- Sample Organization
- Configuring Installation Prerequisites
- Implementing the Central Administration Site
- Deploying the Primary Sites
- Deploying the Secondary Sites
- Configuring the Hierarchy
- Configuring Sites
- Configuring Client Settings
- Implementing Internet-Based Client Management
- Summary
- Best Practices
This chapter is from the book
This chapter is from the book
This chapter is from the book
Configuring Client Settings
Client settings control 18 different areas of client configuration, ranging from BITS configuration through User and Device Affinity. In the past, these settings were monolithic and applied to the entire site. There was no granularity within the site nor any way to transfer settings across the hierarchy. In Configuration Manager 2012, the client settings are configured at a hierarchy level, meaning that the settings apply to the site and all child sites. In addition, custom settings can be created and deployed to collections. These custom settings and flexible targeting mechanism allow settings to be adjusted in a very fine-grained manner.
In the next sections, each of the settings are covered along with recommended settings. To review and edit any of the settings, select the Administration space.
Background Intelligent Transfer
The Background Intelligent Transfer settings allow administrators to control the download behavior of clients via the BITS protocol. By default, these settings are disabled, but if enabled, these settings allow the client to be throttled within a specified window with maximum transfer rates.
For most organizations, it is recommended that this be left disabled.
Client Policy
The client policy settings control how often the client checks in for policy updates, by default every 60 minutes. This essentially establishes a heartbeat for the policy refresh. If new policies are deployed, this polling interval limits how quickly that policy can be deployed.
This was a classic example where different settings were needed for different types of devices. Many organizations were comfortable with a one-hour polling interval for workstations, but wanted a much shorter polling interval for servers along the lines of 15 minutes. This was difficult to do in previous versions of SCCM, but in SCCM 2012 is easy to do with the custom client settings targeted at servers.
In addition, user policy polling can be disabled or enabled. This controls whether users will see user policy. Machine policies are always applied.
Is recommended that the default polling interval of 60 minutes be left in place unless there are specific reasons to adjust it.
Compliance Settings
The Compliance Settings section controls whether compliance is enabled or disabled. This setting is enabled by default. The schedule for compliance evaluation is also set in this section, with the default of every seven days.
It is recommended that compliance evaluation be left enabled and that schedule be adjusted to run every one day.
Computer Agent
The Computer Agent section contains a smorgasbord of settings related to notifications, the Application Catalog, and installation permissions. A few these have very useful applications.
The Install Permissions setting allows administrators to control which users can initiate installation of software and software updates in task sequences. The options are as follows:
- All Users
- Only Administrators
- Only Administrators and Primary Users
- No Users
This setting, in combination with custom settings targeted at collections, allows administrators to control who is allowed to manually install software advertised by SCCM.
The PowerShell Execution Policy allows administrators to control whether unsigned PowerShell scripts are allowed or not. The default Restricted setting prevents unsigned scripts from executing, whereas the Bypass setting allows unsigned scripts to execute.
The Deployment Deadline options control how often users will see pop-ups of impending deployment deadlines over 24 hours out, less than 24 hours out, and less than an hour away. This set of options combined with custom settings targeted at collections allows administrators flexibility in notifying users.
Computer Restart
The Computer Restart section controls the notifications that users receive before pending restart. The temporary notification, by default 90 minutes, is the advance warning the user gets before restart. The countdown notification, by default 15 minutes, is the countdown window that the user gets before restart.
Endpoint Protection
The Endpoint Protection section covers the settings related to the Microsoft anti-malware features of Configuration Manager 2012. It is disabled by default, but is highly recommended that it be enabled.
Most of the settings in this section control agent installation behavior, such as to install the agent (default is True), remove previously installed agents (default is True), and suppress restarts after installation (default is True).
Interestingly, the default remove previously installed agents will remove both Microsoft and non-Microsoft antivirus agents. The list of antivirus agents that will be removed includes the following:
- All current Microsoft anti-malware products except for Windows InTune and Microsoft Security Essentials
- Symantec AntiVirus Corporate Edition version 10
- Symantec Endpoint Protection version 11
- Symantec Endpoint Protection Small Business Edition version 12
- Mcafee VirusScan Enterprise version 8
- Trend Micro OfficeScan
Given the ease with which SCCM 2012 endpoint protection deploys, it may come as a surprise when it uninstalls other antivirus agents. To prevent this, it is recommended to use custom client settings with this option disabled.
The one setting that needs to be changed, after enabling the agent, is the Disable Alternate Sources option. This is enabled by default, which prevents the Endpoint Protection agent from using other sources such as Microsoft Windows Update to get definition updates. This option should be set to False, to allow the agent to get definition updates from Windows Update.
Hardware Inventory
The Hardware Inventory section, enabled by default, primarily controls the interval on which hardware inventory is collected. The default of seven days is usually too long and it is recommended to change the schedule to once per day.
In addition, in this section additional hardware inventory classes can be configured to be collected. This includes Registry values for other important information, which previously required modifying text files directly. Embedding a graphical user interface (GUI) to do this in Configuration Manager 2012 is a very welcome enhancement.
Remote Tools
The Remote Tools section controls the remote tools if enabled on agents and the behavior of the remote tools if it is enabled. Remote tools are by default disabled.
A new feature of the remote tools settings is the ability to set the Windows Firewall as part of enabling the tool. As shown in Figure 3.17, the remote control feature is enabled in the check box to configure the remote control port and program exception for just the domain firewall. This ensures that while computers are connected to the domain, remote control will be allowed through the firewall. When not connected to the domain, those ports will be closed and not present a security risk.
)
Figure 3.17 Enabling remote control with domain firewall exception.
Another welcome enhancement to Configuration Manager 2012 is the Allow Remote Control of an Unattended Computer option. This feature was completely absent from the previous version of SCCM, meaning that the user always had to be present when using remote tools. With SCCM 2012, administrators can now press Ctrl+Alt+Delete on a remote agent. However, this is explicitly allowed (the default) or disallowed in the remote tools client settings.
Software Deployment
In the Software Deployment section, the only setting is for the deployment reevaluation schedule. This defaults to seven days and can be left at the default.
Software Inventory
The Software Inventory section of client settings controls how software inventory is collected. It is enabled by default with the schedule of every seven days.
It is recommended that the schedule be changed to every one days, to ensure that software reporting is as current as possible.
Unfortunately, in SCCM 2012 the inventory file types is blank. This means that no files will be inventoried by default. In previous versions of SCCM, all EXE files were inventoried out of the box. It is recommended that organizations inventory at a minimum all EXE (*.exe), all DLL (*.dll), and all PST (*.pst) files. Figure 3.18 shows the recommended file inventory types.
)
Figure 3.18 The recommended file inventory types.
Software Metering
In the Software Metering section, the only settings are to enable software metering and for the deployment reevaluation schedule. This defaults to seven days and should be adjusted to every one day, if the feature is enabled.
Software Updates
The Software Update section of client settings controls updates behavior. It is enabled by default, but there are several schedule options within the section that should be adjusted.
The software update scan schedule defaults to every seven days, but should be adjusted to every one days. This allows much more timely information to be collected, such as what updates have been applied. This is reflected in reports, which will be current as of the previous day.
The scheduled deployment reevaluation schedule defaults to every seven days and should be left as is. The schedule determines how often the agent checks to see if it is still in compliance with previous deployments, which might result in updates being deployed.
The next setting controls what the agent does when a particular software update deployment deadline is reached, should the agent also opportunistically install any other pending software update deployments. And it allows how far in advance to look for pending software update deployments. Because update deployments frequently result in reboots, it makes sense to deploy future updates at the same time.
The setting defaults to False, so it is recommended to change that to True and the next setting to seven days. This ensures that any updates with mandatory deadlines scheduled up to a week in advance will be deployed at the same time.
State Messaging
The State Messaging section of client settings controls a little-known, but key aspect of the Configuration Manager agent. As the agent is executing policy, deployments, and tasks, it generates status messages and delivers them to the server to be stored in the database.
The State Messaging section controls the frequency with which those messages get uploaded. The default is every 15 minutes, but can be adjusted depending on conditions.
User and Device Affinity
The User and Device Affinity section of client settings controls a much requested feature that Configuration Manager 2012 delivers. Device affinity allows devices such as desktops and laptops to be associated with their users. In SCCM 2012, this can be done automatically.
In the User and Device Affinity section, administrators can specify how much time a user needs to spend with the device for it to be automatically associated with the user account.
There are two threshold settings that create the automatic association. The first is the User Device Affinity Usage Threshold (min) setting, which sets how much time a user needs to spend using the machine for it to be considered associated with that user. The second is the User Device Affinity Usage Threshold (days) setting, which sets the span of time over which usage is measured.
To enable User und Device Affinity, the Automatically Configure User Device Affinity from Usage Data setting needs to be set to True.
In addition, the Allow Users to Define Their Primary Devices setting allows users to actually specify their primary device (that is, set the affinity). It is recommended that this be set to True to give users control.
Figure 3.19 shows the recommended User and Device Affinity settings.
)
Figure 3.19 The User and Device Affinity settings.
Configuring the Client Installation Settings
In Configuration Manager 2012, the client push installation settings are associated with each primary or secondary site in the hierarchy. The Client Installation Settings menu for each site holds the two installation options: Client Push Installation and Software Update-Based Client Installation. The Client Push Installation option is typically used to perform client deployments. The settings within the Client Push Installation configure the command-line options used when the client is pushed, the account used to access the remote computer, and if one of the Configuration Manager discovery methods triggers an installation of the client on remote systems.
A client can be pushed manually from the Configuration Manager console or executed automatically when a Discovery Method is executed. It is important to disable the Automatic Push Installation option until the client is tested and the correct options are set.
To configure the Client Installation account, complete the following steps:
- Open the console, browse to Administration, expand Site Configuration, expand Sites, and select SFO Site.
- Right-click on SFO Site and select Client Installation Settings, Client Push Installation.
- Check the Enable Automatic Site Wide Client Push Installation check box.
- Select the Accounts tab, click “*”, and then click New Account.
- Add an account with local administrative rights to the systems.
- Select the Installation Properties tab. The current installation property is SMSSITECODE=SFO.
- Add FSP=CM2 to the Installation properties. This specifies the fallback status point for clients. Separate the properties with a space.
- Apply the changes.
This account will be used to push the Configuration Manager agent to client systems. The SMSSITECODE=SFO command is configured by default to set the agent’s assigned site. If the agent is being pushed from a primary site, but will be managed by a different primary site or secondary site, this value should be changed to SMSSITECODE=AUTO, allowing the client to choose the correct site code based off of the configured boundaries.
Repeat the previous steps for each primary site and secondary site that will be pushing out agents.