
• Describe subcollections, and how to create them.

Overview of Collections
Key Points
A collection is a unit of management, reporting, and security. Collections provide a
means to discern which computers, devices, users, or other resources you will
manage or use for the task at hand.
For example, you could create a collection that includes all workstations without a
specific antivirus application installed. You could then advertise the antivirus
software to the collection. After the antivirus software is installed on a member of
the collection, that client will report the newly installed software during its next
inventory cycle. Once the site database updates, you can update the collection
membership to see that the computers that reported the newly installed software
are no longer members of the collection.
Collection membership can be direct or query-based:
• Direct membership is a way to manually define a collection by specifically
selecting the resources that you want to be members.

• Query-based membership is a way to dynamically populate your collection.
This means that you do not specify the individual resources that are to be
members of the collection. Instead, you define the rules by which those
resources are placed in the collection. These rules are defined as queries, and
Configuration Manager periodically reruns these queries to keep the collection
up to date.
Question: Do collections only contain computer resources?


Creating a Collection
Key Points
You can create a new collection by using the New Collection Wizard. When
creating a collection, you can specify the following elements:
• Name. Each collection requires a unique name.
• Membership rules. Membership rules define which resources are in the
collection. Membership rules can be query-based, or define direct membership.
Direct membership rules establish static membership for specific resources.
Query-based rules establish dynamic membership based on criteria you define.
• Update schedule. By default, all custom collections are updated daily at the
time of day that the collection was created. You can customize the collection
update schedule, or even choose not to update the collection on a schedule.

• Security settings. Security settings allow you to define collection access rights
by user, or by group. For example, you may want to permit other

administrators to read a collection and use the remote tools to connect to its
members, but reserve for yourself the right to modify or delete the collection.
Question: By default, how often are collections evaluated?


Collection Membership
Key Points
Collection membership rules can be either direct, or query-based:
• Direct membership rules allow you to manually specify which resources are to
be collection members. This method offers the most control over membership.
However, because membership is static, you will need to update direct
membership rules if the collection membership should be changed. For
example, if you use direct membership rules to define a collection of user
resources for a project pilot, you will need to change the direct membership
rules as users in the pilot group change.
• Query-based membership rules allow you to create collections in which
membership is dynamic. Instead of specifying the individual resources in the
collection, you define the criteria by which membership is established. Each of
these rules is a query. Configuration Manager periodically runs the query to
update the collection.
You can include both direct and query-based membership rules in the same
collection.

Important: You should always update collection membership and verify the
members displayed before advertising a program to a collection that includes
query-based membership rules. Failing to do so could cause serious problems. For
example, if, during the business day, you advertise a program that requires a restart
to a collection that inadvertently includes servers, you could cause unexpected
downtime or even cause loss of data on the servers that are forced to restart.
Question: How can you update the collection membership manually?


Demonstration: Creating and Populating Collections
Key Points
In this demonstration, you will see how to create and update collections.
Demonstration Steps
Configure a new collection by using a direct membership rule

Computer Management, and then expand Collections.
2. Right-click Collections, and then click New Collection.
3. In the New Collection Wizard, on the General page, in the Name box, type a
unique name for the collection, and then click Next.
4. On the Membership Rules page, click the new direct membership rule
(computer icon) button.
5. Use the Create Direct Membership Rule Wizard to create the direct
membership rule.

Configure a new collection by using a query-based rule.

3. In the New Collection Wizard, on the General page, in the Name box, type a
unique name for the collection, and then click Next.
4. On the Membership Rules page, click the new query-based membership rule
(gold cylinder icon) button.
5. Use the Query Rule Properties dialog box to create the query-based
membership rule.
Update collection membership and verify the members of the

collection
2. Right-click a collection, and then click Update Collection Membership.
3. In the Collection_name dialog box, click OK. An hourglass symbol will appear
next to the collection icon.
4. Right-click the collection, and then click Refresh. The hourglass symbol
changes to a different style. After a few moments, the hourglass should
disappear.
5. After the hourglass disappears, review the list of collection members in the
details pane.

What Is a Subcollection?
Key Points
You can associate one collection with another by specifying a subcollection.
When working with subcollections, keep in mind:
• You can use the New Collection Wizard to create a subcollection as a new
subcollection, or you can link to an existing collection. If you create a
subcollection as a link to an existing collection, then the link is a reference to
the existing collection; it is not a duplicate collection. You can delete any
reference to the existing collection (subcollection link or original collection
definition) without actually deleting the collection, as long as at least one
reference to the collection remains. However, if you delete all references to the
collection, then the collection itself will be deleted.
• By using linked subcollections, a single collection can be a subcollection of
multiple collections. For example, you might create a collection for computers
in a particular branch office, then create a subcollection link to make the
branch office a subcollection of several different collections used to target
deployment of different software applications.

• The reference between subcollections and their parent collections are the only
association between the two collections. Members of subcollections are not

inherently members of their parent collection, and subcollection membership
is not limited to members of the parent collection. A collection’s settings and
membership rules do not apply to or affect its subcollections.
• When you advertise a program to a collection, by default, the advertisement
also applies to the collection’s subcollections. You can clear the Include
subcollections check box if you do not want the advertisement to apply to
subcollections.
• Most of the actions that you perform on a collection can also be performed on
its subcollections. For example, you can update subcollections by selecting the
Update subcollection membership option when you update the parent
collection.

Demonstration: Creating a Subcollection
Key Points
• Create a new subcollection.
• Configure a linked subcollection.
Create a new subcollection

2. Select and right-click a collection, point to New, and then click Collection.
3. Use the New Collection Wizard to create the collection.

Configure a linked subcollection

2. Select and right-click a collection, point to New, and then click Link to
Collection.
3. In the Browse Collections dialog box, select the appropriate collection, and
then click OK.

Lesson 5
Configuring Collections
Although most client settings affect all clients in the site, Configuration Manager
2007 allows you to manage some settings—such as maintenance windows and
restart settings—by collection. In this lesson, you will learn how to configure
collection-level client settings.
• Describe the collection-specific settings.
• Explain how to configure maintenance windows.
• Explain how to manage maintenance windows.

Collection-Specific Settings
Key Points
In Configuration Manager 2007, you can configure a number of settings by
collection. These collection-level settings include:
• Maintenance windows. Maintenance windows allow you to specify a time for
mandatory advertisements and task sequences. Unless you specify a
maintenance window, mandatory advertisements occur at the earliest time that
all conditions for the advertisement are satisfied.
• Collection variables. Collection variables allow you to define custom variables
and their values for use in task sequences. For example, you could create a
task sequence that uses a variable to designate which server to access for
downloading a file, then set different values to that variable for different
collections.
• Restart settings. The Computer Client Agent allows you to configure restart
settings for all clients in the site. However, you can override those settings for
members of a collection.

• Policy polling interval. The Computer Client Agent allows you to configure the
policy polling interval for all clients in the site. However, you can override that
setting for members of a collection.
• Automatic provisioning for out of band management. For computers that
support out of band management, you can configure automatic out of band
management controller provisioning. This enables out of band management
for the members of the collection that support that function.

Managing Maintenance Windows
Key Points
Maintenance windows allow you to configure a specific period of time during
which mandatory advertisements and task sequences can run on the client.
Assigning a specific start time for an advertised program does not ensure that the
program runs at that specific time. However, you can assign maintenance windows
to ensure that assigned programs do not run, and that Configuration Manager-
triggered restarts do not occur at inconvenient or undesirable times.
What Maintenance Windows Do Not Affect

Maintenance windows limit when Configuration Manager can cause the client to
run assigned programs and restart the computer. Other types of Configuration
Management processes are not limited to maintenance windows.
Configuration Management processes that are not limited to maintenance
windows include:
• Policy downloads
• Inventory and metering data collection and reporting

• Desired configuration management baseline evaluation and reporting
• Remediation for Network Access Protection

• Transmission of Wake On LAN wake-up packets
• Certain content downloads
• Advertisements or task sequences that are specifically configured to ignore
maintenance windows.
Clients with Multiple Maintenance Windows

When using maintenance windows, it is not uncommon for a client computer to be
a member of more than one collection with active maintenance windows. When
client computers are members of two or more collections with active maintenance
windows, the maintenance windows will be a union of the defined collection
windows.
For example, PC1 is a member of Collection A, Collection B, and Collection C:
• Collection A’s maintenance window is: 5 P.M. to 8 P.M.
• Collection B’s maintenance window is: 4 A.M. to 7 A.M.
• Collection C’s maintenance window is: 7 P.M. to 11 P.M.
Therefore, PC1’s maintenance windows will be 4 A.M. to 7 A.M., and 5 P.M. to 11

P.M.
Best Practices
• If you use maintenance windows to restrict system changes, you should create
collections specifically for this purpose instead of using the default collections
or other custom collections.
• Include in the name of the collection a description of the maintenance window
for easy identification.

Other Considerations
• A mandatory advertisement will not run during a maintenance window that is

shorter (or has less time remaining) that the program’s configured maximum
run time.
• If the maximum run time of an advertised program is configured as Unknown,
then the program may run past the end of a maintenance window.
Question: If a computer is a member of multiple collections with different

maintenance windows, which window applies?
Question: If a computer’s next hardware inventory cycle is scheduled to occur at

1:00 P.M. today, and if the computer’s next maintenance window is configured to
occur from 2:00 A.M. to 7:00 A.M. tomorrow, then when will the hardware
inventory cycle occur?

Working with Maintenance Windows
Key Points
• You configure maintenance windows by selecting the collection and clicking
Modify Collection Settings in the Actions pane.
• You can easily identify collections with maintenance windows by viewing the
maintenance window column on the Collection node within the console.
• To determine maintenance windows for a particular computer, review the
Maintenance Windows Available to a Particular Client report.

Demonstration: Configuring a Maintenance Window
Configure a maintenance window for a collection:

1. In the Configuration Manager console, expand Site Database (site), and
expand Computer Management and then navigate to Collections.
2. Select and right-click a collection, and then click Modify Collection Settings.
3. In the Collection_name Settings dialog box, on the Maintenance Windows tab,
click the New (star) icon.
4. In the <new> Schedule dialog box, in Name, type a name for the maintenance
window.
5. In the Time and Recurrence pattern areas, configure a schedule for the
maintenance window.
6. Click OK to close the <new> Schedule dialog box.
7. Click OK to close the Collection_name Settings dialog box.

Lab B: Creating and Configuring a Collection
Lab Setup
Pa$$w0rd.

Scenario
Contoso, Ltd needs a number of applications distributed to its workstations. These

applications must be deployed overnight. As the administrator of the Contoso
Configuration Manager 2007 site, you need to create a collection for this upcoming
software distribution. However, because you will first test the deployment, you
need to include only one test computer in the collection. Additionally, you need to
configure a maintenance window and collection-specific restart settings for the new
collection.

Exercise: Creating a Collection for Software Distribution
Scenario
You need to create the collection for software distribution, add a maintenance
window, and configure a collection-specific restart countdown.
The main tasks for this exercise are:
1. Create and populate a collection.
2. Add a maintenance window for the collection.
3. Add a collection-specific restart countdown.
Task 1: Create and populate a collection

1. On NYC-CFG1, open the Configuration Manager console, and then navigate to
Collections.
2. Start the New Collection Wizard, and provide the following information:
• Name: Deploy Office Viewers
• Include only NYC-CL1 by direct membership rule.
3. Browse to the Reports node and then run the All collections report.
4. Click the arrow next to the Deploy Office Viewers collection.
Question: Which computers are listed as collection members?


Task 2: Add a maintenance window for the collection
1. In the Configuration Manager console, navigate to Collections.

2. Select Deploy Office Viewers, and click Modify Collection Settings.
3. Add a new maintenance window.
4. Configure the maintenance window schedule by using the following
information:
• Name: Daily 1am-4am
• Start: 1:00:00 AM
• End: 4:00:00 AM
• Recurrence pattern: Daily
5. Refresh the list of collections, and verify that the Deploy Office Viewers
collection has a maintenance window.
Task 3: Add a collection-specific restart countdown

1. In the Configuration Manager console, navigate to Collections.
2. Select Deploy Office Viewers, and click Modify Collection Settings.
3. On the Advanced tab of the Deploy Office Viewers Settings dialog box, select
Enable collection specific restart settings.
4. Change the Restart countdown (minutes) to 3 minutes.
Results: After this exercise, you should have configured a collection-specific restart
countdown for the Deploy Office Viewers collection.

Lesson 6
Creating and Configuring Packages and

Programs
Packages and programs are an essential part of software distribution.

Configuration Manager packages define the files needed to install software.
Programs provide instructions on what command to run in the package source.
Both are needed for software distribution to function. In this lesson, you will learn
how to create packages and programs.
• Describe the purpose of packages and programs.
• Describe the package source directory, and how it is used.
• Explain how to create a package at a high level.
• Describe the package home page.
• Explain how to create and manage programs.
• Explain how to install software using a task sequence.

What Are Packages and Programs?
Key Points
Configuration Manager relies on packages and programs for software distribution.
• A package contains the files that a client needs in order to run a program.
• A program is the command that a client runs in order to process the package.
For example, you may want to use Configuration Manager 2007 to deploy a new
software application to computers in your company. The package would contain
the installation files from the application’s source media. The program would be
the command—such as setup.exe /unattended—that installs the application.
A package can contain whatever files that you want to deliver to the target
computers. For example, a package could contain updates to an application that is
already installed on the client. A package could contain data files that should be
copied to the client. You can even create an “empty” package that contains no
source files, if you want to use Configuration Manager to run an executable that
already exists on the client.

A program consists of the command that you want to run on the client, and
settings that affect how the client should run the command. For example, if you are
using Configuration Manager to deliver data files to a specific directory on the
client, then the command could be the .bat or .cmd file that contains xcopy
commands needed to copy the data files to the correct location. Additionally, you
can configure the program to run the command as hidden, so that the user does
not see the copy occur. If the command needs to be run with administrative rights,
or if another program must be run first, then you can configure those options in
the program.
Packages can include multiple programs. For example, if a package contains the
installation files for an application suite, then you could create a separate
installation program for each application in the suite. You could also create a
program that installs the entire suite at once. You could even create a program that
uninstalls the applications.
Package Definition Files

You do not necessarily need to create all packages and programs manually. Some
applications include in their source media, package definition files that allow you
to automatically create packages and their respective programs. Package definition
files specify package properties—such as name and version—and one or more
program definitions. Program definitions in package definition files include the
program command, and can include other properties, such as disk space
requirements and supported client processors and operating systems. When you
create a package by using a package definition file, you must specify the location of
the package source files.
Question: What is not contained in a package definition file?


The Package Source Directory
Key Points
If your package will contain source files, then you need to specify the location of
those source files when you create the package. When you do, Configuration
Manager copies to the site server all of the files and folders in the package source
location that you specified.
You can specify as the package source directory either a universal naming
convention (UNC) path or a path from a local disk on the site server.

Creating a Package
You can use the New Package Wizard to create a package. You launch this wizard
from the Packages node under Software Distribution in the Configuration Manager
console.
When you create a new package, some of the settings you can configure include:
• Name. You must specify a unique name for each new package.
• Data source, if applicable. If the package contains source files (as most do),
then you must specify the location of the package source directory. The
package source directory may be specified as either a UNC path, or a local
path on the site server.
• Distribution settings. You can specify the priority and preferred method for
copying the package to other sites. You can also configure how branch
distribution points will acquire the package, and whether the package can be
transferred via multicast during the Windows Preinstallation Environment
(Windows PE) phase of operating system deployment.

• Reporting information. You can specify the information used to identify which
Management Information Format (MIF) file to use for status reporting.

• Security rights. You can configure administrative users’ rights to the package
object.
You can use the Create Package from Definition Wizard (to configure a package
and one or more programs automatically), by importing a package definition file
(.sms) or Microsoft Installer (.msi) file. If you use a package definition file to create
a package, then you must specify the location of the package source directory. If
you use an .msi file to create a package, then the location of the .msi file is
automatically configured to be the package source directory.
Question: In addition to specifying the source directory, what other option must
you select if you want to use the Update distribution points on a schedule option
on the Data Source page?

Package Home Pages
Key Points
Each package has its own home page that displays nodes containing additional
information about the package. A package’s home page displays the following
nodes:
• Access Accounts. You can use the Access Accounts node to configure custom
user permissions for the package.
• Distribution Points. You can use the Distribution Points node to add, manage,
and update the distribution points to which the package is copied.
• Programs. You can use the Programs node to add and manage the package’s
programs.
• Package Status. You can use the Package Status node to review a summary of
the package’s distribution status.

Question: Where else can you find the distribution status for a package?

Managing Programs
Key Points
Although packages contain the files that you distribute to clients, you advertise
programs, not packages. Thus, you cannot distribute a package to clients unless it
has at least one program.
Programs consist of a command line—including any parameters—that processes the
package on the client, and additional information—such as requirements and
settings that affect how the command will be run. Each package can contain
multiple programs. For example, in an application package, you might have one
program that performs an attended installation of the application, another program
that performs an unattended installation, and a third program that uninstalls the
application.

When you create a program, you specify the following information:
• Program name. Each program requires a name that is unique within the
package.
• Command line. Each program requires a command line. The command line is
the command that the client will run, including any parameters required to
elicit the desired behavior.
• Requirements. Requirements define constraints for the program, such as
maximum allowed run time, and the platforms on which the program can run.
• Environment. Environment settings establish the conditions necessary for the
program, such as whether the program needs to run with administrative rights,
or with the command accessed by using a specific drive letter.
• Advanced settings. Advanced settings establish any dependencies or special
settings for the program. For example, a program may require that another
program be run first, or that the program be run for every user who logs on to
the computer.
• Windows Installer product information. The Windows Installer settings
display Windows Installer identification information, but only if you import an
.msi file in order to enable installation source management for the program.
• MOM Maintenance Mode settings. The Microsoft Operations Manager (MOM)
Maintenance Mode settings allow you to specify settings for interacting with
MOM or Microsoft System Center Operations Manager. For example, you can
configure the program to generate an Operations Manager alert if the program
fails.
To delete a program, right click-the program, select Delete, and use the Delete
Program Wizard to complete the process.
You may want to disable a program in order to keep it from running on computers
where it is advertised. To disable a program, on the <Program> Properties dialog
box, on the Advanced tab, select the Disable this program on computers where
it is advertised check box. To enable a disabled program, clear the Disable this
program on computers where it is advertised check box.
Question: On which page of the New Program Wizard can you enable program
dependencies?

Installing Software Packages as Part of a Task Sequence
Key Points
Software distribution delivers packages to clients when programs are advertised to
collections. However, Configuration Manager can also deliver packages to
computers by including a program as a step in an Operating System Deployment
task sequence.
Installing a program during a task sequence allows you to install applications:
• Immediately after installing the operating system.
• By using multicast transmission during the Windows PE phase of Operating
System Deployment.
• Synchronously, ensuring that a task finishes before the next task in the
sequence begins.
• Before any user logs on to the computer.
Because packages installed as part of a task sequence are installed before users log
on, the packages you configure as part of a task sequence must run without user

intervention. For this reason, when you install a package by using a task sequence,
Configuration Manager ensures that the package meets these requirements.

To install a package as part of a task sequence:
1. Select the task sequence, then right-click and select Edit.
2. Select the step during which you want to install the package, click Add, click
General, and then click Install Software.
3. Select Install a single application, and then specify the package and program.
Or, select Install multiple applications, and then specify the common base
variable name that includes the series of applications for installation.
Question: What level of user interaction is required for a program that installs a
package during a task sequence?

Demonstration: Creating Packages and Programs
Key Points
• Create a package manually.
• Configure a program manually.
• Create a package and programs from a package definition file.
Create a package manually

1. In the Configuration Manager console, navigate to Software Distribution.
2. Start the New Package Wizard.
3. On the General page, specify the name of the package. Include other
information if desired.
4. On the Data Source page, specify the location of the package source files
5. On the Data Access page, specify the distribution settings for the package.

Configure a program manually

1. In the Configuration Manager console, navigate to the package’s Programs
node.
2. Start the New Program Wizard.
3. On the General page, specify the name of the program, the command line with
any necessary parameters, and any other desired settings.
4. On the Requirements page, configure any necessary program constraints.
5. On the Environment page, configure any necessary program conditions.
6. On the Advanced page, configure any required dependencies.
Create a package and programs from a package definition file

2. Start the Create Package from Definition Wizard.
3. On the Package Definition page, browse to and select the .pdf, .sms, or .msi
file.
4. On the Source Files page, specify whether the package has source files and, if
so, whether to create a compressed version, or always obtain the files from the
source directory.
5. If the package contains source files, on the Source Directory page, configure
the location of the package source directory.
Question: If the Maximum allowed run time option is set to Unknown, how long
will Configuration Manager allow the program to run?

Lab C: Creating a Package and Configuring
Programs
Lab Setup
Pa$$w0rd.

Scenario
As the administrator of the Contoso Ltd Configuration Manager site, you are
preparing to distribute a set of applications to Contoso workstations. You need to
create the package and programs necessary for distributing the software.

Exercise: Creating a Package and Configuring Programs
Scenario
You need to create the package and programs necessary for the upcoming software
distribution.
The main tasks for this exercise are:
1. Create the package.
2. Configure the first program.
3. Configure the second program.
Task 1: Create the package

2. Start the New Package Wizard.
3. On the General page, configure the following:
• Name: Office Viewers
• Version: 2007
• Manufacturer: Microsoft
• Language: English
• Comment: Package by your name on today’s date
4. On the Data Source page, configure the data source as
\\NYC-CFG1\Labfiles\Software\Office Viewers.
5. On the Data Access page, configure the following:
• Verify that Access distribution folder through common ConfigMgr
package share is selected.
• Select Disconnect users from distribution points.
6. Refresh the Packages node, and verify that the package named Microsoft
Office Viewers 2007 English exists.


Task 2: Configure the first program

1. In the Configuration Manager console, navigate to Microsoft Office Viewers
2007 English.
• Name: PowerPoint Viewer
• Command line: “PPTViewer\PowerPointViewer.exe” /q
Note: The command line must be typed exactly as shown. The /q option configures
the program to run silently.
• Category: Office Viewers

4. On the Requirements page, configure the following:
• Estimated disk space: 563 MB
• Maximum allowed run time: 5 minutes
5. On the Environment page, configure the following:
• Program can run: Only when a user is logged on.
• Run mode: Run with administrative rights
• Do not select Allow users to interact with this program.
Task 3: Configure the second program

1. In the Configuration Manager console, navigate to Microsoft Office Viewers
2007 English.

• Name: Visio Viewer

• Command line: “VisioViewer\visioviewer.exe” /q
Note: The command line must be typed exactly as shown. The /q option configures
the program to run silently.

4. On the Requirements page, configure the following:
• Estimated disk space: 190 MB
• Maximum allowed run time: 5 minutes
5. On the Environment page, configure the following:
• Run mode: Run with administrative rights
• Do not select Allow users to interact with this program
6. On the Advanced page, configure the following:
• Select Run another program first.
• Package: Microsoft Office Viewers 2007 English
• Program: PowerPoint Viewer
Results: After this exercise, you should have verified creation of both the Office
Viewers package, and the two programs it contains.

Lesson 7
Distributing Packages
Another key phase of software distribution is distributing the package. Distribution

sends the files to particular distribution points, where they can act like installation
media for clients to which a program is advertised. In this lesson, you will learn
how to distribute a package to distribution points.
• Explain how to manage packages on distribution points.
• Explain how to manage branch distribution points.
• Explain how to distribute packages to branch distribution points.

Managing Distribution Points
Key Points
If your package contains source files, then clients will have to retrieve the package
before they can run any of the package’s programs. Thus, before you advertise a
program to a collection, you need to place the package that contains the program
on at least one distribution point.
Several wizards exist to help you manage the packages on your distribution points:
• New Distribution Points Wizard. The New Distribution Points Wizard allows
you to copy the package to distribution points that do not already contain the
package.
• Manage Distribution Points Wizard. The Manage Distribution Points Wizard
allows you to perform a number of tasks, including copying the package to
new distribution points, removing the package from distribution points, and
refreshing the package on distribution points where the package is already
stored.

Note: Use caution when using removing packages from distribution points. If
remaining advertisements depend on the removed package, and if the client is
unable to retrieve the package from another distribution point, then the dependent
advertisements will fail.
• Copy Packages Wizard. The Copy Packages Wizard allows you to copy
multiple packages to a single distribution point, which is useful if you have
added a new distribution point to your site.
• Update Distribution Points Wizard. The Update Distribution Points Wizard
allows you to send the latest version of a modified package to all distribution
points on which the package is already stored.
Question: Which wizard allows you to update only one distribution point?
Question: Which wizard allows you to copy a new package to multiple

distribution points?

Managing Branch Distribution Points
Key Points
In small or remote office deployments, installing a secondary site or standard,
server-based distribution point may be impractical. You can, however, support
such locations by installing one or more branch distribution points on existing
servers or workstations.
Note: The branch distribution point is the only Configuration Manager site system
that can be installed on a workstation-class operating system.
The management tasks for branch distribution points include the following:
• Prestaging packages. You can manually copy a package to a branch
distribution point in order to avoid transferring the package over a limited-
bandwidth network connection.

• Configuring on-demand distribution for packages. You can configure
individual packages for on-demand distribution through branch distribution

points that do not already store a copy of the package. This option allows you
avoid unnecessarily copying a package to branch distribution points where it
is not needed.
• Deleting packages. In order to conserve disk space on a branch distribution
point, you may wish to delete packages that are no longer needed.
• Restoring packages. If one or more packages on a branch distribution point is
lost, then you may need to restore them.
Question: After copying the package files to the distribution point, what must you
do in order to complete the process of prestaging a package on a branch
distribution point?

Demonstration: Managing Distribution Points
Key Points
In this demonstration, you will see how to manage distribution points.
Manage distribution points

2. Expand the package that you want to manage, right-click Distribution Points,
and then click Manage Distribution Points.
3. In the Manage Distribution Points Wizard, select the option of the
management task you want to perform.
Question: In addition to adding a package to a distribution point, what other tasks

can be accomplished by using the Manage Distribution Points Wizard?

Lesson 8
Advertising Programs
The final step in distributing software to clients is advertising programs.

Advertising offers packages to particular users and computers. In this lesson, you
will learn how to distribute a package and create an advertisement.
• Describe advertisements.
• Explain how to create advertisements.
• Describe the options for managing advertisements.
• Explain how clients retrieve information about an advertisement.
• Explain how clients run an advertised program.

What Is an Advertisement?
Key Points
An advertisement is an object that notifies members of a collection that a specific
program in a package is available for installation. When you advertise a program,
you specify:
• The package that contains the program.
• The program that is to be run.
• The collection that will run the program.
Options that you can specify in an advertisement include:

• When the program is available.
• Whether the program is mandatory and, if so, when the program must be run.

• Whether to ignore maintenance windows for running the program or restart.
• Whether clients retrieve the associated packaged over a slow boundary.
Note: Advertisements no longer replicate to secondary sites. You can assign clients
only to primary sites.

Creating and Configuring Advertisements
Key Points
Each advertisement specifies exactly one package, one program, and one collection
(along with its subcollections, if applicable). The advertisement defines when a
program is available for execution. If the advertisement is mandatory, then it also
specifies the run schedule, whether Configuration Manager will wake up the client
before execution, and whether the program can ignore maintenance windows.
Creating Advertisements
You can create advertisements by using a number of different wizards, including:
• New Advertisement Wizard. The New Advertisement Wizard allows you to
create only the advertisement. You must first create the package, program, and
collection in order to use this wizard to create an advertisement.
• Distribute Program Wizard. The Distribute Program Wizard allows you to
place an existing package on one or more distribution points, and create an
advertisement for a specific existing program that targets either a new or
existing collections.

• Distribute Package Wizard. The Distribute Package Wizard allows you to place
an existing package on one or more distribution points, create an

advertisement for any existing program in the package, and target either a new
or existing collection.
• Distribute Software to Collection Wizard. The Distribute Software to
Collection Wizard allows you to create the package and place it on one or
more distribution points, create the program, create a collection, and create an
advertisement. (This wizard also allows you to select an existing package,
program, and collection.)
Important: Before you advertise a program to your clients, you should thoroughly
test the program in a controlled environment.
Configuring Advertisements
Regardless of which wizard you use, when you create an advertisement, you can
specify the following options:
• Name. Each advertisement requires a unique name.
• Package and program. You must select one package and one program from
that package.
• Collection and subcollections. You must select one collection as the target of
the advertisement. Additionally, you must specify whether the advertisement
also applies to the target collection’s subcollections.
• Schedule. You must specify when the advertisement is available. Optionally,
you can specify a mandatory assignment schedule, whether the mandatory
assignment should invoke Wake On LAN, and whether the mandatory
assignment ignores maintenance windows for running the program or
rebooting the client.

• Retrieval method. You must specify whether clients should first download the
entire package to their client cache and then run the program locally, or run
the program from the distribution point. The Run program from distribution
point option instructs the client to use server message block (SMB) to connect
to the distribution point and retrieve the package files as needed to run the
program. You can specify different retrieval methods for clients depending on
whether they are connected to a fast network boundary or a slow or unreliable
network boundary. You can also specify that clients on a slow or unreliable
network boundary do not run the package. You configure the advertisement to
allow clients to use an unprotected distribution point if the package is not
available on a protected distribution point.
• Interaction. If you schedule a mandatory assignment for the advertisement,
you can also specify whether users can run the program independently of
assignments, whether reminders will still appear if they do run independently,
and whether a custom countdown should be used for the advertisement.
Modifying Advertisements
You can modify an existing advertisement by right-clicking the advertisement,
selecting Properties, changing the settings you want to modify, and then clicking
OK.
Question: Which new feature allows computers to be powered up when an

advertisement is pending?
Question: Why must the advertisement be created only after the other three
distribution objects have been created?

Managing Advertisements
Key Points
Other tasks associated with managing advertisements include:
• Deleting advertisements. You can delete advertisements that are no longer
needed. Deleting unnecessary advertisements decreases the size of the policy
downloaded by the client
• Disabling and enabling programs. Advertisements cannot be disabled.
However, if you do not want an advertised program you run, you can disable
the program. If you disable a program, it is disabled for all advertisements. You
can re-enable disabled programs in order to allow the advertised program to
run.
• Re-running advertisements. You can cause clients to re-run mandatory
advertisements that have already been run. However, an advertisement can be
re-run only if the mandatory assignment schedule has not expired.
• Viewing status of advertisements. You can determine the status of an
advertisement in order to monitor the software distribution process.
Advertisement status is available within the System Status node.

Demonstration: Creating an Advertisement
Key Points
In this demonstration, you will see how to create an advertisement.
Create an advertisement
2. Start the New Advertisement Wizard.
3. On the General page, specify the following:
• Advertisement name
• Package
• Program
• Collection
4. On the Schedule page, specify advertisement availability, any mandatory
assignments, and options related to scheduling.

5. On the Distribution Points page, specify the retrieval options for the package.
6. On the Interaction page, specify the user interaction options.

7. On the Security page, customize security rights, if necessary.
8. Complete the New Advertisement Wizard.
Question: What are the four required settings in an advertisement?


Client Policy and Advertisements
Key Points
When you use the Configuration Manager console to make a change that affects
clients, client policy is updated, and then sent to the management point.
Policy Assignments and Policy Bodies

Client policy consists of policy assignments and policy bodies. Policy bodies are
the actual policy settings—such as “hardware inventory is enabled” or “package
X0100004 is available for installation.” Each policy assignment is a reference, or
pointer, to a specific policy body. During each policy polling interval, the client
downloads from the management point a list of policy assignments; the list is
filtered so that only the assignments that apply to the client are downloaded. Once
the client receives the list of policy assignments, it uses the pointers to find and
download the corresponding policy bodies from the management point.

Delta Downloads and Caching
During the first policy retrieval, the client downloads all the policy assignments
and policy bodies that apply. However, during each subsequent polling interval,
the client only downloads the policies that have changed. To conserve network
bandwidth, policy bodies are cached. However, policy assignments are not cached;
and the client does not apply cached policy bodies if the policy assignment no
longer applies. This process ensures that the client always gets the currently
applicable policy assignments and, thus, an up-to-date overall policy.
Question: Which portion of a policy contains the actual policy settings?


How the Client Runs an Advertised Program
Key Points
When the client finds an advertisement and prepares to run the program, the agent
connects to an available distribution point to transfer or run the program. Then the
agent executes the program appropriately.
Advertised programs can be mandatory or optional. Mandatory advertisements can
be configured to run:
• As soon as possible
• After the next logon
• After the next logoff
• At a specific date and time
• On a recurring schedule

As a user, you can access the advertised programs that the Configuration Manager
client makes available to network computers by clicking Run Advertised

Programs in Control Panel. You also can filter the list of programs to display
those that belong to a specific category only. Similar to Run Advertised Programs,
you also can run an advertisement from the Add or Remove Programs within the
Add new programs page.
Question: If a program is configured to run only when no user is logged on, and if
that program is advertised to run after the next logon, when will the program run?

Lesson 9
Monitoring and Troubleshooting Software

Distribution
You will want to monitor software distribution to ensure that software deploys
correctly. Configuration Manager provides several methods to monitor and
troubleshoot software distribution. In this lesson, you will review software
distribution troubleshooting options and best practices.
• Describe the methods used to monitor and troubleshoot software distribution.
• Describe Software Distribution home page features.
• Describe how status messages and status message queries help troubleshoot
advertisement and package issues.

• Describe the software distribution reports that you use to monitor software
distribution.
• Describe the software distribution log files that you use to monitor software
distribution.
• Explain how to use the Client Spy utility to monitor software distribution.
• Describe and apply best practices for securing software distribution.

Software Distribution Monitoring and Troubleshooting
Methods
Key Points
You have many options available to review and troubleshoot Software Distribution,
including:
• Home pages
• Software Distribution home page
• Packages home page
• Advertisements home page
• Software distribution reports
• Status messages

• Software distribution log files
• Client Spy
Question: Which monitoring and troubleshooting method provides a quick

overview of software distribution?

The Software Distribution Home Page
Key Points
The Software Distribution home page in the console tree displays summary
information for advertisements to clients. The information displayed includes:
• Top 10 active advertisements. The top 10 active advertisements for the past
seven days are displayed by default, but you can change the setting to display
the top 10 for the last day, or the last 30 days.
• Graphical summary of the selected advertisement. If you select an
advertisement from the list of top 10 active advertisements, then a chart that
displays a graphical summary of that advertisement’s status displays.

• Links to related home pages, reports, and help content. The bottom section of
the Software Distribution home page includes links to other related

information, including the following:
• Navigation. The Navigation list includes links to other status home pages,
such as the Advertisements home page.
• Web Reports. The Web Reports list includes links to software distribution
reports.
• Resources. The Resources list includes links to software distribution
information in the Configuration Manager help file.
Question: How can you display a graph depicting status for an advertisement?

Software Distribution Status Messages
Key Points
You can use the System Status node to obtain status information and status
messages related to software distribution. The System Status node includes the
Package Status and Advertisement Status home pages. The Status Message
Queries node includes a number of status messages that you can use to
troubleshoot various aspects of software distribution.
Package Status Home Page

The Package Status home page displays an overview packages status. Package
Status information pertains to the transfer of packages to assigned distribution
points. From this page, you can display status messages related to the distribution
of any package.

Advertisement Status Home Page
The Advertisement Status home page displays an overview of the advertisement

status. Advertisement status pertains to the advertisement of programs to clients.
You cannot access status messages directly from the Advertisement Status home
page. However, from the Advertisement Status home page, you can double-click
an advertisement to access that advertisement’s home page and, from there,
display status messages related to the processing of that advertisement at any listed
site.
Status Message Queries

Configuration Manager has several predefined status message queries that you can
use to review and troubleshoot software distribution issues, including:
• Advertisements Created, Modified, or Deleted
• All Status Messages for a Specific Advertisement at a Specific Site
• All Status Messages for a Specific Collection at a Specific Site
• All Status Messages for a Specific Package at a Specific Site
• Clients That Failed to Run a Specific Advertised Program Successfully
• Clients That Failed to Start a Specific Advertised Program
• Clients That Ran a Specific Advertised Program Successfully
• Clients That Received a Specific Advertised Program
• Clients That Rejected a Specific Advertised Program
• Clients That Started a Specific Advertised Program
• Packages Created, Modified, or Deleted
• Programs Created, Modified, or Deleted
Question: Which home page allows you to display status messages related to
transfer of packages to distribution points?

Software Distribution Reports
Key Points
Configuration Manager provides several predefined reports that you can use to
review and troubleshoot software distribution issues.
Software distribution report categories are:
• Software Distribution - Advertisement Status
• Software Distribution - Advertisements
• Software Distribution - Collections
• Software Distribution - Packages

Software Distribution Log Files
Key Points
You can use several log files to help troubleshoot software distribution issues in
Configuration Manager. Both client log files and server log files can be useful.
Client Computer Log Files

You can find the Configuration Manager client log files in one of the following
locations:
• On client computers that serve as management points, by default, the client
log files are located in the %ProgramFiles%\SMS_CCM\Logs folder.
Note: If Configuration Manager was installed to a drive other than the one on which
%ProgramFiles% exists, then the default location of the client log files will be the
Program Files\SMS_CCM\Logs folder on the drive where Configuration Manager was
installed.

• On all other computers, by default, the client log files are located in the
%Windir%\System32\CCM\Logs folder.
A few of the client log files that are useful when troubleshooting software
distribution are listed in the following table.
Log file Description

Execmgr.log Records the process of running advertised programs.
CAS.log (Content Access Service) maintains the local package cache.
CcmExec.log Records activities of the client and the SMS Agent Host
service.
LocationServices.log Records attempts to find management and distribution

points.
PolicyAgent.log Provides information about the process for downloading,

compiling, and deleting policies on client computers.
PolicyEvaluator Provides information about the process for evaluating

policies on client computers, including policies from
software distributions.
Smscliui.log Records usage of the Systems Management tool in Control

Panel.
Server Computer Log Files

You can find the Configuration Manager server log files in the %ProgramFiles%
\Microsoft Configuration Manager\Logs folder by default. A few of the log files
that are useful when troubleshooting software distribution are listed in the
following table.
Distmgr.log Provides information about the replication of software

distribution packages.
Replmgr.log Provides information about the process for replicating files

between sites.
Sender.log Records files that are sent to other child and parent sites.

Sched.log Records site-to-site job and package replication.
Question: Which client log file records the process of running advertised
programs?

Client Spy
Key Points
Client Spy, also referred to as the SMS Advanced Client Troubleshooting Tool,
allows you to troubleshoot a variety of client issues, including software
distribution, inventory and software metering. Client Spy displays software
distribution information by default.
Note: Client Spy is part of the System Center Configuration Manager 2007 Toolkit,
which is available for download from the Microsoft Download Center.
Software distribution information available in Client Spy includes:

• Software Distribution Execution Requests. The Software Distribution
Execution Requests tab displays current execution run requests for the
computer, and all users who have logged on to it.

• Software Distribution History. The Software Distribution History tab displays
information about all programs that have been run as a result of

advertisements, including last run time, and status of the last run.
• Software Distribution Cache Information. The Software Distribution Cache
Information tab displays information about the client cache configuration, all
packages stored in the cache, and items that are currently being downloaded
to the cache.
• Software Distribution Pending Executions. The Software Distribution
Pending Executions tab displays information about all scheduled executions—
both past and future. This tab also displays any optional advertisements that
have not been run on the client.
Question: Which Client Spy tab allows you to view status information about
programs that have already run?

Best Practices for Securing Software Distribution
Key Points
Software distribution is a powerful feature, and it can be a major point of attack for
your company if you do not secure it properly. When installing packages,
Configuration Manager can use elevated rights in either the user or the system
context, even if the user does not have administrative rights.
To help prevent attacks, follow these best practices.
Best practice Description

Do not create While Configuration Manager 2007 does not block you
distribution point shares from doing so, creating any type of distribution point on an
or branch distribution Internet-based client greatly increases your attack surface,
points on Internet- and you should avoid doing this. Create distribution points
based clients only on site systems that you can manage within the
intranet or the perimeter network.

Best practice Description
Secure software at the By default, administrators can fully access the package files
package-access level on distribution points, while users can only read them. Users
with administrative rights on client computers can set the
client to join any site, even if the computer is not within the
site’s boundaries. When the clients have joined the site, they
can receive any software distributions that are available at
that site, as long as the computer or user meets the
qualifications of the relevant collections. For this reason,
software that you want to limit to specific users should be
secured at the package access level, rather than by site
availability or collection criteria.
Always configure Configuring Download content from distribution point

advertisements to and run locally is more secure because Configuration
download content Manager verifies the package hash after the content
downloads, and discards the package if the hash does not
match the hash in the policy. If you configure the
advertisement to Run program from distribution point,
no verification takes place, and malicious users can tamper
with the content. If you must run the program from the
distribution point, use NTFS read-only permissions on the
packages on the distribution points, and use IPsec to secure
the channel between the client and distribution point, and
between the distribution point and the site server.
Remove the distribution By default, the site server is set up as a standard distribution
point role from the site point. However, you should assign this role to other site
server systems and remove it from the site server to reduce the
attack surface. Clients have no valid reason to talk directly
to the site server or any role configured on the site server.
After upgrading, if you SMS 2003 uses a different hash algorithm than
had packages in SMS Configuration Manager. To rehash all of the packages with
2003, update all the new algorithm, you should update all packages after
packages upgrade. Failing to do so might cause clients to discard
valid packages.

Lab D: Deploying Applications by Using
Software Distribution
Lab Setup
2. Ensure that the 6451B-NYC-DC1-D, 6451B-NYC-CFG1-D, and 6451B-NYC-
CL1-D virtual machines are running.
• 6451B-NYC-CL1-D: Windows 7 client in the Contoso.com domain.

3. If required, connect to the 6451B-NYC-CFG1-D and 6451B-NYC-CL1-D
virtual machines.
Pa$$w0rd.
• Log on to 6451B-NYC-CL1-D as Contoso\Andrea using the password
Pa$$w0rd.
Scenario
As the administrator of the Contoso, ltd Configuration Manager site, you are
preparing for an upcoming software distribution. The package and programs
required have already been created. A collection has also been created for the
deployment, and your test computer is the only member of the collection. You
need to place the package on a distribution point, create the program
advertisement, test the process on your test computer, and review the results of the
software distribution process.

Exercise 1: Distributing a Package to a Distribution Point
Scenario
You need place the new package on a distribution point so that clients can
download it during the software distribution process.
The main task for this exercise is to deploy the package to a distribution point.
Task: Deploy a package to a distribution point

2. Expand the Microsoft Office Viewers 2007 English package and start the
Manage Distribution Points Wizard. Place the package on the NYC-CFG1
distribution point.
3. Navigate to Reports.
4. Run the Distribution status of a specific package report.
5. Click the link for the Office Viewers package and review the linked report.
6. If the Install Status for NYC-CFG1 does not show Package Installation
complete, refresh the report periodically until it does.
Results: After this exercise, you should have verified that the Office Viewers
package has been distributed to the NYC-CFG1 distribution point.

Exercise 2: Advertising a Program to a Collection
Scenario
You need to advertise the program to the collection that contains your test
computer.
The main task for this exercise is to advertise a program to a collection.
Task: Advertise a program to a collection

2. Start the New Advertisement Wizard.
• Name: Deploy Office 2007 Viewers
• Package: Microsoft Office Viewers 2007 English
• Program: Visio Viewer
• Collection: Deploy Office Viewers
4. On the Schedule page, create a mandatory assignment by using the As soon
as possible option, and then complete the New Advertisement Wizard.
5. Navigate to Reports.
6. Run the All Advertisements report.
7. Click the arrow next to the Deploy Office 2007 Viewers report. Review the
report, and then close the report window.

8. Click the Software Distribution node, and then run a Home Page
Summarization.
9. Refresh the Home Page to view the status of the Deploy Office 2007 Viewers
advertisement.
Results: After this exercise, you should have verified that the Deploy Office 2007
Viewers advertisement has been created.

Exercise 3: Running an Advertised Program
Scenario
You need to advertise the program to the collection that contains your test
computer.
2. Review log files.
3. Modify an advertisement.
4. Install a software package.

2. On the Actions tab, select Machine Policy Retrieval & Evaluation Cycle, and
then click Initiate Action.

1. On NYC-CL1, use Trace32 to open the
c:\Windows\system32\ccm\log\execmgr.log file.
Note: You may need to wait up to five minutes or more for the information in the
following steps to be logged within the Execmgr.log file.
2. Find the mandatory execution entry in the log, and note the Advertisement
ID. Notice the following line states Create mandatory request for advert
Advertisement ID….
3. Find the line that contains the text WaitingDependency to WaitingContent,
and then notice the state change.
4. Find the line that begins with Content is available for program, and then
notice that the next log entry indicates the program cannot run because of a
service Windows restriction. This indicates that the program is waiting for
the next maintenance window.

5. Find the line that contains the text WaitingContent to
WaitingServiceWindow, and then notice the state change.

6. Close SMS Trace and Windows Explorer.
Task 3: Modify an advertisement

1. On NYC-CFG1, in the Configuration Manager console, navigate to
Advertisements.
2. Right-click Deploy Office 2007 Viewers, and then select Properties.
3. Click the Schedule tab.
4. Select Ignore maintenance windows when running program, and then click
OK. (Remember that you previously created a maintenance window on the
collection that prevents the installation from occurring.)
Task 4: Install a software package

1. On NYC-CL1, in the Configuration Manager Properties, click the Actions tab.
2. Select Machine Policy Retrieval & Evaluation Cycle, and then click Initiate
Action.
3. Click the New Program Available notice after it appears.
Note: Several minutes may pass before the notice appears.
4. In the Program Countdown Status dialog box, click Run.
Note: The program will run silently. Wait at least two minutes before proceeding to
the next step.

5. Open Programs and Features in Control Panel. Notice that both Microsoft
Office PowerPoint Viewer 2007 (English) and Microsoft Office Visio

Viewer 2007 appear in the list of installed programs. (Remember that you
configured the Office Visio® Viewer program to require the Office PowerPoint
Viewer program to run first. Also, recall that you configured the command line
for both programs to include the /q option.)
Results: After this exercise, you should have confirmed successful distribution of
both viewer applications to the test computer.

Exercise 4: Reviewing Results
Scenario
You need to review the results of your test deployment.
1. Review results.
2. Create an appropriate target collection and deploy Office Excel® Viewer
(challenge task—time permitting).
Task 1: Review results

1. On NYC-CFG1, in the Configuration Manager console, navigate to Software
Distribution.
2. Update the Software Distribution home page by running a Homepage
summarization task.
3. Verify that Deploy Office 2007 Viewers is highlighted.
Question: What colors display for Deploy Office 2007 Viewers under Status
for Selected Advertisement?
4. Click the Deploy Office 2007 Viewers link.

5. Review the Status of a specific Advertisement report for Deploy Office 2007
Viewers, and notice that 100 percent of resources have accepted the
advertisement and have installed Office Visio Viewer successfully. Close the
report.

6. Navigate to the Advertisement Status node.
7. Refresh the Advertisement Status node, and notice the Received, Program
Started, Program Errors, and Program Success information displayed for
Deploy Office 2007 Viewers.
Question: What Program Started value displays for Deploy Office 2007
Viewers? What Program Success value displays? How do these values compare
to the Received value displayed? If a discrepancy exists, why?
8. Double-click Deploy Office 2007 Viewers.

9. Show all status messages for NYC –Central Site - New York City.
10. Open Status Message ID 30006.
Question: Who created the package?
11. Open the status message with Message ID 3900, and then notice that the
Advertisement ID is listed.
client passed platform requirements.
program has not started.
14. Open the two status messages with Message ID 10005, and then notice that
the programs both started.
Question: What are the Command lines?
Question: What is the Working directory?
15. Open the two status messages with Message ID 10008, and notice that the
programs completed successfully.
Results: After this exercise, you should have reviewed the results of software
distribution.

Task 2: Create an appropriate target collection and deploy Office Excel
Viewer (challenge exercise—time permitting)

• Create an appropriate target collection and deploy Office Excel Viewer. Use
the following information:
• Source location: \\NYC-CFG1\Labfiles\Software\ExcelViewer
• Package creation method: Package from Definition
• Program to deploy: Per user unattended

click Revert.

virtual machine.

Review questions
1. What are some of the ways that software distribution can help reduce TCO?
2. What is the default timeout when you are deploying a package to a

distribution point?
3. What are the four software distribution objects?
4. What are the two types of collection membership rules?
5. Which object must be created first, the package or the program?


6. Can a computer have two maintenance windows?
7. Where would you find the server side log file for software distribution?
Real-world Issues and Scenarios

1. Scenario
You are the Contoso, Ltd IT Manager. Contoso has many large and small
offices across Texas. You are called to a meeting to discuss rolling out a new
software application that must be customized for every computer installation.
The team at the meeting is deciding whether they should visit each
workstation to install manually, or use the new Configuration Manager
environment to deploy this application. After the meeting, you decide to use
Configuration Manager to deploy the new application. However, management
wants to understand your decision.
Solution
You decide to write a short list of pro and cons for each method, and list them
in a table.
ConfigMgr Manual
No travel expenses High travel expenses
Few days are needed to customize, Copy CD to Network share.

create, and test the package before Limited or no testing of each install occurs.
deploying
Start deployment in a few days. Start deployment today.
A more consistent software Manual installs may lead to inconsistent

installation process processes.
Low number of staff required. High number of staff required.
Shorter overall time to complete. Longer time to completion.
Lower cost per computer to deploy Higher cost per computer to deploy and
and install. install.

2. Scenario
As the Configuration Manager administrator for Contoso, Ltd, you learn that
recently there was an internal audit of software licenses. The audit found that a
very costly application was installed on more computers than it should have
been. Contoso had to purchase additional licenses to move back into
compliance. Your manager wants you to find a way to restrict a costly new
licensed application called Zyx.exe, to a few selected computers.
Solution
To meet these goals, create a package, a program, and a collection called ZYX.
Manually add to the ZYX collection only those computers that should have
this application. Then create an advertisement for the collection. At the same
time, add a software metering rule for this new application, and create a report,
so that your manager can monitor this application.
3. Scenario
As the Configuration Manager administrator for Contoso, Ltd, you are
responsible for ensuring that all computers have security updates applied.
Working with the security team, you have scheduled the Software Updates
Agent to scan and apply security fixes at 9:00 P.M. on Thursday evenings. A
few months later, the server manager informs you that his backups are failing
every Thursday night around 9 P.M. You both quickly realize that the backups
are failing because of the software updates. You need to find a solution fast.
Solution
The server manager and you agree to add maintenance windows to all servers.
Following best practices, you clone the All Windows Server Systems collection,
giving the new collection a name of “Sunday 4am-10am Servers only.” You
then enable the maintenance window from 4 A.M. to 10 A.M. Once this is in
place, the servers will not reboot during the backup.
Best Practices
1. Do not manually place any files directly on the SMSPKGx$ share. This share
should be used only by Configuration Manager. If you want to share files on a
server that is performing the distribution point role, you should use a separate
share.
2. For the Source directory path, do not specify path/filenames for package
source files that exceed 254 characters. Paths of this length cannot be
replicated.

Tools

Advertised • Enable/disable software Browse to Site Management,
Programs Client distribution to clients expand <Site Code>, expand Site
Agent Settings, and then click Client
Agents.
New Collection • Specify information about Browse to Site Management,

Wizard a new collection expand <Site Code>, expand
• Configure membership Computer Management, and
rules then click Collections.
New Package • Create new packages Browse to Site Management,

Wizard • Define data source expand <Site Code>, expand
location Computer Management, expand
Software Distribution, and then
click Packages.
New Program • Create new programs Browse to Site Management,

Wizard • Define requirements expand <Site Code>, expand
Computer Management, expand
• Define environment
Software Distribution, expand
• Define Windows Installer Packages, expand <Package
information Name>, and then click
Programs.
Software • Displays a summary of Browse to Site Management,

Distribution home recent software expand <Site Code>, expand
page distribution Computer Management, and
advertisements then click Software Distribution.
Package Status Displays: Browse to Site Management,

Home Page • Site expand <Site Code>, expand
Computer Management, expand
• Source Version
Software Distribution, expand
• Targeted Packages, expand <Package
• Installed Name>, expand Package Status,
• Retrying and then click Package Status.
• Failed
• Summary Date

(continued)

Advertisement Displays: Browse to Site Management,
Status Home • Name expand <Site Code>, expand
Page Computer Management, expand
• Package
Software Distribution, and then
• Program click Advertisements.
• Collection
• Available After
• Expires After
• Advertisement ID
• Status
Deploying Virtual Applications Using Microsoft® System Center Configuration Manager 2007 7-1

Module 7
Deploying Virtual Applications Using
Microsoft® System Center Configuration
Manager 2007
Contents:
Lesson 1: Configuring the Infrastructure to Support
Application Virtualization 7-3
Lesson 2: Deploying and Managing Application Virtualization Packages 7-18
Lesson 3: Using Virtual Application Programs 7-29
Lab: Deploying Virtual Applications to Configuration Manager Clients 7-35

Module Overview
Microsoft System Center Configuration Manager 2007 R2 introduces

enhancements to both the infrastructure and client components that support
virtual application deployments. Microsoft Application Virtualization (App-V) can
significantly decrease costs and effort associated with various tasks throughout the
application management life cycle, such as application packaging, application
delivery, application updates, and application removal. This module describes how
to use System Center Configuration Manager 2007 R2 to deploy and manage
virtual application packages throughout your environment.
• Describe infrastructure requirements to support App-V.
• Deploy and manage virtual application packages.
• Launch virtual applications on Configuration Manger clients.

Lesson 1
Configuring the Infrastructure to Support

Application Virtualization
To successfully deploy a virtual application package to Configuration Manager

clients, you must understand how App-V integrates with Configuration Manager
2007 R2. Additionally, you need to have a high-level understanding of App-V, and
how you prepare an application for importation into the Configuration Manager
environment. You also need to understand the options that you can use to enable
distribution points to stream or provide a download source for virtual application
packages.
• Describe the concept of application virtualization.
• Describe the process for integrating and deploying virtual applications using
Configuration Manger 2007 R2.

• Configure virtual application streaming delivery.
• Configure virtual application local delivery.

• Configure the Advertised Programs Client Agent to run virtual applications.

Overview of Application Virtualization
Key Points
The term application virtualization refers to running a program on a client
computer without a previously installed application. The traditional process of
installing an application’s files onto the local hard drive and adding entries to the
local registry is now isolated into its own virtual environment on the client.
Each virtual application’s isolated environment does not interact with operating
system settings or other application configuration settings on the client computer.
However, the virtual application can still access user data and system services
(such as print capabilities) as needed.
Depending on how you configure the virtual application package, separate virtual
applications may have limited interaction, or you may package multiple
applications into a combined virtual environment for full interaction (such as
might be the case for suite-based applications such as Microsoft Office).

Note: A virtual application is never installed physically on the client computer. If a

user requires—or no longer needs—a virtual application, you can simply modify user
permissions to provide or remove access to the virtual application on the client
computer.
Microsoft Application Virtualization

Microsoft’s application virtualization solution is known as Microsoft Application
Virtualization (App-V). You can deploy the App-V solution in several architectural
scenarios that depend primarily on the requirements of your organization.
App-V Integration with Configuration Manager 2007 R2

Configuration Manager 2007 R2 provides built-in support for virtual application
deployment. You can advertise virtual application packages to collections of users
or systems, and then deploy them using the standard Configuration Manager
distribution point architecture. The benefits of integrating Configuration Manager
and App-V technology include the following:
• You can manage both physical and virtual applications using a single
management console and management infrastructure
• The inherent scalability of Configuration Manager distribution points provide
more efficient distribution of virtual applications, without having to use App-V
management or streaming-server components.
• Configuration Manager clients, by default, download virtual applications from
a distribution point, and run them from the local cache. You can also configure
virtual applications to stream to the client from a nearby distribution point
using Hypertext Transfer Protocol (HTTP) or Hypertext Transfer Protocol
Secure (HTTPS).
• You can target virtual-application delivery to specific collections that contain
users or computer systems, and can schedule application delivery to ensure
that applications are available after a specific time.
• You can leverage standard Configuration Manager features, such as
distribution point failover, data throttling using Background Intelligent
Transfer Service (BITS), enhanced reporting, and support for Internet-facing
clients and branch caching scenarios.

• You can collect inventory and asset intelligence information about the virtual
application's version, to which machines or users it is deployed, and how often

it is used.
• You can leverage Configuration Manager’s automated Operating System
Deployment capabilities to deliver virtual applications as part of your
operating system deployment and upgrade efforts.
Question: Which App-V components are required for integration with


Process for Deploying Virtual Applications
Key Points
One of the main benefits of using Configuration Manager to deploy virtual
applications is that it uses the same processes and infrastructure as standard
application deployments. However, before using Configuration Manager, you need
to enable specific settings and consider a few prerequisites.
To deploy a virtual application to Configuration Manager clients, do the following:
1. Obtain an App-V sequenced application. Configuration Manager 2007 R2
supports the deployment of virtual applications that were sequenced using the
App-V sequencer. This step in the process is crucial. As with standard
application packages, if an application is not properly sequenced, applications
may fail and cause end-user dissatisfaction.

Note: For more information about App-V sequencing, refer to the Microsoft
Application Virtualization 4.5 Sequencing Guide at http://download.microsoft.com
/download/f/7/8/f784a197-73be-48ff-83da-4102c05a6d44
/App-45_Sequencing_Guide_Final.docx, and Advanced Sequencing with Microsoft
App-V found at http://technet.microsoft.com/en-us/windows/dd459150.aspx.
2. Deploy the App-V client to Configuration Manager clients. You need an App-V
4.5 or newer client to run the virtual applications on the client computer. You
can deploy the App-V client using standard software distribution processes.
The App-V client also requires the following installations on the client
computer prior to deployment:
• Microsoft Visual C++® 2005 SP1 Redistributable Package (x86). If you
install the App-V client manually, you are prompted to install the Visual
C++ component. Otherwise you can download it from the following
location: http://go.microsoft.com/fwlink/?LinkId=116683.
• Microsoft Application Error Reporting. If your client does not have
Microsoft Application Error Reporting installed, you are prompted to
install this component during manual client installation. You can also
install the program from the Support folder within the self-extracting App-
V archive file.
Note: To support 64-bit operating systems, deploy the App-V version 4.6 (or newer)
client. All previous versions of the client only support 32-bit operating systems.
3. Configure virtual application support in Configuration Manager 2007 R2. To

enable support for virtual application deployment in Configuration Manager
2007 R2, you must perform two tasks, as follows:
• Enable distribution points to allow for content distribution using BITS,
HTTP and HTTPS. You may also want to enable virtual application
streaming capabilities if you plan to stream applications from distribution
points.
• Enable the Advertised Programs Client Agent to support virtual
application package advertisements. Both of these tasks are described in
more detail in upcoming topics.

4. Create and advertise the software distribution package. You can use the New
Virtual Application Package Wizard to import and configure the virtual

application package. Just like standard software distribution, the virtual
application package is placed on distribution points for delivery to the client.
More information about advertising virtual application packages appears in the
next lesson.
Question: Which two critical prerequisites need to be in place so that you can
successfully deploy virtual applications using Configuration Manager 2007?

Configuring Virtual Application Streaming Delivery
Key Points
Configuration Manager 2007 R2 allows you to stream virtual applications using
HTTP or HTTPS from a standard distribution point. You can also use a branch
distribution point to stream virtual applications using Server Message Block (SMB)
protocol.
Configuring Distribution Points for Streaming Delivery

By default, distribution points do not stream virtual applications. If you plan to
allow clients to stream applications directly from the distribution point, you must
enable streaming capabilities on the server. To enable a distribution point for
streaming, do the following:
1. From the Site Systems node, open the properties of the distribution point.
2. On the General tab, select the Allow clients to transfer content from this
distribution point using BITS, HTTP, and HTTPS check box.
3. On the Virtual Applications tab, select the Enable virtual application
streaming check box.

The Streaming Delivery Process
Streaming delivery works best when clients have a high bandwidth connection to
distribution point servers. The end-to-end streaming delivery process is as follows:
1. Sequence an application, and save it to a source network share.
2. Create a virtual application package by running the New Virtual Application
Package Wizard. The New Virtual Application Package Wizard copies the
sequenced application package from the source network share to the site
server.
3. Select the distribution point servers and replicate the virtual applications to the
distribution points. Note that streaming does require additional storage space
on the distribution point. Application streaming requires two copies of the SFT
file to be stored on the distribution point, one to support the streaming feature
and the second to support application updates.
4. Create an advertisement targeting the new virtual application package to a
collection of client computers or users.
5. The Configuration Manager client evaluates the advertisement, and registers
the new application package with the App-V client. The App-V client creates
program shortcuts and file type associations for each program included in the
package. Streaming does not take place until the user clicks on one of the
program shortcuts.
6. The user clicks on one of the program shortcuts associated with the virtual
application package.
7. The App-V client streams the blocks of the virtual application package that are
required to launch the program into the App-V client cache directly from a
distribution point. The Configuration Manager client’s current location and the
policies contained in the advertisement for the virtual application package
determine which distribution point server App-V uses for streaming. After
streaming the initial block into the App-V client cache, the application
launches and displays for the user. Any additional blocks are streamed in the
background until the package is fully cached on the client computer. This
ensures that all application features are available when the client system is
offline.
Note: Streaming delivery is not supported for Internet-facing scenarios.


Question: Since an application does not stream until a user launches the
application, what implications may this have on mobile clients?

Configuring Virtual Application Local Delivery
Key Points
Configuration Manager supports what is called virtual application local delivery
(or, download and execute delivery). When an administrator targets a client to
receive a virtual application, the Configuration Manager client receives the
advertisement, and then downloads the entire virtual application package to the
local Configuration Manager client cache. The Configuration Manager client also
registers the application with the App-V client, which then creates the program
shortcuts and file-type associations.
When a user clicks on a program shortcut, the Configuration Manager client calls
the App-V client to launch the application. The App-V client streams the
application from the local Configuration Manager cache into the App-V client
cache, and then starts the application.
The main advantage of this scenario is that the client computer maintains the full
application in the Configuration Manager client cache from the moment the
application package was advertised to the client. This ensures that clients that are
not connected to the network can still run virtual applications.

Configuring Distribution Points for Local Delivery
If your target computers are only going to download and execute the virtual
application package, you do not have to configure streaming. However, you still
need to perform the following tasks:
1. From the Site Systems node, open the properties of the distribution point.
2. On the General tab, select the Allow clients to transfer content from this
distribution point using BITS, HTTP, and HTTPS check box.
Note: Local delivery is supported for Internet-facing scenarios.
Question: Which virtual application delivery method (streaming or local delivery)

will you use in your organization? Why?

Demonstration: Configuring Application Virtualization
Key Points
In this demonstration, you will see how to configure distribution points to support
virtual application deployment. You will also see how to configure the Advertised
Programs Client Agent to allow virtual application package advertisements.
Demonstration Steps
Configure a distribution point to support virtual applications

1. Open the Configuration Manager console and browse to the Site Systems
node.
2. From the ConfigMgr distribution point Properties dialog box, select the
Allow clients to transfer content from this distribution point using BITS,
HTTP, and HTTPS option.
streaming check box. This setting is only required for streaming virtual
applications to clients from the distribution point.

Configure the Advertised Programs Client Agent
1. In the Configuration Manager console, browse to the Client Agents node.

2. From the Advertised Programs Client Agent Properties dialog box, select the
Enable software distribution to clients option.
3. Select the Allow virtual application package advertisement check box.
Question: Which distribution point setting is required for both the streaming and
local delivery scenarios?
Question: You need to configure the Advertised Programs Client Agent to allow
virtual application package advertisement, but the selection is not available. What
might be wrong?

Lesson 2
Deploying and Managing Application

Virtualization Packages
After configuring the server components to support application virtualization and

deploying the App-V client to the target computers, your next step is to create and
advertise the virtual application package. This process does not differ much from
deploying standard software distribution packages.
• Describe the process for creating a new virtual application package.
• Describe the process for advertising virtual application packages to
• Describe tools that help you manage virtual application packages.
• Describe best practices for managing virtual application packages.
• Create and advertise virtual application packages.

Creating a New Virtual Application Package
Key Points
You can use the New Virtual Application Package Wizard to import virtual
applications that were created using the App-V sequencer. Consider the following
points when running the wizard:
• On the Package Source page of the New Virtual Application Package Wizard,
specify the Virtual Application Package Manifest XML file. The App-V
sequencer creates this file, which provides import instructions to
Configuration Manager 2007. If your sequenced application does not contain
this file, the application may have been sequenced with an App-V sequencer
previous to version 4.5.
• On the General page of the New Virtual Application Package Wizard, provide
general information about the package. You can use the Remove this package
from clients when it is no longer advertised option to automatically remove
a virtual application when the target computer is no longer within the scope of
management of the collection.

• On the Data Source page of the New Virtual Application Package Wizard,
specify the location from which distribution points will copy the virtual
application packages. Once you have specified the destination directory, you
cannot change it.
After creating the virtual application package, you need to distribute the package to
distribution points. The process for distributing packages to distribution points is
exactly the same as with any software distribution package.
Question: You have just created a new virtual application package and imported
an existing Virtual Application Package Manifest XML file. What do you do next to
ensure clients can receive the virtual application?

Advertising Virtual Application Packages
Key Points
The final step in deploying a virtual application package is to advertise the package
to a collection of clients. To advertise a virtual application package you can either
use the New Advertisement Wizard or the Distribute Package Wizard.
Using the New Advertisement Wizard

You can use the New Advertisement Wizard to advertise a virtual application
package to Configuration Manager clients. This method assumes you have already
copied the package to intended distribution points.
Consider the following when running the wizard:
• On the General page of the New Advertisement Wizard, specify the name,
package, and collection that you want to associate with this advertisement.
• On the Schedule page of the New Advertisement Wizard, provide the
advertisement start time, and whether or not the advertisement is a mandatory
assignment. As needed, you can also specify additional options such as
enabling Wake on LAN, and ignoring maintenance windows.

• On the Distribution Points page of the New Advertisement Wizard, specify
how the client will run the virtual application. If you have enabled virtual
application streaming support on the distribution points, you can choose the
Stream Virtual applications from distribution point option. This option
assumes a fast network boundary, and you should only use it for intranet-
based clients.
• The Download content from distribution point and run locally option is the
default setting, and it ensures that the Configuration Manager client
downloads the entire package when it receives the advertisement. This setting
works best for mobile clients that are not connected to the network, and will
ensure that the entire package is available to the user.
Using the Distribute Package Wizard

The Distribute Package Wizard allows you to specify all deployment components
such as the distribution points to be used, and the advertise program parameters.
You can also use this wizard to distribute the virtual application package to an
existing collection, or to a new collection that you create.

Virtual Application Package Tools
Key Points
When you install the Configuration Manager 2007 R2 update, the update installs
several virtual application package tools on the site server that you can use to help
perform tasks related to importing, upgrading, and configuring virtual application
packages.
Note: After Configuration Manager 2007 R2 installation, you can access the virtual
application package tools at <ConfigurationManagerInstallationPath>\Tools
\VirtualApp. For detailed information about each tool, open the
SMSv4AppVToolsReadme.htm file.

The virtual application tools installed with the R2 update include the following:
Tool Description
AppVirtMgmtClient.sms Creates a software distribution package to distribute

the App-V client. By default, the program created by
this tool restarts the target computer so that it can
update files used by the operating system. You can
change this setting to No action required. However,
you should verify that restarts are not required within
your specific environment.
AppVirtMgmtSequencer.sms Creates a software distribution package that installs

the App-V sequencer onto a target computer.
SetRetentionRules.vbs Specifies retention rules for application packages

stored on distribution points. You can specify how
long a virtual application package remains on
distribution points, as well as the number of versions
of the virtual application package that should remain
on distribution points. The syntax is:
SetRetentionRules.vbs [TransitionDays]
[Max Versions]
• TransitionDays: The number of days virtual

applications will be saved.
• Max Versions: The number of versions that will be
saved on the distribution point.
ManageVAppPackage.vbs Automates the process of importing new virtual

application packages and updating existing packages
in Configuration Manager. The syntax is:
ManageVAppPackage /Action ADD <options>
ManageVAppPackage /Action UPDATE <options>
For a list of options, refer to the

SMSv4AppVToolsReadme.htm file in the VirtualApp
folder on an R2-based site server.

Best Practices for Managing Virtual Application Packages
Key Points
Consider the following best practices when managing virtual application packages:
• Increase the default Configuration Manager 2007 client cache size. By default,
the Configuration Manager client cache size is set to 5 gigabytes (GB).
Consider increasing this size depending on the number of virtual applications
that you intend to deploy to clients. Additionally, if you deploy software
updates using Configuration Manager, the client cache must maintain an
adequate size so that it can support critical update deployments. Plan on
maintaining at least twice the amount of client cache space required for
application virtualization.
• Secure access to virtual application packages. Consider controlling who has
access to streamed virtual application packages. You can do this by modifying
the package access account settings.

• Train or develop helpdesk processes related to App-V troubleshooting.
Troubleshooting virtual application issues requires a different focus than

standard application troubleshooting on a client computer. Make sure to
adequately train support personnel on the App-V client component and how
to run virtual applications on the client.
• Learn about App-V sequencing. Since application sequencing is one of the
most critical factors for successful App-V integration with Configuration
Manager, spend some time learning about the App-V sequencer. This can save
you time when troubleshooting issues that are not related to the Configuration
Manager environment.

Demonstration: Creating and Advertising Virtual
Application Packages
Key Points
In this demonstration, you will see how to create and advertise a virtual application
package.
Demonstration Steps
Import a virtual application package

1. Open the Configuration Manager console, and browse to the Software
Distribution\Packages node.
2. Create a new virtual application package. Provide general information and the
data source information.
3. Run the New Distribution Point Wizard to copy the package to the
distribution points.

Advertise a virtual application package
1. In the Configuration Manager console, browse to the Software

Distribution\Advertisements node.
2. Create a new advertisement. Provide general information, and configure the
schedule.
3. On the Distribution Points page, specify whether to stream the virtual
applications, or download content and run locally.
Question: A user moves to a new department and no longer requires a specific

virtual application. Which package setting can help you ensure that the virtual
application is removed from the user’s computer?
Question: You have a large number of mobile users using virtual applications.
Which advertisement setting ensures that virtual applications will run when the
users are disconnected from the network?

Lesson 3
Using Virtual Application Programs
Running a virtual application on a client computer should provide a seamless

experience for end users. Depending on how well an application was sequenced,
users may not realize that an application is packaged as a virtual application.
However, in the event that an issue does occur, it is important to understand how
the Configuration Manager client interacts with the App-V client. You should also
be familiar with the types of reports and log files that can help you troubleshoot or
monitor virtual application usage.
• Describe the architecture of the client components.
• Launch and verify virtual applications on a client computer.
• Monitor virtual application deployment.

Launching Virtual Applications
Key Points
Configuration Manager 2007 R2 and App-V 4.5 both provide enhancements that
integrate communication paths for the client-side components. This integration
minimizes the client-side configuration requirements, and ensures that an
appropriate distribution point is selected whenever a virtual application is
launched on a client workstation.
Integration between the two clients is provided based upon the following:
• The App-V 4.5 client includes a command-line interface called SFTMIME that
controls virtual applications on a client workstation.
• The App-V 4.5 client includes an OverrideURL registry value that the
Configuration Manager client uses to provide distribution point location
information.

• The App-V 4.5 client includes a Windows Management Instrumentation
(WMI) provider that enables any WMI-based application to retrieve

information about the status of virtual applications residing in the App-V client
cache.
• The Configuration Manager 2007 R2 client includes a new launcher
component that obtains location requests from a management point, and then
communicates with the App-V client to set the appropriate distribution point
using the OverrideURL registry setting.

Demonstration: Launching Virtual Applications
Key Points
In this demonstration, you will see how to launch a virtual application package.
Demonstration Steps
Launch a virtual application package

1. Open the Configuration Manager Control Panel and run the Machine Policy
Retrieval & Evaluation Cycle. This option retrieves the latest advertisement
information from the management point.
2. Run the advertisement.
3. Start the virtual application. Depending on the package, the icons may appear
on the Start menu, or on the desktop.
4. Verify that running the application does not install any application-based
folders on the client machine.

Monitoring Virtual Application Deployment
Key Points
Configuration Manager 2007 R2 provides a number of reports and log files that
you can use to monitor and troubleshoot virtual application deployment.
The following table describes the reports and log files used for virtual application
monitoring:
Reports and log

files Description
Configuration You can find virtual application-related reports in the Software
Manager reports Distribution – Packages category, and the Virtual Applications
category. These reports include:
• All distribution points with virtual application streaming enabled.
• All virtual application packages in the streaming store of a
distribution point.
• Computers with a specific virtual application.
• Computers with a specific virtual application package.

Reports and log
files Description
• Count of all instances of virtual application packages.
• Count of all instances of virtual applications.
• Streaming store distribution status of a specific virtual
application package.
• Virtual application launch failures for a specific application.
• Virtual application launch failures for a specific computer.
• Virtual application launch failures over a number of days.
Client logs The Configuration Manager R2 client includes the following log
files used to record virtual application status information:
• VirtualApp.log. Tracks virtual application registration and
publishing.
• VAppLauncher.log. Tracks virtual application launches by the
user.

Lab: Deploying Virtual Applications to
Configuration Manager Clients
Lab Setup
2. Ensure that the 6451B-NYC-DC1-D, 6451B-NYC-CFG1-D, and the 6451B-
NYC-CL1-D virtual machines are running.
domain.
• NYC-CL1: Windows® 7 client computer in the Contoso.com domain.

Lab Scenario
You are an administrator for Contoso, Ltd. You were asked to prepare the
Configuration Manager environment to support the deployment of virtual
applications. You have already installed Configuration Manager Service Pack 2 and
the R2 update, and you were provided with sample virtual applications that were
sequenced by the application packaging department. First, you need to configure
the site to support virtual applications. You also need to deploy the App-V client to
users that will be running virtual applications. Finally, you will deploy the virtual
applications to target users and launch a virtual application.

Exercise 1: Preparing the Infrastructure for Application
Virtualization
Scenario
Before deploying the App-V client, you must configure distribution points and the
Advertised Programs Client Agent.
1. Configure distribution points to support virtual applications.
2. Configure the Advertised Programs Client Agent.
3. Deploy the App-V client.
Task 1: Configure distribution points to support virtual applications

1. On NYC-CFG1, open the Configuration Manager console and browse to the
Site Systems node.
2. Configure the distribution point role on NYC-CFG1 by enabling the following
options:
• Allow clients to transfer content from this distribution point using
BITS, HTTP, and HTTPS
• Enable virtual application streaming
Task 2: Configure the Advertised Programs Client Agent

1. In the Configuration Manager console, browse to the Client Agents node.
2. Configure the Advertised Programs Client Agent by enabling the following
options:
• Enable software distribution to clients
• Allow user targeted advertisement requests
• Allow virtual application package advertisement

Task 3: Deploy the App-V client

2. Create a new package from definition with the following settings:
• Package definition location: C:\Microsoft Configuration
Manager\Tools\VirtualApp\AppVirtMgmtClient.sms.
• Source files location: E:\Labfiles\VApps\Client
3. Distribute the new package to the NYC-CFG1 distribution point.
4. Create a new advertisement with the following settings:
• Name: App-V Client
• Package: Microsoft Application Virtualization Desktop Client 4.5
English
• Collection: All Windows Workstation or Professional Systems
• Assignment Schedule: Assign immediately after this event
5. Switch to the NYC-CL1 virtual machine.
6. From the Configuration Manager Control Panel, select Machine Policy
Retrieval & Evaluation Cycle. It may take a few minutes for the advertisement
to appear. If it does not appear, select Machine Policy Retrieval & Evaluation
Cycle again. You can monitor the advertisement by selecting Advertisement
Status in the Configuration Manager console.
7. On NYC-CL1, run the received advertisement. The computer will restart once
the program installation is finished.
8. After NYC-CL1 restarts, log on as Contoso\Administrator using the password
Pa$$w0rd.
Results: After this exercise, you should have configured the infrastructure
requirements to support App-V deployment.

Exercise 2: Deploying a Virtual Application Package
Scenario
Now that you have prepared the infrastructure, you can deploy the virtual
application package to Configuration Manager clients.
• Import a virtual application package.
Task: Import a virtual application package

2. Create a new virtual application package with the following settings:
• Package Source:
E:\labfiles\VApps\Word_Viewer\Word_Viewer_manifest.xml
• Name: Word_Viewer
• Version: 1
• Remove this package from clients when it is no longer advertised:
Enabled
• Data Source: \\NYC-CFG1\Labfiles\Source
3. Distribute the new package to the NYC-CFG1 distribution point.
4. Create a new advertisement with the following settings:
• Name: Word Viewer
• Package: Microsoft Word_Viewer 1
• Assignment Schedule: Assign immediately after this event
• Distribution Points: Stream virtual applications from distribution point
Results: After this exercise, you should have deployed a virtual application to

Exercise 3: Launching and Monitoring a Virtual Application
Program
Scenario
Now that deployment is complete, you can launch a virtual application and then
view related reports.
1. Launch a virtual application.
2. Review Virtual Applications reports.
Task 1: Launch a virtual application

1. On NYC-CL1, open the Configuration Manager Control Panel and run the
Machine Policy Retrieval & Evaluation Cycle.
Note: It may take a few minutes for the advertisement to appear. If it does not
appear, run the Machine Policy Retrieval & Evaluation Cycle again.
2. When the notification appears, click the notification, and then click Run.
3. On the desktop, double-click Microsoft Office Word Viewer 2003.
Task 2: Review Virtual Applications reports

1. On NYC-CFG1, in the Configuration Manager console, browse to the
Computer Management\Reporting\Reports node.
2. Apply a filter so that only reports that have the name “virtual” appear in the
details pane.
3. Right-click the All virtual application packages in the streaming store of a
distribution point report, and then click Run. Configure the report to open in
a new window.

4. Run several other reports and view the results.
Note: If some reports do not show results, switch to NYC-CL1 and run a Hardware
Inventory and Machine Policy Retrieval & Evaluation Cycle.
Results: After this exercise, you should have launched a virtual application on a
client and viewed related reports.

click Revert.

7. Wait for NYC-CFG1 to start, and then start 6451B-NYC-SVR2-D. Connect to

Review Questions
1. You decide to incorporate App-V into your Configuration Manager
environment. What are the main prerequisites for App-V integration with
2. You deploy a virtual application to several users in your organization. When

users start the application, basic features work fine, but some of the more
advanced features fail. What do you need to do to ensure that the application
runs as expected?
3. You need to deploy a virtual application deployment solution that minimizes

the amount of bandwidth used over the network, and minimizes the amount
of storage space required on distribution servers. Which virtualization
deployment method would you use?

4. You discover that a client is running out of disk space. In an attempt to gain
disk space, you remove all virtual applications from the client. You notice that
disk space availability has not changed. What should you do?

• When migrating from an App-V infrastructure to the Configuration Manager
2007 infrastructure, be aware that enabling the Allow virtual application
package advertisement option in the Advertised Programs Client Agent
Properties dialog box gives Configuration Manager control of the App-V client
on each client computer. This causes the Configuration Manager client to
remove all previously deployed virtual application packages that may have
been published using another App-V infrastructure scenario, such as the full
infrastructure or standalone scenarios.
• You can use Asset Intelligence features to report application data such as
product codes and publisher names for each virtual application registered on
the computer. However, if you have a physical version of the same application
installed on the client, Asset Inventory will only be available for the physical
version of the application.
• You can track and report virtual application usage using Configuration
Manager software metering. Just as with physical applications, you can
configure virtual application software metering rules to track the execution of
specific virtual application programs.

Tools

Application • Managing virtual C:\Program Files\Microsoft Configuration
virtualization application Manager\Tools\VirtualApp
tools packages
App-V 4.5 • Sequencing or Available with the Microsoft Desktop Optimization

sequencer packaging Pack that is available to organizations subscribed to
applications into a Software Assurance.
virtual environment
App-V 4.5 • Running virtual Available with the Microsoft Desktop Optimization
client applications on the Pack that is available to organizations subscribed to
client Software Assurance.
Module 2: Planning and Deploying a Single-Site Architecture L2-1

Module 2: Planning and Deploying a Single-Site
Architecture
Lab A: Deploying a Configuration
Manager Site Server
Exercise 1: Installing Configuration Manager Prerequisites
Task 1: Check for existing prerequisites
1. Log on to NYC-CFG1 as Contoso\Administrator using the password
Pa$$w0rd.
2. Click Start, and then click Computer.
3. Double-click Allfiles (E:), double-click Labfiles, and then double-click
ConfigMgrSP2.
4. Double-click Splash.hta.
5. Click Run the prerequisite checker.
6. On the Installation Prerequisite Check Options page, fill in the following
and then click OK:
• SQL Server and instance, if applicable: NYC-CFG1
• SDK Server: NYC-CFG1
• Management point computer FQDN on the intranet: NYC-
CFG1.contoso.com
7. Record the missing prerequisites.
8. On the Installation Prerequisite Check page, click Cancel.
9. Close the ConfigMgrSP2 window.
L2-2 Lab A: Deploying a Configuration Manager Site Server

Task 2: Install Windows Server 2008 features
1. On NYC-CFG1, on the Task Bar, click Server Manager.

2. In the console tree, click the Features node, and then in the results pane, click
Add Features.
3. On the Select Features page, select Background Intelligent Transfer Service
(BITS).
4. In the Add Features Wizard, click Add Required Role Services.
5. On the Select Features page, select Remote Differential Compression.
6. On the Select Features page, click Next.
7. On the Web Server (IIS) page, click Next.
8. On the Select Role Services page, ensure each of the following is selected. (Do
not change any of the default settings.)
• Common HTTP Features node: WebDAV Publishing
• Security node: Windows Authentication
• Management Tools / IIS 6 Management Compatibility node: IIS 6
Metabase Compatibility and IIS 6 WMI Compatibility
9. On the Select Role Services page, click Next.
Task 3: Configure WebDAV

1. In the Server Manager window, expand roles, expand Web Server (IIS), and
then select Internet Information Services (IIS) Manager.
2. Expand NYC-CFG1, expand Sites, and then click Default Web Site.
3. In the Features view, double-click WebDAV Authoring Rules.
4. In the Actions pane, click Enable WebDAV.
5. In the Actions pane, click Add Authoring Rule.

6. Configure the Add Authoring Rule as follows:
• Allow access to: All content

• Allow access to this content to: All users
7. In the Add Authoring Rule dialog box, click OK.
8. In the Actions pane, click WebDAV Settings.
9. Configure the WebDAV Settings page as follows:
• Property Behavior: Allow Anonymous Property Queries: True
• Property Behavior: Allow Custom Properties: False
• Property Behavior: Allow Property Queries with Infinite Depth: True
• WebDAV Behavior: Allow Hidden Files to be Listed: True.
10. In the Actions pane, click Apply.
11. Close the Server Manager.
Results: After this exercise, you should have installed the prerequisite components
for a Configuration Manager 2007 SP2 single-site deployment.

Exercise 2: Extending the Active Directory schema for
Configuration Manager
Task 1: Extend the Active Directory schema with ExtADSch
Pa$$w0rd.
2. Click Start, in the Search programs and files box, type \\NYC-
CFG1\Labfiles\ConfigMgrSP2\SMSSETUP\BIN\I386, and then press
ENTER.
3. In the Explorer window, right-click extadsch.exe, and then click Run as
administrator.
4. In the navigation pane, click Local Disk (C:).
5. Double-click ExtADSch.log.
6. Review the log file for any errors. If there are errors, notify your instructor.
7. Close Notepad and the Windows Explorer window.
Task 2: Configure Active Directory permissions

1. On NYC-DC1, click Start, point to Administrative Tools, and then click
Active Directory Users and Computers.
2. Click View, and then click Advanced Features.
3. Expand Contoso.com, and then click System.
4. Right-click System, and then click Properties.
5. In the System Properties dialog box, click the Security tab.
6. Click Advanced, click Add, click Object Types, clear all the check boxes, select
the Computers check box, and then click OK.
7. Type NYC-CFG1, and then click OK.
8. Under Apply to, select This object and all descendant objects if necessary.
9. Under Permissions, under Allow, select the Full control check box.

10. In the Permission Entry for System dialog box, click OK, in the Advanced
Security Settings for System dialog box, click OK, and then in the System
Properties dialog box, click OK.
11. Leave Active Directory Users and Computers open.
Results: After this exercise, you should have extended the Active Directory schema
and set permissions for the Configuration Manager server to publish information in
Active Directory® Domain Services (AD DS).

Exercise 3: Installing Configuration Manager 2007 SP2
Task 1: Install a primary site

1. Switch to NYC-CFG1, click Start, and then click Computer.
ConfigMgrSP2.
4. Under Install, click Configuration Manager 2007 SP2.
5. On the Welcome to the Microsoft System Center Configuration Manager
2007 SP2 Setup Wizard page, click Next.
6. On the Available Setup Options page, ensure Install a Configuration
Manager site server is selected, and then click Next.
7. On the Microsoft Software License Terms page, select the I accept these
license terms check box, and then click Next.
8. On the Installation settings page, ensure Custom settings is selected, and
then click Next.
9. On the Site Type page, ensure Primary site is selected, and then click Next.
10. On the Customer Experience Improvement Program Configuration page,
click Next.
11. On the Product Key page, click Next.
12. On the Destination Folder page, type C:\Microsoft Configuration
Manager\, and then click Next.
13. On the Site Settings page, specify:
• Site code: NYC
• Site Name: Central Site - New York City
14. On the Site Settings page, click Next.
15. On the Site Mode page, select Configuration Manager Mixed Mode, and then
click Next.
16. Review the Client Agent Selection page, and then click Next.
17. Review the Database Server page, review the SQL Server Computer
information, and then click Next.

18. Review the SMS Provider Settings page, review the server information, and
then click Next.

19. On the Management point page, ensure Install a management point is
selected, and that the FQDN is NYC-CFG1.Contoso.Com. Click Next.
20. Review the Port Settings page, and then click Next.
21. On the Updated Prerequisite Components page, select The latest updates
have already been downloaded to an alternate path, and then click Next.
22. On the Updated Prerequisite Component page, specify
E:\Labfiles\ConfigMgrSP2\Download, and then click Next.
Install. While the installation completes, continue to the next task.
Task 2: Install the Configuration Manager console

1. Log on to NYC-CL1 as Contoso\Administrator with a password of
Pa$$w0rd.
2. Click Start, in the Search programs and files box, type \\NYC-
CFG1\Labfiles\ConfigMgrSP2, and then press ENTER.
4. Under Install, click Configuration Manager 2007 SP2.
2007 SP2 Setup Wizard page, click Next.
6. On the Available Setup Options page, ensure Install or upgrade an
administrator console is selected, and then click Next.
7. On the Microsoft Software License Terms page, select the I accept these
license terms check box, and then click Next.
8. On the Customer Experience Improvement Program Configuration page,
click Next.
9. On the Destination Folder page, accept the default, and then click Next.

10. On the Site Server page, next to Server Name, type NYC-CFG1, and then click
Next.
Install.
Results: After this exercise, you should have begun the installation of Configuration
Manager 2007 and the Configuration Manager console on a separate machine. The
installation will run for about 30 minutes while the instructor continues with the
course. You will continue deploying a Configuration Manager site server in the next
lab.

Lab B: Deploying a Configuration
Manager Site Server, Continued

Exercise 1: Verifying a Successful Configuration Manager
Site Server Installation
Task 1: Complete the installation on NYC-CL1
1. Connect to NYC-CL1, and on the Setup Action Status Monitoring page, click
Next.
Task 2: Complete the installation on NYC-CFG1

1. Connect to NYC-CFG1.
2. On the Setup Action Status Monitoring page, verify the green check marks
indicating that setup has completed successfully, and then click Next.
Task 3: Review the Configuration Manager Setup log

1. Click Start, and then click Computer.
2. Double-click Local Disk (C:), and then double-click ConfigMgrSetup.log.
3. At the beginning of the log, find the prerequisite check you ran at the
beginning of the lab.
4. Review the log file to find the following information and any errors:
• Verifying SMS Active Directory Schema Extensions
• DATABASE CREATION
• Collection creations
• Adding a login for the SMS Site Server
L2-10 Lab B: Deploying a Configuration Manager Site Server, Continued

• SQLINSTALL Returning with Success!
• Successfully created local user group

• Granted SMS Admins rights to WMI Name Space
• Done with service installation
• Completed monitoring installation of Configuration Manager services
• Installation and configuring site are done
• Moving to Finish page
5. Close the ConfigMgrSetup.log.
Task 4: Review the Configuration Manager Component Setup log

1. In the Windows Explorer window, double-click ComponentSetup.log.
2. Review the log file to verify that all the components installed successfully.
3. Close ComponentSetup.log.
Task 5: Verify the Configuration Manager 2007 version of the site

1. On NYC-CFG1, click Start, click All Programs, click Microsoft System
Center, click Configuration Manager 2007, and then click ConfigMgr
Console.
Site-New York City, and then click Properties. Note the version information
and the R2 status for the NYC-Central Site-New York City site.
installation has completed successfully.

Exercise 2: Verifying the Creation of the System
Management Container
Task: Verify the creation of the Configuration Manager objects in
AD DS
1. Connect to NYC-DC1, and in the Active Directory Users and Computers
window, click System.
2. Click the F5 key to refresh the screen.
3. In the results pane, double-click System Management. If the System
Management container does not exist, contact your instructor.
4. Verify that the SMS-MP-NYC-NYC-CFG1 object exists.
5. Verify that the SMS-Site-NYC object exists.
6. Leave Active Directory Users and Computers open.
Results: After this exercise, you should have verified that the System Management
container was successfully created in AD DS, and that the Configuration Manager
objects were created in AD DS.
L2-12 Lab B: Deploying a Configuration Manager Site Server, Continued

Exercise 3: Installing Configuration Manager 2007 R2
Task 1: Install Configuration Manager 2007 R2 on NYC-CFG1

1. Switch to NYC-CFG1, click Start, and then click Computer.
ConfigMgrR2.
2007 R2 Setup Wizard page, click Next.
6. On the License Agreement page, select I accept the license agreement, and
then click Next.
7. On the Registration Information page, click Next.
8. On the Installation page, click Next.
9. On the Setup Complete page, click Finish.
10. Close all open Windows.
Task 2: Verify the Configuration Manager 2007 R2 installation

Site-New York City, and then click Properties.
3. Note the version information and the R2 status for the NYC-Central Site-New
York City site.
Task 3: Install Configuration Manager 2007 R2 on NYC-CL1

1. Switch to NYC-CL1, click Start, in the Search programs and files box, type
\\NYC-CFG1\Labfiles\ConfigMgrR2, and then press ENTER.

2007 R2 Setup Wizard page, click Next.

then click Next.
6. On the Registration Information page, click Next.
10. Log off of NYC-CL1.
Results: After this exercise, you should have installed and verified Configuration
Manager 2007 R2.
L2-14 Lab C: Managing Users and Configuring Boundaries and Discovery Methods

Lab C: Managing Users and
Configuring Boundaries and

Discovery Methods
Exercise 1: Managing Configuration Manager Users
Task 1: Create and populate groups
1. If necessary, log on to NYC-DC1 as Contoso\Administrator with a password
of Pa$$w0rd.
2. Click Start, point to Administrative Tools, click Active Directory Users and
Computers, and then click the IT organizational unit.
3. Right-click IT, point to New, and then click Group.
4. In the New Object - Group dialog box, in the Group name: field, type
SCCM_Full_Admin, and then click OK.
5. Right-click IT, point to New, and then click Group.
6. In the New Object - Group dialog box, in the Group name: field, type
SCCM_Dist_Software, and then click OK.
7. Right-click Ed Meadows, and then click Add to a group...
8. In the Select Groups dialog box, type SCCM_Full_Admin, and then click OK.
9. In the Active Directory Domain Services message, click OK.
10. Right-click Andrea Dunker, and then click Add to a group...
11. In the Select Groups dialog box, type SCCM_Dist_Software, and then click
OK.
12. In the Active Directory Domain Services message, click OK.

Task 2: Clone an existing user using the ConfigMgr User Wizard
1. Connect to NYC-CFG1.
3. Expand Site Database, expand Security Rights, right-click Users, and then
click Manage ConfigMgr Users.
4. In the ConfigMgr User Wizard, click Next.
5. On the User Name page, ensure Add a new User is selected, and then click
Browse...
6. Type SCCM_Full_Admin, click OK, and then click Next.
7. On the User Rights page, select Copy rights from an existing ConfigMgr
user or User group, and then click Next.
8. Ensure that the Source user is Contoso\Administrator, and then click Next.
9. On the User Rights page, ensure The listed rights are sufficient is selected,
and then click Next.
11. On the Wizard Completed page, click Close.
Task 3: Create a new user using the ConfigMgr User Wizard

1. On the Configuration Manager console, right-click the Users,node, and then
click Manage ConfigMgr Users.
2. In the ConfigMgr User Wizard, click Next.
3. On the User Name page, ensure Add a new User is selected, and then click
Browse...
4. Type SCCM_Dist_Software, click OK, and then click Next.
5. On the User Rights page, ensure Add another right or modify an existing
one is selected, and then click Next.
6. On the Add Right page, select Class: Collection, Instance: All Windows
Workstation or Professional Systems.
7. Under Rights, click Advertise, and then click Next.

8. On the User Rights page, ensure Add another right or modify an existing
one is selected, and then click Next.

9. On the Add Right page, select Class: Package, Instance: (All Instances).
10. Under Rights, select Read, and then click Next.
11. On the User Rights page, ensure The listed rights are sufficient is selected,
Task 4: Configure DCOM

1. On NYC-CFG1, click Start, click Run, type Dcomcnfg.exe, and then press
ENTER.
2. In the Component Services window, click Console Root, expand Component
Services, expand Computers, right-click My Computer, and then click
Properties.
3. In the My Computer Properties dialog box, click the COM Security tab, and
then in the Launch and Activation Permissions area, click Edit Limits.
4. In the Launch and Activation Permissions dialog box, click Add.
5. In the Select Users, Computers, or Groups dialog box, click Locations, select
NYC-CFG1, and then click OK.
6. In the Enter the object names to select (examples): box, type SMS Admins,
and then click OK.
7. In the Permissions for SMS Admins area, under Allow, select Remote
Activation.
8. Click OK to close the Launch and Activation Permissions window, click OK to
close the My Computer Properties window.

Task 5: Configure permissions on the Microsoft Configuration
Manager folder
1. On NYC-CFG1, click Start, and then click Computer.
2. Double-click Local Disk (C:).
3. Right-click Microsoft Configuration Manager, and then click Properties.
4. Click the Security tab, click Edit..., and then click Add...
5. Click Locations, specify NYC-CFG1, and then click OK.
6. In the Enter the object names to select (examples): field, type SMS Admins,
and then click OK.
7. On the Permissions for Microsoft Configuration Manager dialog box, click
OK.
8. Click the Sharing tab, click Advanced Sharing..., click Permissions, and then
click Add...
9. Click Locations, specify NYC-CFG1, and then click OK.
10. In the Enter the object names to select (examples): field, type SMS Admins,
and then click OK.
11. On the Permissions for SMS_NYC dialog box, click OK.
12. In the Advanced Sharing dialog box, click OK.
13. In the Microsoft Configuration Manager Properties dialog box, click Close.
Task 6: Add SCCM_Full_Admin to the Administrators group

1. On NYC-CFG1, click Start, click Administrative Tools, and then click
Computer Management.
2. Expand Local Users and Groups, click Groups, double-click Administrators,
and then click Add...
3. In the Enter the object names to select (examples): field, type
SCCM_Full_Admin, and then click OK.

4. In the Administrators Properties dialog box, click OK.

Results: After this exercise, you should have configured Active Directory groups for
use with Configuration Manager 2007, and configured security for Configuration
Manager 2007.

Exercise 2: Configuring Boundaries
Task: Create a Configuration Manager site boundary

1. Log on to NYC-CL1 as Ed with a password of Pa$$w0rd.
3. Expand Site Database, expand Site Management, expand NYC - Central Site
- New York City, expand Site Settings, and then click the Boundaries node.
4. Right-click Boundaries, and then click New Boundary.
5. In the New Site Boundary dialog box, set the following, and then click OK.
Results: After this exercise, you should have configured a Configuration Manager
site boundary.

Exercise 3: Enabling and Configuring Discovery Methods
Task 1: Configure and run Active Directory System Discovery

1. On NYC-CL1, in the Configuration Manager console, click Discovery
Methods, right-click Active Directory System Discovery, and then click
Properties.
2. On the General tab, select Enable Active Directory System Discovery.
3. Click the New (star) button, and then click OK.
4. In the Select New Container dialog box, click OK.
5. Click the Polling schedule tab, and then click Schedule.
6. Under Recurrence pattern, select None, and then click OK.
7. Check Run discovery as soon as possible, and then click OK.
Task 2: Configure and run Active Directory System Group Discovery

1. Right-click Active Directory System Group Discovery, and then click
Properties.
2. On the General tab, select Enable Active Directory System Group Discovery.
3. Click the New (star) button, and then click OK.
4. In the Select New Container dialog box, click OK.
5. Click the Polling schedule tab, check Run discovery as soon as possible, and
then click OK.
Task 3: Verify that discovery completed

1. Expand Computer Management, expand Collections, select All Systems.
2. In the Actions pane, click Update Collection Membership, and then click
OK.
3. In the Actions pane, click Refresh.
4. Right-click NYC-CL1, and then click Properties.

5. On the General tab, scroll down and review the Agent Name entries.
6. Click Close.
7. Leave the Configuration Manager console open.
Results: After this exercise, you should have configured and run Configuration
Manager 2007 discovery.
L2-22 Lab D: Monitoring and Troubleshooting Configuration Manager 2007

Lab D: Monitoring and
Troubleshooting Configuration
Manager 2007
Exercise 1: Using the ConfigMgr Service Manager
Task 1: Configure SMS_AD_System_Discovery_Agent Logging
1. On NYC-CL1, in the Configuration Manager console, expand the Tools
node.
2. Right-click ConfigMgr Service Manager, and then select Start ConfigMgr
Service Manager.
3. In ConfigMgr Service Manager, expand NYC, expand Components, expand
SMS_AD_System_Discovery_Agent, and then select NYC-CFG1.
4. In the results pane, right-click SMS_AD_System_Discovery_Agent.
Question: What options are available?
Query and Logging,
5. Right-click SMS_AD_System_Discovery_Agent, and then select Logging.
6. In the Log size text box, type 4, and then click OK.
7. Collapse Components.
Task 2: Check component status

1. In the ConfigMgr Service Manager window, expand Servers, and then click
NYC-CFG1.
2. In the right pane, right-click SMS_AD_System_Discovery_Agent, and then
click Select All.
3. Right-click SMS_AD_System_Discovery_Agent, and then select Query.
Question: Which components are not running?
SMS_SITE_BACKUP and all the Discovery components are not running.

4. Right-click SMS_COLLECTION_EVALUATOR, and then select Stop.

No, the status did not change.
5. Right-click SMS_COLLECTION_EVALUATOR, and then select Query.
Yes. The status changed to Stopped.
6. Right-click SMS_COLLECTION_EVALUATOR, and then select Start.
7. Right-click SMS_COLLECTION_EVALUATOR, and then select Query.
Task 3: Start SMS_AD_System_Discovery_Agent

1. Select SMS_AD_System_Discovery_Agent.
2. Record the time, right-click SMS_AD_System_Discovery_Agent, and then
select Start.
3. Close ConfigMgr Service Manager.
Results: At the end of this exercise, you will have reconfigured the
SMS_AD_SYSTEM_DISCOVERY_AGENT log file and used the ConfigMgr Service
Manager to manage Configuration Manager components.

Exercise 2: Reviewing Log Files with Trace32
Task 1: Use the Highlight tool to review a log file

1. On NYC-CL1, click Start, click All Programs, click ConfigMgr 2007 Toolkit,
and then click Trace32.
2. In the SMSTrace dialog box, click Yes.
3. Click File, and then click Open on server...
4. Click NYC-CFG1, and then click OK.
5. Click adsysdis.log, and then click Open.
6. Click Tools, and then click Highlight.
7. Type Starting, and then click OK.
Question: How many times did the service thread start?
It started two times. (More if you ran the agent more than specified.)
Question: Did discovery run when you manually started
SMS_AD_SYSTEM_DISCOVERY_AGENT? (Hint: Look for 'Starting the Data
Discovery')
No, discovery did not run.
9. In the Configuration Manager console, click Discovery Methods.
10. Right-click Active Directory System Discovery, and then click Properties.
then click OK.
12. Monitor adsysdis.log in SMS Trace. Wait a moment for the new lines to
appear.
Question: When you set the polling schedule to start as soon as possible, did
discovery run this time?
Yes, it ran this time.
14. Type INFO: DDR, and then click OK.

Question: How many systems were discovered each time the discovery agent
ran?
Four
17. Type ERROR, and then click OK.
Question: How many errors are there?
Two—once for each time you ran discovery and discovery found Bad-
Computer.
Question: What caused the error?
Bad-Computer caused the error.
Task 2: Use the Filter tool to review a log file

1. Click Tools, click Filter, check Filter when the Entry Text, and then select
contains from the dropdown menu.
2. Type STATMSG:, and then click OK.
Question: How many status messages are there?
Four—two for each time you ran discovery.
3. Select the log entry that starts with STATMSG: ID=5203.
Question: What information do you see in the status message?
The status message ID, the agent’s name, the site name, and additional
information including several string codes.
4. Record the time the status message was generated in the info pane.
5. Click Tools, and then Click Filter.
6. Uncheck Filter when the Entry Text, and then click OK.
Results: After this exercise, you should have used the Trace32 Highlighting and
Filtering tools to assist in analyzing a log file.

Exercise 3: Reviewing Discovery Status Messages
Task 1: Review the SMS_AD_SYSTEM_DISCOVERY_AGENT status

messages
1. In the Configuration Manager console, expand System Status, expand Site
Status, expand NYC-Central Site – New York City, and then click
Component Status.
2. Right-click SMS_AD_SYSTEM_DISCOVERY_AGENT, point to Show
Messages, and then click ALL.
3. Maximize ConfigMgr Status Message Viewer for <NYC> <Central Site - New
York City>.
4. Find the 5203 status message that matches the time you recorded earlier.
5. Hover over the Description column to display the message.
6. Double-click 5203 Status Message. How many possible causes and possible
solutions are listed?
There are one of each.
7. Close the Status Message Details window.
8. Close ConfigMgr Status Message Viewer for <NYC> <Central Site - New
York City>.
Results: After this exercise, you should have reviewed the status messages
generated from the error that was previously logged.

Exercise 4: Configuring Status Messages
Task 1: Configure a status filter rule

1. In the Configuration Manager console, expand Site Management, expand
NYC - Central Site - New York City, expand Site Settings, and then click
Status Filter Rules.
2. Right-click Status Filter Rules, and then click New Status Filter Rule.
3. In the New Status Filter Rule Wizard, on the General page, set the following,
and then click Next:
• Name: Bad Computers in Active Directory
• Component: SMS_AD_SYSTEM_DISCOVERY_AGENT
• Message ID: 5203
4. On the Actions page, check Report to the event log, and then click Finish.
6. On the Confirmation page, click Close.
7. Select the Bad Computers in Active Directory status filter rule.
8. In the Actions pane, click Increment Priority until the rule reaches the top.
Task 2: Configure a status summary threshold

1. In the Configuration Manager console, click Status Summary.
2. In the results pane, double-click Component Status Summarizer.
3. Click the Thresholds tab, and then in the Message Type menu, select
Warning status messages.
4. Double-click SMS_AD_SYSTEM_DISCOVERY_AGENT.
5. Under Status message thresholds, type 3 for Warning (messages:).
6. In the Status Threshold Properties dialog box, click OK.
7. In the Component Status Summarizer Properties dialog box, click OK.

Task 3: Run Active Directory System Discovery
1. In the Configuration Manager console, click Discovery Methods, right-click

Active Directory System Discovery, and then click Properties.
then click OK.
3. Monitor the adsysdis.log in SMS Trace. Wait a moment for the new lines to
appear.
Task 4: Verify that the status filter rule was applied

1. Click Start, type eventvwr.msc, and then press ENTER.
2. Right-click Event Viewer (local), click Connect to Another Computer..., type
NYC-CFG1, and then click OK.
3. Expand Windows Logs, and then select Application.
Question: Is there a Warning entry with Source SMS Server and Event ID
5203?
Yes
Question: Is there an Information entry with source SMS Server and Event ID
4610?
Yes
Question: What does the 4610 Event show?
The 4610 Event shows that the SMS_AD_SYSTEM_DISCOVERY Component
status was set to Warning.
4. Close the Event Viewer.
Task 5: Verify that the site status has changed

1. In the Configuration Manager console, right-click System Status, and then
select Refresh.
Question: What does the site status indicator show?
The indicator is a yellow triangle, which indicates a warning status.
2. Expand Site Status, expand NYC - Central Site - New York City, and then

3. Right-click SMS_AD_SYSTEM_DISCOVERY_AGENT, point to Reset Counts,
and then click Warnings.
Note: This action clears the warning status. However, it will take a few minutes to
show the change.
Results: After this exercise, you should have configured and tested a status filter rule
and a status summary threshold.

click Revert.
4. In the Virtual Machines pane, click 6451B-NYC-DC1-B, and then in the
DC1-B, and then in the Actions pane, click Connect.
6. Wait for NYC-DC1 to start, and then start 6451B-NYC-CFG1-B. Connect to

7. Wait for NYC-CFG1 to start, and then start 6451B-NYC-CL1-B. Connect to the
virtual machine.
Module 3: Planning and Deploying Configuration Manager 2007 Clients L3-1

Module 3: Planning and Deploying
Configuration Manager 2007 Clients

Lab A: Deploying Configuration
Manager 2007 Clients
Exercise 1: Preparing the Site for Client Installation
Task 1: Verify the default management point and approval settings
1. On NYC-CFG1, click Start, point to All Programs, point to Microsoft System
Center, point to Configuration Manager 2007, and then click ConfigMgr
Console.
2. In the Configuration Manager console, expand Site Database (NYC – NYC-
CFG1, Central Site - New York City), expand Site Management, expand
NYC – Central Site - New York City, expand Site Settings, and then click
3. In the results pane, right-click Management Point Component, and then click
Properties.
4. In the Management Point Component Properties dialog box, click
Management point, and then ensure that NYC-CFG1 is listed in the Server
name list.
5. Click OK.
6. Right-click NYC-Central Site - New York City, and then click Properties.
7. Click the Site Mode tab.
8. Under Approval Settings, verify that Automatically approve computers in
trusted domains is selected, and then click OK.
L3-2 Lab A: Deploying Configuration Manager 2007 Clients

Task 2: Deploy a server locator point

NYC – Central Site - New York City, expand Site Settings, and then click Site
Systems.
2. In the results pane, right-click \\NYC-CFG1, and then click New Roles to
launch the New Site Role Wizard.
3. On the General page, do the following, and then click Next.
• Ensure that Specify a fully qualified domain name (FQDN) for this site
system on the intranet is selected.
• In the Intranet FQDN field, ensure that NYC-CFG1.Contoso.com is
entered.
• Ensure that Use the site server’s computer account to install this site
system is selected.
4. On the System Role Selection page, select Server locator point, and then
click Next.
5. On the Server Locator Point page, enter the following information, and then
click Next:
• Select Use the site database.
• Select Use the server locator point’s computer account.
7. Click Close.
8. In the Actions pane, click Refresh to update the Configuration Manager
console.
Task 3: Deploy a fallback status point

Systems.
2. Right-click \\NYC-CFG1, and then click New Roles to launch the New Site
Role Wizard.

3. On the General page, do the following, and then click Next.
entered.
system is selected.
4. On the System Role Selection page, select the Fallback status point check
box, and then click Next.
5. On the Fallback Status Point page, accept the defaults, and then click Next.
7. Click Close.
8. In the Actions pane, click Refresh to update the Configuration Manager
console.
Task 4 Deploy a reporting point

Systems.
2. Right-click NYC-CFG1, and then click New Roles to launch the New Site Role
Wizard.
3. On the General page, do the following, and then click Next:
entered.
system is selected.
4. On the System Role Selection page, select the Reporting point check box,
L3-4 Lab A: Deploying Configuration Manager 2007 Clients

5. On the Reporting Point page, accept the defaults, and then click Next.

7. Click Close.
8. In the Actions pane, click Refresh to update the console.
Results: After this exercise, you should have installed various site system roles that
relate to client deployment tasks.

Exercise 2: Deploying the Configuration Manager Client
Using the Client Push Installation Method

Task 1: Enable the client push installation method
1. On NYC-CFG1, ensure that the Configuration Manager console is open.
NYC – Central Site - New York City, expand Site Settings, and then click
Client Installation Methods.
4. On the General tab, select the following check boxes:
• Enable Client Push Installation to assigned resources (and then click
OK at the message box)
• Servers
• Workstations
• Domain controllers
• Enable Client Push Installation to site systems
5. On the Accounts tab, click New, and then provide the user name
Contoso\Administrator using the password Pa$$w0rd.
6. On the Client tab, in the Installation properties dialog box, enter
SMSSITECODE=NYC SMSSLP=NYC-CFG1 FSP=NYC-CFG1, and then click
OK.
Task 2: Verify Configuration Manager installation

1. After approximately 5 to 10 minutes, on NYC-CFG1, click Start, and then click
Control Panel.
2. Click System and Security, and then click Configuration Manager (32-bit).
3. Confirm that the computer is assigned to the NYC site.
Results: After this exercise, you should have deployed the Configuration Manager
client using the client push installation method.
L3-6 Lab B: Verifying Client Deployment

Lab B: Verifying Client Deployment
Exercise: Verifying Client Deployment

Task 1: Review status messages
1. On NYC-CFG1, in the Configuration Manager console, expand System Center
Configuration Manager, expand Site Database, expand System Status,
expand Site Status, expand NYC – Central Site – New York City, and then
2. In the results pane, click SMS_CLIENT_CONFIG_MANAGER, and then in the
Actions pane, click Show Messages.
3. Click All.
4. Click status message ID 502 or 501.
Note: These status messages might take a few minutes to appear.
5. On the View menu, click Detail.

6. Click OK.
7. Browse through the other listed messages.
8. On the File menu, click Exit.

1. On NYC-CL1, open
C:\Windows\System32\Ccm\Logs\ClientIDManagerStartup.log.
3. In the Find what field, type Site assignment.
4. Click Find.
Question: Did the site assignment change?
The site changed from <none> to NYC.
5. Close SMS Trace.

6. Open C:\Windows\System32\Ccm\Logs\ClientLocation.log.

8. In the Find what field, type Assigning Client to Site.
9. Click Find. What is the assigned site for the client?
The client is assigned to NYC.
11. Open C:\Windows\System32\Ccm\Logs\LocationServices.log.
13. In the Find what field, enter Current AD Site.
14. Click Find.
Question: What is the current AD site?
NewYork is the AD site for the client.
16. Close the Logs window.
Task 3: Review reporting

Configuration Manager, expand Site Database, expand Computer
Management, and then expand Reporting.
2. In the tree pane, click Reports.
3. In the results pane, click Client Deployment Success Report.
4. On the Actions pane, in the Client Deployment Success Report section, click
Run, select the Open reports in a new window check box, and then click OK.
5. View the report data to identify the clients that deployed successfully. It may
take some time before data is available for the report.
6. View other reports based on the SMS Site - Client Information category.
Results: After this exercise, you should have verified that the Configuration
Manager client has installed successfully.
L3-8 Lab B: Verifying Client Deployment

click Revert.
4. In the Virtual Machines pane, click 6451B-NYC-DC1-C, and then in the
DC1-C, and then in the Actions pane, click Connect.
6. Wait for NYC-DC1 to start, and then start 6451B-NYC-CFG1-C. Connect to

7. Wait for NYC-CFG1 to start, and then start 6451B-NYC-CL1-C. Connect to the
virtual machine.
Module 4: Inventory Collection, Software Metering, and Asset Intelligence L4-1

Module 4: Inventory Collection, Software
Metering, and Asset Intelligence

Lab A: Collecting Inventory
Exercise 1: Configuring and Managing Hardware Inventory
Task 1: Enable and configure the Hardware Inventory Client Agent
Console. At the User Account Control prompt, click Yes.
2. In the Configuration Manager console, expand Site Database (NYC - NYC-
CFG1, Central Site - New York City).
3. Expand Site Management, expand NYC - Central Site - New York City,
expand Site Settings, and then click Client Agents.
4. In the results pane, double-click Hardware Inventory Client Agent.
5. On the General tab, select the Enable hardware inventory on clients check
box.
6. Under Inventory schedule, click the Custom schedule option, and then click
Customize.
7. On the Custom Schedule dialog box, under Recurrence pattern, click
Weekly.
8. Select Friday, and then click OK.
9. On the Hardware Inventory Client Agent Properties dialog box, click OK.

L4-2 Lab A: Collecting Inventory

1. On NYC-CL1, click Start, and then click Control Panel.

2. In Control Panel, click System and Security.
3. In System and Security, click Configuration Manager.
4. Click the Actions tab.
5. Under Actions, select Machine Policy Retrieval & Evaluation Cycle, and
then click Initiate Action. In the Machine Policy Retrieval & Evaluation
Cycle dialog box, click OK. Click OK to close the Configuration Manager
Properties dialog box.
the next step. Note that you will have to close the Configuration Manager Properties
dialog box and then reopen it to view the status change.
6. Click Configuration Manager, and then click the Components tab. Verify that
ConfigMgr Inventory Agent appears in the Component column, and that the
Status is Enabled.
Note: Leave the Configuration Manager Properties dialog box open.

1. On NYC-CL1, in Configuration Manager, click the Actions tab.
2. Under Actions, select Hardware Inventory Cycle, and then click Initiate
Action. In the Hardware Inventory Cycle dialog box, click OK.
3. In the Configuration Manager Properties dialog box, click OK.
4. Close the System and Security window.

Task 4: View hardware inventory using Resource Explorer
1. On NYC-CFG1, in the Configuration Manager console, expand Site Database

(NYC - NYC-CFG1, Central Site - New York City), expand Computer
Management, expand Collections, and then click All Systems.
2. In the results pane, right-click NYC-CL1, point to Start, and then click
Resource Explorer.
3. In the ResourceExplorer – [NYC-CL1] window, expand Resource Explorer,
and then expand Hardware.
4. Click the CD-ROM Drive component to view data related to the CD-ROM.
5. Click the Desktop Monitor component to view data related to the monitor.
6. Click the IDE Controller component to view data related to the integrated
device electronics (IDE) Controller.
7. Click the Workstation Status component to view data related to the last
hardware scan.
8. Close Resource Explorer.
Results: At the end of this exercise, you will have verified that NYC-CL1 reported
hardware inventory by viewing the information in Resource Explorer.

Exercise 2: Modifying Hardware Inventory Collection
Task 1: Modify the Sms_def.mof file on the site server

1. On NYC-CFG1, click Start, click Run, type C:\Microsoft Configuration
Manager\inboxes\clifiles.src\hinv\, and then click OK.
2. In the open window, double-click Sms_def.mof.
3. In the Windows dialog box, click Select the program from a list, and then
click OK.
4. In the Open with dialog box, click Notepad, clear the Always use the selected
program to open this kind of file check box, and then click OK. Maximize
the Notepad window.
5. Search for the first occurrence of the CD-ROM attribute:
a. On the Edit menu, click Find.
b. In the Find dialog box, in the Find what field, type CD-ROM, and then
click Find Next.
c. Once you have found the first occurrence, click Cancel to close the Find
dialog box.
6. For the CD-ROM, change the SMS_Report attribute to FALSE. Verify that your
changes look like the example below:
[SMS_Report (FALSE),
SMS_Group_Name (“CD-ROM”),
SMS_Class_ID (“MICROSOFT|CDROM|1.0”)]
7. Repeat steps 5 and 6 for the Desktop Monitor and IDE Controller attributes.
The changes should look like the following examples:
SMS_Group_Name (“Desktop Monitor”),
SMS_Class_ID (“MICROSOFT|DESKTOP_MONITOR|1.0”)]
SMS_Group_Name (“IDE Controller”),
SMS_Class_ID (“MICROSOFT|IDE_CONTROLLER|1.0”)]

8. On the File menu, click Save, and then close Notepad.
9. Close the hinv window.
Task 2: Verify that the hardware inventory changes were modified

successfully
1. On NYC-CFG1, click Start, and then click Run.
2. In the Open box, type C:\Microsoft Configuration
Manager\Logs\dataldr.log, and then click OK.
3. Search for the first occurrence of the Removing Dataitem.
a. On the Tools menu, click Find.
b. In the Find what box, type Removing Dataitem, and then click Find.
c. Once you have found the first occurrence, scroll down a few lines. Notice
that there are three instances in the log file that start with Removing
Dataitem. These are the three attributes that were modified.
4. Close SMS Trace.
Cycle dialog box, click OK.
the next step.
10. On the Actions tab, click Hardware Inventory Cycle, and then click Initiate
Action. In the Hardware Inventory Cycle dialog box, click OK.
11. Click OK to close the Configuration Manager Properties box.


14. In the results pane, right-click NYC-CL1, point to Start, and then click
Resource Explorer.
15. In the ResourceExplorer – [NYC-CL1] window, expand Resource Explorer,
and then expand Hardware. Notice that in the list of components displayed in
the console tree, the CD-ROM, Desktop Monitor, and IDE Controller classes
are no longer visible.
16. Expand Hardware History. Notice that CDROM Drive History, Desktop
Monitor History, and IDE Controller History are listed.
Results: At the end of this exercise, you will have modified hardware inventory
collection, and verified the changes.

Exercise 3: Configuring and Managing Software Inventory
Task 1: Enable and configure the Software Inventory Client Agent.

Console. The Configuration Manager console opens.
4. In the results pane, double-click Software Inventory Client Agent.
5. On the General tab, select the Enable software inventory on clients check
box.
6. Under Inventory schedule, click the Custom schedule option, and then click
Customize.
7. On the Custom Schedule dialog box, under Recurrence pattern, click
Weekly.
8. In the spin box between Recur every and weeks on, configure a value of 2.
9. Select Thursday, and then click OK.
10. Click the Inventory Collection tab.
11. Under File types, select *.exe, and then click the edit (finger pointing to
document) icon.
12. To inventory all the EXE files in the root of the system drive, perform the
following steps:
a. Click Set.
b. In the Path Properties box, click Variable or path name, and then in the
Location box, type %SystemDrive%.
c. Verify that the Search subdirectories check box is selected.
d. Click OK to close the Path Properties box.
e. Click OK to close the Inventoried File Properties box.
13. Click Apply.


14. Click the File Collection tab and then click the New (star) icon.
15. In the Name box, type ClientLocation.log. This file will provide information
related to the client’s default management point.
16. In the Maximum size (KB) box, type 1024.
17. Click OK to close the Collected File Properties box.
18. Click OK to close the Software Inventory Client Agent Properties page.
Note: Leave the Configuration Manager Console open.

6. Click OK to close the Configuration Manager Properties dialog box.
the next step.
Task 3: Initiate a Software Inventory Cycle and File Collection Cycle on

the client
1. On NYC-CL1 in the Control Panel, click Configuration Manager and then
click the Actions tab.
2. Under Actions, select Software Inventory Cycle, and then click Initiate
Action. In the Software Inventory Cycle dialog box, click OK.

3. Under Actions, select File Collection Cycle, and then click Initiate Action. In
the File Collection Cycle dialog box, click OK.

4. In the Configuration Manager Properties dialog box, click OK.
5. Close Control Panel.
Note: Wait at least five minutes for the software inventory cycle and file collection
cycle to complete before moving to the next step.
Task 4: View software inventory using Resource Explorer

2. In the results pane, right-click NYC-CL1, click Start, and then click Resource
Explorer.
3. In the ResourceExplorer- [NYC-CL1] window, expand Resource Explorer, and
then expand Software.
4. Click Collected Files.
5. In the results pane, right-click the log file, click All Tasks, and then click View
File to view the file in SMS Trace. Close SMS Trace when you are finished
viewing the log file.
6. Click File Details. Review the executable files that have been inventoried.
Results: At the end of this exercise, you will have viewed collected files and software
L4-10 Lab B: Using Asset Intelligence

Lab B: Using Asset Intelligence
Exercise 1: Configuring Asset Intelligence Prerequisites

Task 1: Verify that Hardware and Software Inventory Client Agents are
enabled
Console. At the User Account Control prompt, click Yes. The Configuration
Manager console opens.
4. In the results pane, double-click Hardware Inventory Client Agent.
5. On the General tab, verify that the Enable hardware inventory on clients
check box is selected, and then click OK.
6. In the results pane, double-click Software Inventory Client Agent.
7. On the General tab, verify that the Enable software inventory on clients
check box is selected, and then click OK.
Task 2: Modify the Configuration.mof file on the site server

1. On NYC-CFG1, click Start, click Run, type C:\Microsoft Configuration
Manager\inboxes\clifiles.src\hinv\, and then click OK.
2. In the open window, double-click Configuration.mof.
3. In the Windows dialog box, click Select a program from a list, and then click
OK.

4. In the Open with dialog box, click Notepad, clear the check box for Always
use the selected program to open this kind of file, and then click OK.
Maximize the Notepad window.
5. Search for the CCM_CALTrackConfig section:
a. On the Edit menu, click Find.
b. In the Find what box, type CCM_CALTrackConfig, and then click Find
Next.
c. Once you have found the second occurrence, click Cancel to close the
Find dialog box.
6. In the CCM_CALTrackConfig section, make the following changes:
• CALCollectionType = 3
• CALCollectionFrequencyDays = 0
• CALCollectionFrequencyMinutes = 5
The changes should look like the following example:
{
CALCollectionType = 3; //0-Disabled, 1-User CAL, 2-Device CAL,
3-All
CALCollectionFrequencyDays = 0;
CALCollectionFrequencyMinutes = 5;
CALCollectionTimeWindow = 90;
CALCollectionSupportedWindowsVersions = "5.0,5.2,6.0";
7. On the File menu, click Save, and then close Notepad.

8. Close the hinv window.
Task 3: Configure the Asset Intelligence site maintenance tasks

(NYC - NYC-CFG1, Central Site - New York City).
expand Site Settings, expand Site Maintenance, and then select Tasks.

3. In the details pane, double-click the Summarize Client Access License
Weekly Usage Data task.

4. In the Summarize Client Access License Weekly Usage Data Properties page,
ensure that the Enable this task check box is selected.
5. Under Schedule, configure the Start after: time as 10:00 AM, configure the
Latest start time: as 10:30 AM, and select the check box labeled Tuesday, and
then click OK.
6. In the Configuration Manager console details pane, double-click the Delete
Aged Client Access License Data task.
7. On the Delete Aged Client Access License Data Properties page, verify that
the Enable this task check box is selected.
8. Verify that the Saturday and Sunday check boxes are selected, and then click
OK.
Task 4: Configure Windows event log settings

1. On NYC-DC1, click Start, click Administrative Tools, and then click Group
Policy Management.
2. In the Group Policy Management console tree, expand Forest: Contoso.com.
3. Expand Domains, expand Contoso.com, and then select Group Policy
Objects.
4. In the details pane, right-click Default Domain Policy, and then click Edit.
5. In the Group Policy Management Editor console tree, expand Computer
Configuration, expand Policies, expand Windows Settings, expand Security
Settings, expand Local Policies, and then select Audit Policy.
6. In the details pane, double-click Audit logon events.
7. In the Audit logon events Properties page, select Define these policy
settings, verify that the Success check box is selected, and then click OK.
8. Close the Group Policy Management Editor console, and then close the Group
Policy Management console.
9. On NYC-CL1, click Start, click All Programs, click Accessories, right-click
Command Prompt, and click Run as Administrator.

10. In the User Access Control box, click Yes.
11. In the Administrator: command prompt, type gpupdate /force, and then
press ENTER.
12. At the command prompt, type exit, and then press ENTER.
Results: At the end of this exercise, you will have configured the prerequisites for
Asset Intelligence.

Exercise 2: Configuring Asset Intelligence
Task 1: Enable Asset Intelligence data collection.

2. Expand Computer Management, right-click Asset Intelligence, and then click
Enable Asset Intelligence.
3. In the Asset Intelligence Reporting Class Settings dialog box, select Enable
all Asset Intelligence reporting classes, and then click OK.
4. In the Asset Intelligence Reporting Class Settings Modification dialog box,
click Yes.
Task 2: Configure an Asset Intelligence synchronization point

expand Site Settings, expand Site Systems, and then select \\NYC-CFG1.
3. Right-click \\NYC-CFG1, and then click New Roles.
4. In the New Site Role Wizard, on the General page, click Next.
5. On the System Role Selection page, select Asset Intelligence
Synchronization Point, and then click Next.
6. On the Asset Intelligence Synchronization Point Configuration Settings
page, click Next.
7. On the Proxy Server Settings page, click Next.
8. On the Synchronization Schedule page, clear the Enable synchronization on
a schedule check box, and then click Next.
Note: You will configure a synchronization schedule in a later task.


Task 3: Configure an Asset Intelligence catalog synchronization
schedule
2. Expand Computer Management, right-click Asset Intelligence, and then click
Schedule Catalog Synchronization.
3. In the Asset Intelligence Synchronization Point Schedule dialog box, select
Enable synchronization on a schedule.
4. Under Synchronization schedule, select Custom schedule, and click
Customize.
5. In the Custom Schedule dialog box, under Time, in the Start boxes, configure
a start date of June 1, 2010 and a start time of 1:00 PM.
6. Under Recurrence pattern, select Custom interval.
7. Under Recur every, set the interval to 1 Days.
8. Click OK to close the Custom Schedule dialog box.
9. Click OK to close the Asset Intelligence Synchronization Point Schedule
dialog box.
Results: After this exercise, you should have enabled Asset Intelligence, configured
an Asset Intelligence synchronization point, and scheduled synchronization.

Exercise 3: Customizing Asset Intelligence
Task 1: Customize the Asset Intelligence catalog

2. Expand Computer Management, expand Asset Intelligence, expand
Customize Catalog and then select Software Categories.
3. Right-click Software Categories, and click New Category.
4. In the New Category Wizard, on the General page, in the Category name box,
type Contoso developed. In the Description box, type Software developed
in-house by Contoso, and then click Next.
7. In the Configuration Manager Console, in the Customize Catalog node,
select Software Families.
8. Right-click Software Families, and then click New Family.
9. In the New Family wizard, on the General page, in the Family name box, type
Custom Software. In the Description box, type Special-use, custom
application software, and then click Next.
12. In the Configuration Manager console, in the Customize Catalog node, select
Custom Labels.
13. Right-click Custom Labels and click New Label.
14. In the New Label Wizard, on the General page, in the Label name box, type
Unsupported. In the Description box, type Software not supported by
Contoso IT, and then click Next.


Task 2: Import licensing data
1. On NYC-CFG1, in the Configuration Manager console, right-click Asset

Intelligence, and then click Import Software Licenses.
2. In the Import Software Licenses Wizard, on the Welcome page, click Next.
3. On the Import page, in the Path box, type \\NYC-
CFG1\Labfiles\Licenses\LicenseData.csv, and then click Next.

4. In the Configuration Manager Properties box, click the Actions tab.
the next step.
Task 4: Initiate a Hardware Inventory Cycle on the Client

1. On NYC-CL1, in the Control Panel, click Configuration Manager and then
click the Actions tab.
2. Under Actions, select Hardware Inventory Cycle, and then click Initiate
Action.
3. In the Hardware Inventory Cycle box, click OK.

Task 5: Initiate a Software Inventory Cycle on the Client
1. On NYC-CL1 in Configuration Manager Properties, click the Actions tab.

2. Under Actions, select Software Inventory Cycle, and then click Initiate
Action.
3. In the Software Inventory Cycle box, click OK.
4. In the Configuration Manager Properties box, click OK.
5. Close Control Panel.
Note: Wait several minutes for the Software Inventory Cycle to complete before
moving to the next step.
Results: After this exercise, you should have customized the Asset Intelligence
catalog, imported licensing information, and initiated inventory reporting on a
client.

Exercise 4: Viewing Asset Intelligence Reports
Task 1: Review reported Asset Intelligence information in the

Configuration Manager console
2. Expand Computer Management, and then select Asset Intelligence.
3. In the details pane, review the Asset Intelligence Catalog Summary and Asset
Intelligence Catalog synchronization status areas.
4. In the console tree, expand Asset Intelligence, expand Inventoried Software
Titles, and then select All Inventoried Software Titles. Review the
information displayed in the details pane.
5. In the console tree, select Unidentified and Not Pending Online
Identification. Review the information displayed in the details pane.
Task 2: Run Asset Intelligence reports

2. Expand Computer Management, expand Asset Intelligence, and then select
Asset Intelligence Reports.
3. In the results pane, right-click Hardware 03A - Primary computer users, and
then click Run.
4. In the Report Options dialog box, under Classic Reporting, select Open
reports in a new window, and then click OK.
5. In the View ConfigMgr Reports – Windows Internet Explorer window, in the
Collection area, click Values.
6. In the Select Value – Webpage Dialog browser window, click SMS00001 to
select the All Systems collection.
7. Ensure that SMS00001 appears in the Collection box, and then click the
Display link.
8. Review the report and then close all browser windows.
9. In the Configuration Manager console results pane, right-click License 15A -
General License Reconciliation Report, and then click Run.


12. Verify that SMS00001 appears in the Collection box, and then click the
Display link.
13. Review the report and then close all browser windows.
14. In the Configuration Manager console results pane, right-click Software 01A -
Summary of installed software in a specific collection, and then click Run.
17. Verify that SMS00001 appears in the Collection box.
18. Verify that 100 appears in the Specify the number of rows to return box.
19. Click the Display icon.
20. Review the report, and close all browser windows.
Results: After this exercise, you will have reviewed Asset Inventory data both in the
Configuration Manager Console, and by using reports.

Lab C: Configuring Software
Metering
Lab Setup
Exercise: Configuring Software Metering
Task 1: Enable and configure the Software Metering Client Agent
Console. At the User Account Control prompt, click Yes.
CFG1 Central Site - New York City).
4. In the results pane, double-click Software Metering Client Agent.
5. On the General tab, select the Enable software metering on clients check
box.
6. On the Schedule tab, click Schedule.
7. Under Recurrence pattern, select Custom interval. Under Recur every, set
the interval to 3 Days, and then click OK.
8. In the Software Metering Client Agent Properties dialog box, click OK.
Task 2: Create a software metering rule to meter Windows Calculator

1. On NYC-CFG1, in the Configuration Manager console, expand Computer
Management, and then click Software Metering.
2. In the console tree, right-click Software Metering, point to New, and then
click Software Metering Rule.
3. In the New Software Metering Rule Wizard, in the Name box, type CalcRule.
4. Click Browse, and browse to C:\Windows\system32.
5. Click Calc.exe, and then click Open. Notice that the Original file name,
Version, and Language boxes are populated automatically.
L4-22 Lab C: Configuring Software Metering

6. In the Version box, delete the existing version text, and type the wildcard
character *.
7. In the Language: box, select – Any --.
8. Click Next, and then click Finish.
Task 3: Configure software metering rule auto-creation

1. On NYC-CFG1, in the Configuration Manager console, right-click Software
Metering, and then click Properties.
2. In the Software Metering Properties dialog box, ensure that Auto-create
disabled metering rules from recent usage inventory data is enabled.
3. In the Rules will be auto-created when an executable is used on a specific
percentage of computers within the site. At what percent should rules be
auto-created? box, configure a setting of 5.
4. In the Rules will not be auto-created if the total number of rules within the
site exceeds a set threshold. What is the threshold for this site? box,
configure a setting of 25.
5. Click OK to close the Software Metering Properties dialog box.

4. In the Configuration Manager Properties dialog box, click the Actions tab.

the next step. Note that you will have to close the Configuration Manager Properties
dialog box and then reopen it to view the status change.

8. In the Configuration Manager Properties dialog box, select the Components
tab. Verify that ConfigMgr Software Metering Agent appears in the
Component column, and that the Status is Enabled.
Task 5: Create test data on the client

1. On NYC-CL1, click Start, point to All Programs, click Accessories, and then
click Calculator. Close Calculator.
2. Click Start, point to All Programs, click Accessories, and then click Notepad.
Close Notepad.
3. Repeat steps 1 and 2 several times to generate test-metering data in the log
files.
Task 6: Initiate a usage report on the client

3. In System and Security, click Configuration Manager..
4. In the Configuration Manager Properties dialog box, lick the Actions tab.

5. Under Actions, select Software Metering Usage Report Cycle, and then click
Initiate Action. In the Software Metering Usage Report Cycle dialog box,
click OK.
Note: Wait at least two minutes for the cycle to complete before moving to the next
step.
Task 7: Verify software metering on the client

double-click mtrmgr.log. Maximize the SMS Trace window.
2. Click the Tools menu, and then click Find.
3. In the Find what box, type calc.exe, and then click Find.
4. Scroll down and verify that the following entries are present for calc.exe:
• Creation event received for process xxx
• Process ID xxx is for process C:\Windows\system32\calc.exe
• Found match against RuleID NYC00yyy
• Tracked usage for process xxx
The Process ID xxx corresponds to the decimal value that this application has
in task manager. The RuleID NYC00yyy is the rule number automatically
assigned when you created each software metering rule.
The Found match and Tracked usage lines indicate that the client is metering
the configured software.

5. Scroll down and verify that the following entries are present for notepad.exe:
• Creation event received for process xxx

• Process ID xxx is for process C:\Windows\system32\notepad.exe
• Tracked usage for process xxx
6. Close SMS Trace.
Task 8: Initiate metering data summarization

1. On NYC-CFG1, click Start, click All Programs, click Accessories, and then
click Command Prompt.
2. At the command prompt, type C: , and then press ENTER.
3. Type cd “\Microsoft Configuration Manager\bin\i386” and then press
ENTER.
4. Type e:\Labfiles\ConfigMgrSP2\Tools\RUNMETERSUMM.EXE SMS_NYC
and then press ENTER.
Note: The RunMeterSumm tool must be run from the specified path. The command
is case-sensitive; the database parameter, SMS_NYC, must be typed in upper case.
5. Review the output of the RUNMETERSUMM command. Verify that the rows
added to File Usage Summary are greater than 0.
6. At the command prompt, type exit, and then press ENTER.
Task 9: View a software metering report

CFG1 Central Site - New York City).
2. Expand Computer Management, expand Reporting, and then click Reports.
3. In the detail pane, click the Category heading. The list of reports is sorted by
category.
4. Scroll down the list of reports and locate the reports in the Software Metering
category. Review the titles of the Software Metering reports.

5. Right-click the Computers that have run a specific metered software
program report, and then click Run.

6. If the Report Options dialog box appears, under Classic Reporting, in the
Select the default reporting point for running reports drop-down list, select
http://NYC-CFG1:80/SMSReporting_NYC, select Open reports in a new
window, and then click OK.
7. In Internet Explorer, in the View ConfigMgr Reports window, in the Rule
Name area, click Values.
8. In the Select Value – Webpage Dialog browser window, click CalcRule.
Ensure that the value CalcRule appears in the Rule Name box.
9. In the Month (1-12) area, click Values. In the Select Value – Webpage Dialog
window, click the current month..
10. In the Year box, type the current year.
11. Click the Display icon.
12. In the ConfigMgr Report window, review the report, and then close all open
windows.
Results: After this exercise, you should have viewed software metering information
by using a report.

1. On the host computer, start Microsoft Hyper-V™ Manager.
click Revert.


virtual machine.
Module 5: Querying and Reporting Data L5-1

Module 5: Querying and Reporting Data
Lab A: Creating Queries

Exercise 1: Creating and Running a Query
Task 1: Create a query
1. Log on NYC-CFG1 as Contoso\Ed using the password of Pa$$w0rd.
Configuration Manager 2007, click ConfigMgr Console, and then click Yes
at the prompt.
3. Expand Site Database, expand Computer Management, and then click on
Queries.
5. On the General page, in the Name field, type All Windows 7 Systems.
6. In the Comment field, type Query to find all discovered Windows 7
Systems, and then click Import Query Statement.
7. In the Browse Query dialog box, select All Systems, and then click OK.
8. On the General page, click Edit Query Statement.
9. In the Query Statement dialog box, click Criteria, and then click the New
(star) button.
10. On the Criterion Properties page, in the Criterion Type field, select Simple
value, and then click Select.
11. In the Select Attribute dialog box, in the Attribute class list, click System
Resource.
12. In the Attribute list, click Operating System Name and Version, and then
click OK.
13. On the Criterion Properties page, in the Operator field, select is equal to,
and then click Value.
14. In the Values window, select Microsoft Windows NT Workstation 6.1, and
then click OK.
15. On the Criterion Properties page, click OK.
L5-2 Lab A: Creating Queries

16. On the Query Statement Properties dialog box, click OK.

18. On the Security page; click Finish.
Task 2: Run a query and view the results

• Double-click the All Windows 7 Systems query.
NYC-CL1 and NYC-CL3
Results: After this exercise, you should have created and run a query to find all the
discovered Windows® 7 systems.

Exercise 2: Creating and Running a Complex Query
Task 1: Create and edit a complex query

2. On the General page, in the Name field, type All Windows 7 Systems
without the ConfigMgr Client.
3. In the Comment field, type Query to find all discovered Windows 7 Systems
without a Configuration Manager client, and then click Import Query
Statement.
4. In the Browse Query dialog box, select All Windows 7 Systems, and then
click OK.
5. On the General page, click Edit Query Statement.
6. On the Query Statement dialog box, click Criteria, and then click the New
(star) button.
7. On the Criterion Properties page, in the Criterion Type field, select Null
Value, and then click Select.
8. In the Select Attribute dialog box, in the Attribute class list, click System
Resource.
9. In the Attribute list, click Client, and then click OK.
10. On the Criterion Properties page, in the Operator list, click is NULL.
11. On the Criterion Properties page, click OK.
12. On the Query Statement Properties dialog box, click OK.
14. On the Security page, click Finish.

Task 2: Run the query and view the results
• Double-click the All Windows 7 Systems without the ConfigMgr Client

query.
NYC-CL3
Results: After this exercise, you should have run a query to find all discovered
Windows 7 systems that have not yet had the client installed.

Exercise 3: Creating and Running a Status Message Query
Task 1: Create a status message query

1. In the console tree, expand System Status, and then click Status Message
Queries.
2. Right-click Status Message Queries, and then select New Status Message
Query.
3. On the General page, on the Name field, type Inventory Resynchronization
Requests.
4. In the Comment field, type Query for Inventory Resynchronization
requests, and then click Edit Query Statement.
5. In the Query Statement dialog box, click Criteria, and then click the New
(star) button.
6. On the Criterion Properties page, in the Criterion Type field, select Simple
value, and then click Select.
7. In the Select Attribute dialog box, in the Attribute class list, click Status
Message.
8. In the Attribute list, click Message ID, and then click OK.
9. On the Criterion Properties page, in the Operator list, click is equal to.
10. In the Value field, type 2715, and then click OK.
11. On the Query Statement Properties page, click OK, and then click Finish.

Task 2: Run the status message query

Messages.
Question: How many resynchronization requests are shown?
Six are shown, one for each client.
Question: What does the resynchronization request indicate?
The current MIF file represents all inventory for the current machine.
Question: Does this indicate an error?
No, this represents the initial inventory for each client.
Results: After this exercise, you should have created and run a status message
query.

Lab B: Creating a Reporting Point
Exercise 1: Installing Reporting Point Prerequisites

Task: Install IIS
1. On NYC-SVR2, click Start, right-click Computer, and then click Manage.
2. Click Roles, and then click Add Roles.
3. In the Add Roles Wizard, click Next, select the Web Server (IIS) check box,
4. On the Web Server (IIS) page, click Next.
5. On the Select Role Services page, select the ASP.NET check box.
6. Click Add Required Role Services.
7. Select the ASP check box.
8. Select the Windows Authentication check box.
9. Select the IIS 6 Metabase Compatibility check box.
10. Select the IIS 6 WMI Compatibility check box.
11. On the Select Role Services page, click Next.
14. Log off NYC-SVR2.
Results: After this exercise, you should have installed Internet Information Services
(IIS) with the components to support a reporting point.
L5-8 Lab B: Creating a Reporting Point

Exercise 2: Adding a Site System with the Reporting Point
Role
Task: Add a new site system
1. Connect to the NYC-CFG1 computer.
2. In the Configuration Manager console, expand Site Database, expand Site
Management, expand NYC - Central Site - New York City, and then expand
Site Settings.
3. Click Site Systems.
5. On the General page, in the Name field, type NYC-SVR2.
6. In the Intranet FQDN field, type NYC-SVR2.Contoso.com.
7. Select Use another account for installing this site system, and then click Set.
8. In the Windows User Account dialog box, in the User name field, type
Contoso\Administrator.
9. In the Windows User Account dialog box, in the Password field, type
Pa$$w0rd.
10. In the Confirm Password field, type Pa$$w0rd, click OK, and then click
Next.
11. On the System Role Selection page, check Reporting point, and then click
Next.
12. Review the Reporting Point page, and then click Next.
Results: After this exercise, you should have added a new site system with the
reporting point role.

Exercise 3: Using the Report Viewer in a Web Browser
Task: Open the Report Viewer and view a report

1. On NYC-CFG1, open Windows® Internet Explorer®.
2. In the Address bar, type http://NYC-SVR2:80/SMSReporting_NYC, and then
press ENTER.
3. In the reports pane, click Upgrade Assessment - Windows 7, and then click
Windows 7 Upgrade Assessment - Hardware summary for all systems in a
collection.
4. Under Report Information, click Values, select All Windows Workstation or
Professional Systems, and then click Display.
Results: After this exercise, you should have viewed a report through Internet
Explorer.
L5-10 Lab C: Managing Reports

Lab C: Managing Reports
Exercise 1: Creating a List Report

Task 1: Create a report that lists computers by NetBIOS name, user ID,
and manufacturer
1. On NYC-CFG1, click Start, type Notepad, and then press ENTER.
2. In Notepad, click File, click Open, browse to E:\Labfiles\Reports\List.sql,
and then click Open. You may need to change the file type to All Files.
3. Select and copy the contents of the file.
4. Minimize Notepad.
6. Expand Site Database, expand Computer Management, expand Reporting,
and then click Reports.
7. In the Actions pane, click New, and then click Report.
8. On the General page, in the Name field, type Computers by Manufacturer.
9. In the Category field, type Contoso, and then click Edit SQL Statement.
all text, paste the copied text from List.sql, and then click OK.
11. Click Next.
12. On the Display page, click Next.
13. On the Links page, click Next.
14. On the Security page, click Next.
15. On the Wizard Complete page, click Close.

Task 2: Review the list report
1. Open Internet Explorer.

2. In the Address bar, type http://NYC-SVR2:80/SMSReporting_NYC.
3. In the reports pane, click Contoso, select Computers by Manufacturer, and
then click Display.
4. Review the results.
5. Close the report window.
Reports page.
Results: After this exercise, you should have created and viewed a list report.

Exercise 2: Creating a Filter Report
Task 1: Edit the list report

1. Restore Notepad, click File, click Open, browse to
E:\Labfiles\Reports\Filter.sql, and then click Open.
4. In the Configuration Manager console, click Reports.
6. In the Computers by Manufacturer Properties dialog box, click Edit SQL
Statement.
7. In the Report SQL Statement dialog box, click Prompts, and then click the
New (star) button.
8. In the Prompt Properties dialog box, in the Name field, type Manufacturer.
9. In the Prompt text field, type Enter Name of Manufacturer, and then select
the Provide a SQL statement check box.
10. On the Prompt Properties dialog box, click Edit SQL Statement.
11. In the Prompt SQL Statement field, paste in the copied contents from
Filter.sql, and then click OK.
12. Click OK to close the Prompt Properties dialog box, and then click OK to
close the Prompts dialog box.
13. In the Linked Reports and Dashboards dialog box, click Yes.
14. In the Report SQL Statement dialog box, in the SQL Statement field, replace
‘Microsoft Corporation’ with @Manufacturer.
15. Click OK to close the Report SQL Statement dialog box, and then click OK to
close the Computers by Manufacturer Properties dialog box.

Reports page. Refresh the page.
2. Click Contoso, and then select Computers by Manufacturer.
3. Under Report Information, click Values, select Microsoft Corporation, and
then click Display.
Reports page.
Results: After this exercise, you should have created and viewed a filter report.

Exercise 3: Creating a Count Report
Task 1: Create a count report

1. Restore Notepad, click File, click Open, browse to
E:\Labfiles\Reports\Count.sql, and then click Open.
5. In the Actions pane, click New, and then click Report.
6. On the General page, in the Name field, type Count of PCs by Manufacturer.
7. In the Category field, type Contoso, and then click Edit SQL Statement.
all text, paste the copied text from Count.sql, and then click OK.
9. Click Next.
10. On the Display page, click Next.
11. On the Links page, click Next.
13. On the Wizard Complete page, click Close.

Reports page.
2. Right-click and select Refresh.
then click Display.

Reports page.
Results: After this exercise, you should have created and viewed a count report.

Exercise 4: Enabling a Link in a Report
Task 1: Edit the Contoso reports

3. In the Computers by Manufacturer Properties dialog box, click Links.
4. In the Link type list, click Link to Computer Details, and then click OK.
5. Right-click Count of PCs by Manufacturer, and then click Properties.
6. In the Count of PCs by Manufacturer Properties dialog box, click Links.
7. In the Link type list, click Link to another report.
8. Click Select, and in the Select Report dialog box, click Computers by
Manufacturer.
9. Click OK, and then click OK again.
Task 2: Review the linked reports

Reports page.
then click Display.
4. Click the arrow next to Microsoft Corporation. Notice that Microsoft
Corporation is entered automatically in the Computers by Manufacturer
report, and that the report displays.
5. Click the arrow next to NYC-CFG1. Note that NYC-CFG1 is entered
automatically in the Computer Details report, and that the report displays.
6. Click Hardware – Processor, and then click Processor information for a
specific computer.

8. Close the report windows.
Reports page.
Results: After this exercise, you should have created and viewed linked reports.
L5-18 Lab D: Working with Dashboards

Lab D: Working with Dashboards
Exercise: Creating and Using a Dashboard

Task 1: Create a dashboard
1. In the Configuration Manager console, under the Reporting node, click
Dashboards.
2. In the Actions pane, click New Dashboard.
3. In the New Dashboard Wizard, on the General page, in the Name field, type
Contoso, and then click Next.
4. In the New Dashboard Wizard, on the Reports page, highlight Row 1 and
Column 1, and then click Properties.
5. In the Select Report dialog box, highlight Count of PCs by Manufacturers,
and then click OK.
6. Highlight Row 1 and Column 2, and then click Properties.
7. In the Select Report dialog box, highlight All software companies, and then
click OK.
9. In the Select Report dialog box, highlight Count operating systems and
service packs, and then click OK.
11. In the Select Report dialog box, highlight Computers that may share the
same SMS Unique ID, and then click OK.
12. Click Finish.
Task 2: Use the dashboard

Reports page.
3. Scroll down to the Dashboards section, select the Contoso, and then click
Display.

5. Close the dashboard window.
6. Close the Internet Explorer window that is open to the View ConfigMgr
Reports page.
Results: After this exercise, you should have created and used a dashboard.
L5-20 Lab E: Using SQL Reporting Services

Lab E: Using SQL Reporting
Services
Exercise 1: Installing the Reporting Services Point Role
Task 1: Verify SQL Reporting Services
1. On NYC-CFG1, click Start, click All Programs, click Microsoft SQL Server
2008, and then click Configuration Tools.
2. Click Reporting Services Configuration Manager, and then click Yes at the
prompt.
3. Verify that Reporting Services Configuration Connection is connecting to:
• Report Server Instance: MSSQLSERVER
4. Click Connect.
5. Click Service Account.
6. Verify that Use built-in account is selected, and that Local System is selected
in the drop-down list.
7. Click Web Service URL and verify the following settings:
• Virtual Directory: ReportServer
• IP Address: All Assigned
• TCP Port: 80
• SSL Certificate: (Not Selected)
8. Click Database and verify the following settings:
• SQL server: NYC-CFG1
• Database name: ReportServer
• Report Server Mode: Native

9. Click Report Manager URL and verify the following settings:
• Virtual Directory: Reports

• URLs: http://NYC-CFG1:80/Reports
10. Exit Reporting Services Configuration Manager.
Task 2: Install the Reporting Services point

NYC - Central Site - New York City, expand Site Settings, and then expand
Site Systems.
2. Right-click NYC-CFG1, and then select New Roles.
4. On the System Role Selection page, check Reporting Services point, and then
click Next.
5. On the Reporting Services Point page, click Next.
Results: After this exercise, you should have installed a Reporting Services point.
L5-22 Lab E: Using SQL Reporting Services

Exercise 2: Managing the Reporting Services Point
Task 1: Configure the Reporting Services point

Computer Management, expand Reporting, and then expand Reporting
Services.
2. Right-click NYC-CFG1, and then click Properties.
3. In the \\NYC-CFG1 Properties dialog box, click Data Source Settings, and
then in the Server Name field, type NYC-CFG1.
4. In the Database field field, type SMS_NYC.
Task 2: Copy the Configuration Manager reports to the Reporting

Services point
2. On the Data Source page, click Next.
3. On the Data Source Authentication page, select Windows integrated
security, and then click Next.
4. On the Select Reports page, ensure all reports are selected, and then click
Next.
7. After the import completes, click Next.
8. On the Wizard Completed page click Close.
9. Right-click NYC-CFG1, and then click Refresh.
Results: After this exercise, you should have configured the Reporting Services
point, and copied the existing reports from the reporting point to the Reporting
Services point.

Exercise 3: Viewing SQL Reporting Services Reports
Task: Using the SQL Reporting Services to view a report

1. Log on to NYC-CFG1 as Contoso\Administrator with the password of
Pa$$w0rd.
2. Open Internet Explorer, type http://NYC-CFG1:80/Reports, and then press
ENTER.
3. Click ConfigMgr_NYC, click Upgrade Assessment - Windows 7, and then
click Windows 7 Upgrade Assessment - Hardware summary for all systems
in a collection.
Systems.
Question: How does this compare to the Report Viewer version of the report?
The formatting is different, there are options for downloading the report, and
there are no links to additional reports.
6. Close Internet Explorer.
Results: After this exercise, you should have viewed a report on the Reporting
Services point.
L5-24 Lab F: Installing and Using Client Status Reporting

Lab F: Installing and Using Client
Status Reporting
Exercise 1: Installing and Configuring Client Status
Reporting
Task 1: Install client status reporting
1. On NYC-CFG1, click Start, and then click Computer.
2. Double-click Allfiles (E:), double-click Labfiles, double-click ConfigMgrR2,
and then double-click Client Status Reporting.
3. Double-click ClientStatusReporting.msi.
4. On the Microsoft Configuration Manager 2007 R2 Client Status Reporting
page, click Next.
then click Next.
6. On the Destination Folder page, click Browse.
7. In the Folder name field, type C:\Microsoft ConfigMgr Client Status\, and
then click OK.
8. On the Destination Folder page, click Next.
Task 2: Configure client status reporting

Reporting.
2. Click Site Settings, and then in the ConfigMgr SQL server and instance field,
type NYC-CFG1.
3. In the ConfigMgr site database field, type SMS_NYC, and then select Use the
local system account on this server.

4. Click Options, and then select the Update Configuration Manager 2007 site
database with inactive client information check box.

5. Click Schedule, and then select the Collect policy request information from
management points check box.
6. Click Apply, and then click OK.
7. Next to Collect policy request information from management points, click Run
Now.
8. Select the Ping inactive clients check box, and then click Apply.
9. Next to Ping inactive clients, click Run Now, and then click OK.
Results: After this exercise, you should have Installed and configured Client Status
Reporting.
L5-26 Lab F: Installing and Using Client Status Reporting

Exercise 2: Installing and Viewing Client Status Reporting
Reports
Task 1: Install client status reporting reports
1. Open the Configuration Manager console, expand Computer Management,
expand Reporting, and then click Reports.
2. Right-click the Reports folder, and then select Import Objects.
3. On the Welcome to the Import Object Wizard page, click Next.
4. On the MOF File Name page, click Browse.
5. Select C:\Microsoft ConfigMgr Client
Status\Reports\ClientStatusReports.mof, and then click Open.
6. On the MOF File Name page, click Next.
7. On the Objects page, click Next.
8. On the Comment page, click Next.
9. On the Complete page, click Finish.
10. Right-click Reports, and then click Refresh.
Task 2: View a client status report

1. Open Internet Explorer.
2. In the Address bar, type http://NYC-SVR2:80/SMSReporting_NYC, and then
press ENTER.
3. In the reports pane, click the Client Status report category, and then click
Client Status Detail for a Specific Computer.

4. Under Report Information, click Values, select NYC-CL1, and then click
Display.
Question: When was the last DDR received?
Answers will vary.
Question: When was the last hardware scan?
Answers will vary.
Results: After this exercise, you should have installed and viewed a client reporting
status report.

1. On the host computer, start Hyper-V™ Manager.
click Revert.
DC1-D , and then in the Actions pane, click Connect.
Important: Start the NYC-DC1 virtual machine first, and ensure that it is fully started
6. Wait for NYC-DC1 to start, and then start 6451B-NYC-CFG1-D . Connect to

Module 6: Distributing Software Using Microsoft® System Center Configuration Manager 2007 L6-1

Module 6: Distributing Software Using

Manager 2007
Lab A: Preparing for Software
Distribution
Exercise 1: Configuring the Software Distribution
Component
Task: Configure the Software Distribution component
Console. Click Yes at the User Account Control prompt.
3. In the details pane, right-click Software Distribution, and then click
Properties.
4. In the Software Distribution Properties dialog box, on the General tab, in
Location of stored packages box, type E:\.
5. Select the Distribution Point tab.
6. Select the Send package from the nearest site in the hierarchy check box,
and then click OK.
Results: After this exercise, you should have configured the software distribution
component.
L6-2 Lab A: Preparing for Software Distribution

Exercise 2: Configuring the Advertised Programs Client
Agent
Task: Configure the Advertised Programs Client Agent
Client Agents.
2. In the details pane, right-click Advertised Programs Client Agent, and then
click Properties.
3. Select Enable software distribution to clients.
4. Click the Notification tab, review options, and then click OK.
Results: After this exercise, you should have enabled the Advertised Programs Client
Agent.

Exercise 3: Configuring a Distribution Point
Task: Configure a distribution point

NYC - Central Site - New York City, expand Site Settings, expand Site
Systems, and then click \\NYC-CFG1.
2. In the details pane, right-click ConfigMgr distribution point, and then click
Properties.
3. In the ConfigMgr distribution point Properties dialog box, select Allow
clients to transfer content from this distribution point using BITS, HTTP,
and HTTPS (required for device clients and Internet-based clients).
4. Verify that the Allow intranet-only client connections drop-down option is
selected, and then click OK.
Results: After this exercise, you should have configured a BITS-enabled distribution
point.
L6-4 Lab B: Creating and Configuring a Collection

Lab B: Creating and Configuring a
Collection
Exercise: Creating a Collection for Software Distribution
Task 1: Create and populate a collection
Console.
CFG1, Central Site - New York City), expand Computer Management, and
then click Collections.
4. In the New Collection Wizard, in the Name box, type Deploy Office Viewers,
5. On the Membership Rules page, click the direct membership rule (computer
icon) button.
6. In the Create Direct Membership Rule Wizard, click Next.
7. On the Search for Resources page, configure the following information, and
then click Next:
• Resource class: System Resource.
• Attribute name: Name.
• Value: %.
8. On the Collection Limiting page, click Browse.

9. In the Browse Collection dialog box, click All Windows Workstation or
Professional Systems, click OK, and then click Next.
10. On the Select Resources page, select NYC-CL1, and then click Next.
11. Click Finish to complete the Create Direct Membership Rule Wizard.
12. In the New Collection Wizard, on the Membership Rules page, click Next.
13. On the Advertisements page, click Next.

14. On the Security page, click Next, and then click Close.
15. In the Configuration Manager console, under Computer Management,

16. In the details pane, right-click All collections, and then click Run.
17. If the Report Options dialog box appears, select Open reports in a new
18. In the ConfigMgr Report – Windows Internet Explorer window, click the
arrow next to the Deploy Office Viewers collection.
Question: Which computers are listed as collection members?
NYC-CL1 is the only member of the collection.
19. Close the ConfigMgr Report – Windows Internet Explorer window.
Task 2: Add a maintenance window for the collection

2. Right-click Deploy Office Viewers, and then click Modify Collection Settings.
3. In the Deploy Office Viewers Settings dialog box, on the Maintenance
Windows tab, click the New (star) icon.
4. In the <new> Schedule dialog box, in the Name box, type Daily 1am-4am.
5. Under Recurrence pattern, select Daily.
6. Click OK to close the <new> Schedule dialog box.
7. Click OK to close the Deploy Office Viewers Settings dialog box.
8. In the Configuration Manager console, select Collections.
L6-6 Lab B: Creating and Configuring a Collection

9. In the Actions pane, click Refresh. Wait for the list of collections in the results
pane to refresh.
10. In the details pane, select Deploy Office Viewers, and scroll right until you can
see the Maintenance Windows column. Verify that Yes appears in the
Maintenance Windows column for the Deploy Office Viewers collection.
Task 3: Add a collection-specific restart countdown

2. Right-click Deploy Office Viewers, and then click Modify Collection Settings.
3. In the Deploy Office Viewers Settings dialog box, click the Advanced tab.
4. Select Enable collection specific restart settings.
5. Change the Restart countdown (minutes) to setting to 3, and then click OK.
Results: After this exercise, you should have configured a collection-specific restart
countdown for the Deploy Office Viewers collection.

Lab C: Creating a Package and
Configuring Programs
Exercise: Creating a Package and Configuring Programs
Task 1: Create the package
Console.
then expand Software Distribution.
3. Right-click Packages, point to New, and then click Package.
4. In the New Package Wizard, on the General page, configure the following
information, and then click Next:
• Name: Office Viewers.
• Version: 2007.
• Manufacturer: Microsoft.
• Language: English.
• Comment: Package by your name on today’s date.
5. On the Data Source page, select This package contains source files, and then
click Set.
6. In the Source directory box, type \\NYC-CFG1\Labfiles\Software\Office
Viewers, click OK, and then click Next.
7. On the Data Access page, configure the following information, and then click
Finish:
• Verify that Access the distribution folder through common ConfigMgr
package share is selected.
• Select Disconnect users from distribution points.
9. Click Close to close the New Package Wizard.
L6-8 Lab C: Creating a Package and Configuring Programs

10. In the Configuration Manager console, select Packages. Right-click Packages,
and then click Refresh.

11. Verify that the new package named Microsoft Office Viewers 2007 English
exists.
Task 2: Configure the first program

CFG1, Central Site - New York City), expand Computer Management,
expand Software Distribution, expand Packages, and then expand Microsoft
Office Viewers 2007 English.
2. Right-click Programs, point to New, and then click Program.
3. In the New Program Wizard, on the General page, configure the following,
• Name: PowerPoint Viewer
• Command line:
"PPTViewer\PowerPointViewer.exe" /q.
Note: The command line must be typed exactly as shown, including the quotes.

4. On the Requirements page, configure the following, and then click Next:
• Estimated disk space: 563
• Estimated disk space box: MB.
• Maximum allowed run time: 5

5. On the Environment page, configure the following, and then click Next:

• Run model: Run with administrative rights.
• Run mode: clear the check box next to Allow users to interact with this
program.
6. On the Advanced page, click Next.
7. On the Window Installer page, click Next.
8. On the MOM Maintenance Mode page, click Next.
10. Click Close to close the New Program Wizard.
11. In the Configuration Manager console, expand Packages, expand Microsoft
Office Viewers 2007 English, and then select Programs.
12. In the details pane, verify that the new package named PowerPoint Viewer
exists.
Task 3: Configure the second program

2. Right-click Programs, point to New, and then click Program.
L6-10 Lab C: Creating a Package and Configuring Programs

3. In the New Program Wizard, on the General page, configure the following,

• Name: Visio Viewer
• Command line:
"VisioViewer\visioviewer.exe" /q
Note: The command line must be typed exactly as shown, including the quotes.

4. On the Requirements page, configure the following, and then click Next:
• Estimated disk space: 190
• Estimated disk space box: MB.
• Maximum allowed run time: 5
5. On the Environment page, configure the following, and then click Next:
• Run mode: Run with administrative rights.
• Run mode: clear the check box next to Allow users to interact with this
program.
6. On the Advanced page, configure the following, and then click Next:
a. Select Run another program first.
b. Click Browse, select Microsoft Office Viewers 2007 English, and then
click OK.
c. In the Program drop-down list, verify that PowerPoint Viewer is selected.
7. On the Window Installer page, click Next.
8. On the MOM Maintenance Mode, click Next.
10. Click Close to close the New Program Wizard.

11. In the Configuration Manager console, expand Packages, expand Microsoft
Office Viewers 2007 English, and then select Programs.

12. In the details pane, verify that a new package named Visio Viewer exists.
Results: After this exercise, you should have verified creation of both the Office
Viewers package, and the two programs it contains.
L6-12 Lab D: Deploying Applications by Using Software Distribution

Lab D: Deploying Applications by
Using Software Distribution

Exercise 1: Distributing a Package to a Distribution Point
Task: Deploy a package to a distribution point
Console.
3. Right-click Distribution Points, and then click Manage Distribution Points.
4. In the Manage Distribution Points Wizard, on the Welcome page, click Next.
5. On the Select Destination Distribution Point page, verify that Copy the
package to new distribution points is selected, and then click Next.
6. On the Package page, select NYC-CFG1, and then click Next.
7. On the Completing the Manage Distribution Points Wizard page, click Next.
8. Click Close to close the Manage Distribution Points Wizard.
9. In the Configuration Manager console, navigate to Computer Management,
10. In the details pane, right-click Distribution status of a specific package, and
then click Run.
12. Click Values, click the Package Id that corresponds with Office Viewers, and
then click Display.
13. Review the report. If Install Status for NYC-CFG1 does not display as
Package Installation complete, then periodically refresh the report until it
does, by clicking the Refresh button on the tool bar.

14. Once the report indicates that the package has been installed on NYC-CFG1,
close all open Windows® Internet Explorer® windows.
Results: After this exercise, you should have verified that the Office Viewers
package has been distributed to the NYC-CFG1 distribution point.

Exercise 2: Advertising a Program to a Collection
Task: Advertise a program to a collection

expand Software Distribution.
2. Right-click Advertisements, point to New, and then click Advertisement.
3. In the New Advertisement Wizard, on the General page, in the Name box,
type Deploy Office 2007 Viewers.
4. To the right of the Package box, click Browse.
5. Select Microsoft Office Viewers 2007 English, and then click OK.
6. In the Program list, select Visio Viewer.
7. To the right of the Collection box, click Browse.
8. Select Deploy Office Viewers, click OK, and then click Next.
9. On the Schedule page, click the New (star) icon.
10. Select Assign immediately after this event, verify that As soon as possible is
selected, and then click OK. Click Next.
11. On the Distribution Points page, click Next.
12. On the Interaction page, click Next.
13. On the Security page, click Finish.
15. Click Close to close the New Advertisement Wizard.
17. Right-click All advertisements, and then click Run.
19. Click the arrow next to Deploy Office 2007 Viewers. Review the report
window, and then close the ConfigMgr Report – Windows Internet Explorer
window.

and then select Software Distribution.

21. In the Actions pane, click Run Home Page Summarization.
22. In the Actions pane, click Refresh. Review the status of the Deploy Office
2007 Viewers.
Results: After this exercise, you should have verified that the Deploy Office 2007
Viewers advertisement has been created.

Exercise 3: Running an Advertised Program

4. In Configuration Manager Properties, click the Actions tab.
Cycle box, click OK. Click OK again, to close Configuration Manager
Properties.

double-click execmgr.log. Maximize the SMS Trace window.
2. Press CTRL+HOME to move to the top of the log file.
Note: You may need to wait five minutes or more for the information in the
following steps to be logged within the execmgr.log file.
4. In the Find dialog box, in the Find what box, type mandatory execution, and
then click Find. Click Cancel to close the Find dialog box. Review the log
entry. Notice that the next log entry states Creating mandatory request for
advert Advertisement ID....
5. Click Tools, and then click Find. In the Find dialog box, in the Find what
box, type WaitingDependency to WaitingContent, and then click Find. Click
Cancel. Review the log entry.
box, type Content is available for program Visio Viewer, and then click
Find. Click Cancel. Review the log entry. Notice that the next log entry states
The package cannot run because of a service Window restriction. This
indicates that the program is waiting for the next maintenance window.

box, type WaitingContent to WaitingServiceWindow. and then click Find.

Click Cancel. Review the log entry.
8. Close the SMS Trace window.
9. Close the Windows Explorer window.
Task 3: Modify an advertisement

then expand Software Distribution. Click Advertisements.
2. Right-click Deploy Office 2007 Viewers, and then select Properties.
3. Click the Schedule tab.
4. Select Ignore maintenance windows when running program, and then click
OK.
Task 4: Install a software package

4. In Configuration Manager Properties, click the Actions tab.
Cycle box, click OK. Click OK again to close Configuration Manager
Properties.
6. Wait until the New Program Available notice appears in the notification area,
and then click the notice.
Note: Several minutes may pass before the notice appears.


7. In the Program Countdown Status dialog box, click Run.
Note: The program will run silently. Wait at least two minutes before proceeding to
the next step.

9. In Control Panel, click Programs.
10. In Programs, click Programs and Features.
11. In Programs and Features, verify that both Microsoft Office PowerPoint
Viewer 2007 (English) and Microsoft Office Visio Viewer 2007 appear in
the list of installed programs. Both programs were installed silently, although
the countdown appeared before Microsoft® Office Visio® Viewer was installed.
Results: After this exercise, you should have confirmed successful distribution of
both viewer applications to the test computer.

Exercise 4: Reviewing Results
Task 1: Review results

then select Software Distribution.
2. Right-click Software Distribution, and then click Run Homepage
Summarization.
Note: You may need to refresh several times before updated information displays.
4. Verify that Deploy Office 2007 Viewers is highlighted. Scroll right in the box
in which the advertisements display. Notice that 100 percent of the targeted
clients successfully ran the advertised program.
Question: What colors display for Deploy Office 2007 Viewers under Status
for Selected Advertisement?
Green should be the only color displayed, indicating that 100 percent of the
targeted systems successfully ran the program.
5. Click the Deploy Office 2007 Viewers link. If the Report Options dialog box
appears, select Open reports in a new window, and then click OK.
6. Review the Status of a specific advertisement report for Deploy Office 2007
Viewers, and notice that 100 percent of resources have accepted the
advertisement and have processed the advertisement successfully. Close the
ConfigMgr Report – Windows Internet Explorer window.
7. In the Configuration Manager console, navigate to and expand System Status,
and then click Advertisement Status.

9. In the details pane, review the status information for the Deploy Office 2007
Viewers advertisement. Notice that, although the Received column displays a

value of 1, the Programs Started and Program Success columns both display a
value of 2. (The reason for this result is that you advertised the Office Visio
Viewer program, and that program required that the Office PowerPoint®
Viewer program run first.)
Question: What Program Started value displays for Deploy Office 2007
Viewers? What Program Success value displays? How do these values compare
to the Received value displayed? If a discrepancy exists, why?
Although only one computer received the advertisement, two program starts
and two program successes should display. The reason for this is that the
advertised program required another program to run first. Both starts and
successes are recorded.
10. Double-click Deploy Office 2007 Viewers.

11. In the results pane, right-click NYC – Central Site - New York City, point to
Show Messages, and then click All.
12. Find the Status Message with a Message ID of 30006, double-click the
message, and then review Status Message details.
Question: Who created the package?
The package was created by CONTOSO\Ed.
13. Click OK to close the Status Message Details window.

14. Find the Status Message with a Message ID of 3900, double-click the message,
and then review Status Message details. Notice the Advertisement ID is listed.
message, and then review Status Message details. Notice that the client passed
platform requirements.
message, and then review Status Message details. Notice the program has not
started.

message, and then review Status Message details. Notice the program has
started.
Question: What are the Command lines?
The older command line is C:\Windows\system32\CCM\Cache\
NYC00003.1.System\PPTViewer\PowerPointViewer.exe" /q. The more recent
command line is C:\Windows\system32\CCM\Cache\NYC00003.1.System\
VisioViewer\visioviewer.exe" /q
Question: What is the Working directory?
The working directory for both programs is
C:\Windows\system32\CCM\Cache\NYC00003.1.System\

message, and then review Status Message details. Notice the program
completed successfully.
Results: After this exercise, you should have reviewed the results of software
distribution.
Task 2: Create an appropriate target collection and deploy Office Excel

Viewer (challenge exercise—time permitting)
• Create an appropriate target collection, and deploy Office Excel Viewer. Use
the following information:
• Source location: \\NYC-CFG1\Labfiles\Software\ExcelViewer
• Package creation method: Package from Definition
• Program to deploy: Per user unattended

click Revert.

virtual machine.
Module 7: Deploying Virtual Applications Using Microsoft® System Center Configuration Manager 2007 L7-1

Module 7: Deploying Virtual Applications Using

Manager 2007
Lab: Deploying Virtual Applications
to Configuration Manager Clients
Exercise 1: Preparing the Infrastructure for Application
Virtualization
Task 1: Configure distribution points to support virtual applications
Console.
Management, expand NYC – Central Site - New York City, expand Site
Settings, expand Site Systems, and then click NYC-CFG1.
3. In the details pane, right-click ConfigMgr distribution point, and then click
Properties.
4. In the ConfigMgr distribution point Properties dialog box, on the General
tab, select the Allow clients to transfer content from this distribution point
using BITS, HTTP, and HTTPS check box.
streaming check box.
6. Click OK.
Task 2: Configure the Advertised Programs Client Agent

Management, expand NYC – Central Site - New York City, expand Site
Settings, and then click Client Agents.
2. In the details pane, right-click Advertised Programs Client Agent, and then
click Properties.
L7-2 Lab: Deploying Virtual Applications to Configuration Manager Clients

3. In the Advertised Programs Client Agent Properties dialog box, on the
General tab, ensure that Enable software distribution to clients and Allow
user targeted advertisement requests check box is selected.
4. On the General tab, select the Allow virtual application package
advertisement check box.
5. Click OK.
Task 3: Deploy the App-V client

1. In the Configuration Manager console, expand Site Database, expand
Computer Management, expand Software Distribution, and then click
Packages.
2. Right-click Packages, point to New, and then click Package from Definition
to launch the Create Package from Definition Wizard. Click Next.
3. On the Package Definition page, click Browse.
4. Browse to C:\Microsoft Configuration Manager\Tools\VirtualApp, click
AppVirtMgmtClient.sms, and then click Open.
5. On the Package Definition page, click Next.
6. On the Source Files page, click Always obtain files from a source directory,
7. On the Source Directory page, click Local drive on site server, and then in
the Source directory field, type E:\Labfiles\VApps\Client. Click Next.
8. On the Summary page, click Finish.
9. Under Packages, expand Microsoft Application Virtualization Desktop
Client 4.5 English, and then click Distribution Points.
10. Right-click Distribution Points, and then click New Distribution Points.
11. In the New Distribution Points Wizard, click Next.
12. On the Copy Package page, select NYC-CFG1, and then click Next.
14. Under Microsoft Application Virtualization Desktop Client 4.5 English,
expand Package Status, and then click the Package Status folder. Keep
refreshing the folder until the details pane shows the package status as
installed.


Advertisements.
17. On the General page, provide the following, and then click Next:
• Name: App-V Client
• Package: Microsoft Application Virtualization Desktop Client 4.5
English
18. On the Schedule page, click New. In the Assignment Schedule dialog box,
click the Assign immediately after this event option, click OK, and then click
Next.
19. On the Distribution Points page, click Next.
20. On the Interaction, Security and Summary pages, click Next.
22. Switch to the NYC-CL1 virtual machine.
24. In the Control Panel, click System and Security, and then click
Configuration Manager.
25. In the Configuration Manager Properties dialog box, click the Actions tab.
26. Select Machine Policy Retrieval & Evaluation Cycle, and then click Initiate
Action. Click OK at the prompt, click OK to close the Configuration Manager
Properties box, and then close Control Panel.
Note: It may take a few minutes for the advertisement to appear. If it does not
appear, initiate the Machine Policy Retrieval & Evaluation Cycle again. You can
monitor the advertisement by selecting Advertisement Status in the Configuration
Manager console.

27. When the advertisement arrives, a message will appear in the notification area
of the client computer. Click the notification, and then click Run. (If you do
not manually run the program, it will automatically run in 5 minutes). The
computer restarts once the program installation has finished.
28. After NYC-CL1 restarts, log on as Contoso\Administrator using the password
Pa$$w0rd.
Results: After this exercise, you should have configured the infrastructure
requirements to support App-V deployment.

Exercise 2: Deploying a Virtual Application Package
Task: Import a virtual application package

Packages.
2. Right-click Packages, point to New, and then click Virtual Application
Package.
3. In the New Virtual Application Package Wizard, on the Package Source page,
click Browse, navigate to E:\labfiles\VApps\Word_Viewer, click
Word_Viewer_manifest.xml, and then click Open.
4. On the Package Source page, click Next.
• Name: Word_Viewer
• Version: 1
• Remove this package from clients when it is no longer advertised:
Enabled
6. On the Data Source page, under Specify the ConfigMgr data source for this
package, enter \\NYC-CFG1\Labfiles\Source, and then click Next.
10. Expand the Microsoft Word_Viewer 1 package, and then click Distribution
Points.
11. Right-click Distribution Points, and then click New Distribution Points.
12. In the New Distribution Points Wizard, click Next.
13. On the Copy Package page, select NYC-CFG1, and then click Next.
15. Under the Microsoft Word_Viewer 1 package, expand Package Status, and
then click the Package Status folder. Keep refreshing the folder until the
details pane shows the package status as installed.


Advertisements.
• Name: Word Viewer
• Package: Microsoft Word_Viewer 1
19. On the Schedule page, click New. In the Assignment Schedule dialog box,
click Assign immediately after this event, click OK, and then click Next.
20. On the Distribution Points page, click Stream virtual applications from
distribution point, and then click Next.
21. On the Interaction page click Next.
22. On the Security pages, click Next.
Results: After this exercise, you should have deployed a virtual application to

Exercise 3: Launching and Monitoring a Virtual Application
Program
Task 1: Launch a virtual application
1. On NYC-CL1, click Start, click Control Panel, and then click System and
Security.
2. Double-click Configuration Manager.
3. In the Configuration Manager Properties dialog box, click Actions.
4. Select Machine Policy Retrieval & Evaluation Cycle, click Initiate Action,
click OK at the prompt, and then click OK to close the Configuration
Manager Properties dialog box
5. Close the Control Panel. It may take a few minutes for the advertisement to
run.
6. When the advertisement appears in the notification area, click the notification,
and then click Run.
7. On the desktop, double-click Microsoft Office Word Viewer 2003.
Task 2: Review Virtual Applications reports

Configuration Manager, expand Site Database, expand Computer
Management, and then expand Reporting.
2. In the tree pane, click Reports.
3. In the results pane, next to Look for, type virtual, and then click Find Now.
All reports related to virtual applications display.
4. Right-click the All virtual application packages in the streaming store of a
distribution point report, and then click Run.
5. On the Report Options dialog box, select the Open reports in a new window
check box, and then click OK.

6. In the Report Viewer, click the Values button, click NYC-CFG1, and then click
Display. Close the report when finished.

7. Run several other reports and view the results. For some results, you may have
to run a Hardware Inventory Cycle and Machine Policy Retrieval & Evaluation
Cycle on NYC-CL1.
Results: After this exercise, you should have launched a virtual application on a
client and viewed related reports.

click Revert.

7. Wait for NYC-CFG1 to start, and then start 6451B-NYC-SVR2-D. Connect to

6451B ENU Beta Trainer Handbook Volume1

Încărcat de

Informații document

Descriere originală:

Drepturi de autor

Formate disponibile

Partajați acest document

Partajați sau inserați document

Opțiuni de partajare

Vi se pare util acest document?

Este necorespunzător acest conținut?

Drepturi de autor:

Formate disponibile

6451B ENU Beta Trainer Handbook Volume1

Încărcat de

Drepturi de autor:

Formate disponibile

OFFICIAL MICROSOFT LEARNING PRODUCT

Be sure to access the extended learning content on your

All other trademarks are property of their respective owners.

Technical Reviewer: Steve Bobosky

Product Number: 6451B

■ Microsoft Certiﬁed Trainers and Instructors—Your instructor is a technical and

■ Certification Exam Benefits—After training, consider taking a Microsoft Certification

■ Customer Satisfaction Guarantee—Our Certiﬁed Partners for Learning Solutions offer

Conan Kezema – Content Developer

Bob Lawler – Content Developer

David Susemiehl – Content Developer

Steve Bobosky – Technical Reviewer

Module 2: Planning and Deploying a Single-Site Architecture

Module 3: Planning for and Completing Client Deployment

Module 4: Inventory Collection, Software Metering, and Asset Intelligence

Module 5: Querying and Reporting Data

Module 6: Distributing Software Using Microsoft® System Center

Module 7: Deploying Virtual Applications Using Microsoft® System Center

Module 8: Deploying and Managing Software Updates

Module 9: Deploying Operating Systems Using Microsoft® System Center

Module 10: Working with Desired Configuration Management

Module 11: Configuring Wake On LAN, Out of Band Management, and

Module 12: Planning and Configuring a Multiple Site Hierarchy

Module 13: Maintaining and Monitoring Microsoft® System Center

Module 14: Microsoft® System Center Configuration Manager 2007 Native

Lab Answer Keys

Module 13 Lab B: Using Windows Performance Monitor to Monitor

MCT USE ONLY. STUDENT USE PROHIBITED

About This Course

MCT USE ONLY. STUDENT USE PROHIBITED

• Deployment, configuration, and troubleshooting for personal computers

MCT USE ONLY. STUDENT USE PROHIBITED

This section provides an outline of the course:

MCT USE ONLY. STUDENT USE PROHIBITED

software updates feature integrates with Configuration Manager 2007. This

MCT USE ONLY. STUDENT USE PROHIBITED

The following materials are included with your kit:

To provide additional comments or feedback on the course, send e-mail to

MCT USE ONLY. STUDENT USE PROHIBITED

Virtual Machine Configuration

2. In the Revert dialog box, click Yes.

Virtual machine Role

6451B-NYC-CL1 Windows® 7 client in the Contoso.com domain.

6451B-NYC-CL2 Windows Vista® client in the Contoso.com domain.

6451B-NYC-SVR2 Member server in the Contoso.com domain

6451B-ATL-CL1 Windows 7 client in the Contoso.com domain.

6451B-NYC-CAP Pre-configured Windows 7 client in a workgroup.

6451B-NYC-REF “Bare-metal” system.

MCT USE ONLY. STUDENT USE PROHIBITED

Course Hardware Level

• Intel Virtualization Technology (Intel VT) or AMD Virtualization (AMD-V)

In addition, the instructor computer must be connected to a projection display

MCT USE ONLY. STUDENT USE PROHIBITED

MCT USE ONLY. STUDENT USE PROHIBITED

Microsoft System Center Configuration Manager 2007 provides powerful desktop

MCT USE ONLY. STUDENT USE PROHIBITED

Introduction to Configuration Manager 2007

Configuration Manager 2007 drives information technology (IT) productivity and

MCT USE ONLY. STUDENT USE PROHIBITED

MCT USE ONLY. STUDENT USE PROHIBITED

• Operating system and application deployment

Configuration Manager also includes mobile device management, which extends

MCT USE ONLY. STUDENT USE PROHIBITED