CCMEXEC.COM – System Center blog

CCMEXEC.COM – by Jörgen Nilsson

Browsing Posts tagged ConfigMgr

In Configuration Manager 1702 there is a new feature /site system role(pre-release) called Data Warehouse. This is a great addition as I cannot count the time I have setup and configured another database and then on a schedule moved data to that Database instead to be used both for historical data and by other systems that shouldn’t query our precious Configuration Manager database during production hours.

Many times, performance issues in Configuration Manager has been caused by developers querying the Configuration Manager database with really bad queries causing the overall performance being degraded.

In Configuration Manager 1702 the Data Warehouse feature holds all the answers to those issues. With the Data Warehouse Service Point role we can transfer SQL data to a another SQL database. That server doesn’t need to have the same high-spec as the Configuration Manager Database.

When we configure the Data Warehouse Service Point role we set a Schedule on when the data should be transferred to the Data Ware house and how often. Adding the Data Warehouse service connection point.  At is it still a pre-release feature you need to opt-in to using pre-release features, that is done in the Hierarchy Settings.

Pre-release features

To add the Data Warehouse service point we do add the Data Warehouse Service Point role to the server that should host the role.

DataWareHouse Service Point

We add the SQL Database Server Name, database name and Port to be used.

DataWareHouse Service Point 2

We can then configure how often it should synchronize the data.

DataWareHouse Service Point 3

We also get a couple of new reports that will show historical data from the Data Ware house database which are cool and useful as well if we have compliance rules applied to our business. No more exporting data at the end of each year to .CSV files for historical compliance reporting and Endpoint protection and software update compliance.

DataWareHouse reports

When configuring the Data Ware house don’t forget to grant the Reporting Service User account used in Configuration Manager “Data Reader” role permissions to the Data Warehouse Database, otherwise this message will show up when running the reports.

Error Displaying Reports

We grant the SQl Reporting Service user account the data reader role.

Reporting user permissions

After granting the Reporting Services user account permissions to the database the reports now run as they should.

Reporting user permissions_2

The Data Warehouse role is a great feature so you should try it out!

Updated!! With the new features in OSD that Aaron Czechowski shared on Twitter! Thanks Aaron, great stuff!

Every time a new Technical Preview of Configuration Manager is released is a late night upgrading and playing around with the new cool features! Last night it was time again TP 1703 was released. One of my favorite small but great feature is the Collapsible groups in the Task Sequence editor :D Will make navigating long and complex Task Sequences much easier.

1703TP1

More OSD news, Secureboot state can also be included in the hardware inventory, great important for Windows 10 deployments.

1703Secureboot

Importing a computer is also updated, it is now possible to add the computer to more than one collection, I wish we had that a long time ago!

1703multipleOSD

The next feature proves how much investment is made in Windows Analytics and that you should look at starting to use these awesome FREE service now! We will be able to control the Commercial ID, Telemetry level and more in Client Settings in Configuration Manager hopefully eliminating the need of running the Windows Analytics script to configure the clients as we do today!

1703TP2

Next new feature is a new wizard to on board to all Azure Services, the one that exists there in TP 1703 is Windows Store for Business.

1703TP4

More new features:

PFX certificates for Configuration Manager Windows client computers
Direct links to applications in Software Center
Convert from BIOS to UEFI during an in-place upgrade
PFX certificates for Configuration Manager Windows client computers
Making it possible to deploy .PFX cert to Windows 10 client as well, great and important addition.
Direct links to applications in Software Center
This will make it possible to email or send a link to an application in Software Center to the users. Will have to try it out as well.
Softwarecenter:SoftwareId=*Application Identifier*
Convert from BIOS to UEFI during an in-place upgrade
With the new ADK for Windows 10 creators update it is now possible to convert BIOS-UEFI during an in-place upgrade as well, removing one of the biggest blockers for inplace upgrade. More information:

https://docs.microsoft.com/en-us/sccm/osd/deploy-use/task-sequence-steps-to-manage-bios-to-uefi-conversion#convert-from-bios-to-uefi-during-an-in-place-upgrade

For more information on the improvements in Configuration Manager 1703 Technical Preview, check out the product documentation. https://docs.microsoft.com/en-us/sccm/core/get-started/capabilities-in-technical-preview-1703

KB2918614 which is part of the August patch Tuesday is released to solve a security issue in Windows Installer. What it does is change the way that Windows Installer handles repairs and advertised shortcuts as well. The description for the update doesn’t provide that much information.

UPDATE!! a workaround is described below

This security update resolves a privately disclosed vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker runs a specially crafted application that attempts to repair a previously-installed application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.

Normally a user could repair an application from the control panel without any additional permissions but after the update is applied if you try to repair for instance Adobe Reader you will, depending on your UAC setting be prompted for credentials.

UAC1This has caused some headache for many the last weeks not just for the auto-repair but for all using Activesetup and launches a msiexec.exe command in there to apply the users settings at first logon, and for advertised shortcuts as well.

Uninstalling the update brings back the normal behavior of Windows Installer again.

UPDATE!!

Thanks to HappySCCM http://happysccm.com/kb2918614-uac-gate/ who have posted the answer from Microsoft and a valid workaround..

Below if from HappySCCM’s site!

Microsoft:

This security update resolves a privately disclosed vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker runs a specially crafted application that attempts to repair a previously-installed application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.
Workaround if you have problems with repairing application:
==================================================
1. Uninstall the application and reinstall it with the security update installed. (sourcehash file generated with security update)

2. Manually copy the sourcehash file to c:\windows\installer folder. As the sourcehash file is generated based on the application files, the sourcehash file generated on computer A can be used on computer B.

Below is a screenshot of the sourcehash file:
screen

Just tested it and it works fine if you uninstall/install Adobe Reader again. After the installation the sourcehash file is generated and after that the repair is successful again.

Adobehash

Then at least newly installed computers can have the Update installed as it will not affect them.

Thanks for sharing HappySCCM!!