5 SCCM Tools

Client Center Configuration Manager

Here is one of my favorite SCCM tool and probably the most useful I have ever seen! Client Center Configuration Manager has been developed by Roger Zander (Microsoft MVP). You can download the tool from the CodePlex website: https://sccmclictr.codeplex.com

The tool is designed to troubleshoot SCCM Client related issues. This tool provides a quick and easy overview of:

• Client settings,
• Running services,
• Agent settings,
• Software updates,
• …

Once the installation is done, enter the IP Address or the DNS name of the machine you want to monitor and click “connect”. If the connection failed, please check the requirements:

• Windows Remote Management (WinRM) must be enabled and configured on all target computers. (Run “winrm quickconfig” in a command prompt.)
• Microsoft .NET Framework 4 (on the computer running the Tool)
• Configuration Manager Agent on the target computer
• Admin rights on the target computer
• Windows Management Framework 4.0 is required since Version 1.0.2.

• You will notice 4 sections in the left pane. The first one is called “Agent Settings” and will display information about the SCCM client such as:
• Agent settings gather information about the SCCM client properties
• SCCM cache will display cache-items, cache size, cache path, …
• Install / Repair allows you to run some checks on the machine such as “Check WMI repository”, “Repair the agent”, “Restart the machine”, …
• …

The “Software Distribution” section displays information about Applications, Software and Service Window.

The next section gathers information about installed software and Windows updates.

One cool feature in this section is to install pending updates. Sometimes, you may have some pending windows updates that you can remotely force the installation.

To finish, the “Monitoring” section allows you to monitor Windows Services, Processes, and Logs on the client machine.

CMTrace

CMTrace.exe is a life saver! CMTrace reads log files in real time. It was designed to look at Configuration Manager log files. You don’t need to open a log file and re-open it after something has made a change because CMTrace will refresh content in real time.

You don’t need to download it from Microsoft website because it is included in the actual installation of Configuration Manager. You can find CMTrace.exe on the Primary Site server, located into <Configuration Manager install folder>\Tools, and also included in the Boot Images.

Of course, you can use CMTrace as your default log viewer. If you like using it, I advise you to copy it to all your computers so you have it everywhere where you might need it!

Firstly, navigate to C:\Program Files\Microsoft Configuration Manager\tools\ and open CMTrace.exe.

Next, you must choose if you want to make it as your default viewer for reading log files or not.

Now when you will open any log files, CMTrace will display the content. By default, SCCM log files are located under C:\Program Files\Microsoft Configuration Manager\Logs. Below, I opened the CMUpdate.log:

CMTrace Highlight is one of the most useful features. The goal is to highlight anything you want. Here, I want to highlight anything written about “Successfully”. To do that, go to “Tools” menu and select “Highlight”:

Another useful feature is the “Error Lookup” tool. You just need to enter an error code into the tool and CMTrace will display a brief description of what the code means. To use the error lookup, go to “Tools” and select “Error Lookup”. Enter your error code and click “Lookup”:

Now, if you need to examine multiple log files, you can use CMTrace to display the files together. You click open and select the log files. Note that you also can select the box “Merge selected files”. In this case, CMTrace will merge them together for a complete view.

Support Center Tool

System Center Configuration Manager Support Center Tool helps you to gather information about SCCM clients so that you can more easily address issues. First, you need to download “cmsupportcenter.msi” from the Microsoft Download Center https://www.microsoft.com/en-us/download/details.aspx?id=42645. After the download completes, double-click “cmsupportcenter.msi” to run the setup wizard. Follow the instructions in the setup wizard to install Configuration Manager Support Center.

When you will launch the Configuration Manager Support Center Tool, you will need to choose if you want to query the local machine or a remote machine. That’s really cool and useful because you don’t need to install this tool on a remote machine.

Now you will see the “Data Collection” tab. Select one or more tasks and then click on Collect Selected Data. Support Center will collect the data for enabled tasks. Of course, the SCCM client must be installed on the machine!

Once the data collection is done, all the data are stored in a .zip file. You can use the next tab called “Client” to get the information about the SCCM client:

Next, the “Policy” tab will display the policies that are applicable to the configuration manager client.

The “Content” and “Inventory” tabs will load the inventory data for that client (application, package, hardware inventory, …). The “Troubleshooting” tab will run some troubleshooting tasks. If there is an error status, then you can open the associated log file from the tool:

Let’s finish by the “Logs” tab which is something like a CMTrace. You can open the log files and use filters to display the entries from the log file.

Support Center is a must have for troubleshooting SCCM client.

Configuration Manager Toolkit

This toolkit contains fifteen downloadable tools to help you manage and troubleshoot Microsoft System Center Configuration Manager. A toolkit is a group of 15 tools that extend SCCM capabilities by providing features for troubleshooting, monitoring, security, and management. You can download it from this URL: https://www.microsoft.com/en-us/download/details.aspx?id=50012

Don’t be afraid if you see “System Center 2012 R2 Configuration Manager Toolkit”, it works like a charm on SCCM CB 1610 version!

Once the toolkit is installed, you can open the Windows Start menu and confirm that the installation was successful.

Go to the following folder: C:\Program Files (x86)\ConfigMgr 2012 Toolkit R2 and you will notice two folders:

• ClientTools
• ServerTools

It means that some tools are focused on client side or server side. The toolkit includes the following tools:

Client tools

• Client Spy is a tool for troubleshooting software distribution, inventory, and software metering on computers running System Center Configuration Manager Client.
• Deployment Monitoring Tool is a graphical user interface designed to assist in troubleshooting applications, updates, and baseline deployments on a System Center Configuration Manager managed client
• Policy Spy is a tool for viewing and troubleshooting the policy system on System Center Configuration Manager Clients
• Power Viewer Tool will help administrators view the status of power management feature on the client side.
• Send Schedule Tool is used to trigger a schedule on a Client or trigger the evaluation of a specified DCM Baseline.
• Wakeup Spy provides a view of the power state of the Configuration Manager client peer computers and which computers are operating as managers on that client computers’ subnet.
• Configuration Manager Trace (CMTrace)

Server tools

• Security Configuration Wizard Template for System Center Configuration Manager is an attack-surface reduction tool for the Microsoft Windows Server operating system. Security Configuration Wizard determines the minimum functionality required for a server’s role or roles and disables functionality that is not required.
• Role Based Administration Modeling and Auditing Tool audits security scope and security role.
• Content Ownership Manager changes ownership of orphaned packages in System Center Configuration Manager.
• Run Metering Summarization Tool is used to trigger Metering Summarization immediately on Primary Sites
• Content Library Transfer Tool transfers content from one disk drive to another. It is designed to run on distribution point site systems.
• Collection Evaluation Viewer is a tool for viewing the collection evaluation processes.

PowerShell

The last but not the least: Windows PowerShell. Microsoft has introduced native Windows PowerShell support with System Center 2012 Configuration Manager SP1. It means that you can use PowerShell cmdlets to manage your SCCM environment. Let’s start by launching the Configuration Manager console. In the upper left corner, choose “Connect via Windows PowerShell”.

The first option will open the PowerShell console and the second option will open the PowerShell ISE editor. Note that you also can directly open the PowerShell console and then load manually the SCCM PowerShell module with the following command lines:

1 2 3 4

# Import the ConfigurationManager.psd1 module   PS > Import-Module "$($ENV:SMS_ADMIN_UI_PATH)\..\ConfigurationManager.psd1" # Set the current location to be the site code.   PS > Set-Location "CM1:" # Replace by YOUR site code

There are many cmdlets at your disposal (more than 700 cmdlets). Below are some examples:

Gather information about the distribution point Server

Getting information about some packages

You can easily create SCCM device collection with the New-CMDeviceCollection cmdlet. We need to define update schedule with the New-CMSchedule cmdlet and then define the device collection to be created:

I can check the new collection from the SCCM console

Windows PowerShell is very useful to automate your daily tasks. All the SCCM cmdlets are listed and described with examples on TechNet: https://technet.microsoft.com/en-us/library/jj821831(v=sc.20).aspx

SCCM Site Boundary Types and its Advantages and Disadvantages

Boundaries for System Center Configuration Manager define network locations on your intranet that can contain devices that you want to manage. Boundary groups are logical groups of boundaries that you configure.

Types of Boundary's in SCCM.

• IP Subnet
• Active Directory Site
• IPv6 Prefix
• IP Range

Clients on the intranet evaluate their current network location and then use that information to identify boundary groups to which they belong.

Clients use boundary groups to:

• Find an assigned site: Boundary groups enable clients to find a primary site for client assignment (automatic site assignment).
• Find certain site system roles they can use: When you associate a boundary group with certain site system roles, the boundary group provides clients that list of site systems for use during content location and as preferred management points.

Clients that are on the Internet or configured as Internet-only clients do not use boundary information. These clients cannot use automatic site assignment and can always download content from any distribution point from their assigned site when the distribution point is configured to allow client connections from the Internet.

Best practices for boundaries and boundary groups:

• Use a mix of the fewest boundaries that meet your needs
• Avoid overlapping boundaries for automatic site assignment

Refer below MS links for more info:

https://docs.microsoft.com/en-us/sccm/core/servers/deploy/configure/boundaries

Site Boundary Type	Advantage	Disadvantage
IP Subnets	Using IP subnets to define the boundaries of Configuration Manager sites allows you to be very specific about which clients will be assigned to which Configuration Manager 2007 sites based on their individual subnets. This also allows you to assign computers residing in the same Active Directory sites, but on different subnets, to different Configuration Manager sites. NOTE: When adding IP subnets as boundaries for a site, you should ensure that the IP subnet being added as a boundary has not been added to an existing Active Directory site defined as a boundary for a different Configuration Manager site.	Each IP subnet you want to be part of your Configuration Manager boundaries must be entered individually in the Configuration Manager console. IP subnet changes or additions will require additional Configuration Manager boundary administration.
Active Directory Sites	Because Active Directory sites are based on physical network segments, the easiest method of defining Configuration Manager boundaries is to base them on Active Directory sites. This allows Configuration Manager administrators to split up or combine IP subnet boundaries based on logical, not physical, criteria. One advantage to using Active Directory sites as Configuration Manager boundaries is that subnet changes to Active Directory sites are automatically reflected within Active Directory boundaries. NOTE:Active Directory discovery methods can only be used to discover computers located within the boundaries defined by Active Directory site names.	Before assigning clients using Active Directory sites, you must ensure that the Active Directory administrators have included all of the subnets you expect to be present in the Active Directory site. If the Active Directory sites are not properly configured, and you use them for Configuration Manager boundaries, you will have unmanaged clients on those subnets.
IPv6 Prefix	IPv6 allows for many more addresses to be assigned and many current and future operating system releases will support its use.	IPv4-only systems cannot communicate directly with IPv6 computers and may require IP translation, such as NAT, to communicate.
IP Ranges	In some cases, you may not want to add an entire IP subnet as a boundary. In these cases it may be advantageous to specify only an IP range to use for client site assignment.	Entering IP ranges can result in more planning to ensure that the IP ranges used are not configured as part of an IP subnet boundary for a different Configuration Manager site.

Automatic Deployment Rule (ADR) in SCCM

To use the Create Automatic Deployment Rule Wizard to create the Automatic Deployment Rule for your Patch Tuesday updates. Here are the steps:

1.     In the SCCM 2012 administrator console, navigate to the Software Library workspace.

2.     Select Software Updates, and choose Automatic Deployment Rules. Click the Create Automatic Deployment Rule option on the ribbon to launch the Create Automatic Deployment Rule Wizard.

3.     On the General page, which is shows in below screenshot, specify Patch Tuesday in the Name field and a description in the Description field. In the Collection field, enter or browse to the (Ex:SUM WRK Pilot I) collection you created in your environment. For the Each time the rule runs and finds new updates option, select Create a new Software Update Group. Although adding updates to an existing software update group is useful when creating an Automatic Deployment Rule for Endpoint Protection definition updates, it's not useful for regular software updates. Here you'll create a new group every month. Otherwise, you'll end up having too many updates in the group. (A software update group has a limit of 1,000 updates.) Clear the Enable the deployment after this rule is run check box. Click Next

       Specifying the General Information for the Automatic Deployment Rule

4.     On the Deployment Settings page, click Next.

5.     On the Software Updates page, select the following filters and add the specified search criteria: Date Released or Revised: Last 3 weeks; Update Classification: "Critical Updates" OR "Security Updates" OR "Updates Rollups" OR "Updates"; Title: -as below.

Confirm that your page looks like the one in below screenshot, then click Next.

Specifying the Filters and Search Criteria

6.     On the Evaluation Schedule page, select Enable rule to run on a schedule and click the Customize button. Configure the rule to run the second Tuesday of every month at a time of your choosing. Click OK, then click Next.

7.     On the Deployment Schedule page, configure the following settings. In the Time based on drop-down list, select Client local time. In the Software available time and Installation deadline sections, select As soon as possible. You don't have to worry about this deadline being too aggressive because this setting is being applied only to the devices in your pilot group. For the production workstations, I recommend making the updates available two days prior to the company-decided deadline. Updates will start downloading in the background when they become available and will install when the deadline is reached. Click Next.

8.     On the User Experience page, select Display in Software Center and show all notifications in the User notifications drop-down list. In addition, suppress the system restart on both servers and workstations, as shown in below screenshot. Click Next.

       Configuring the User Experience Settings for the Automatic Deployment Rule

9.     On the Alerts page, you can configure SCCM to send an alert when the compliance level drops below a certain percentage. To do this, select the Generate an alert when the following conditions are met check box. Then, in the Client compliance is below the following percent drop-down list, select 95. Finally, set the Offset from the deadline option to 35 days. This means that SCCM will generate an alert if the compliance level isn't at 95 percent 35 days after the specified deadline. Click Next.

10.  On the Download Settings page, configure the following settings. Select Download software updates from distribution point and install as the deployment option for the preferred distribution point. Select Download and install software updates from the fallback content source location as the deployment option to use when updates aren't available on any preferred distribution point. Select the Allow clients to share content with other clients on the same subnet check box. Select the If software updates are not available on preferred distribution point or remote distribution point, download content from Microsoft Updates check box. This is a new SP1 feature that allows clients to fall back and use Windows Update to download the content. The client will only download content for the updates you have approved. After making sure that your settings look like those in Figure 4, click Next.

      Figure 4: Specifying How to Download the Updates

11.  On the Deployment Package page, you can either select an existing deployment package or create a new one. For this example, create a new one, specifying a name and description for it. In the Package Source field, enter or browse to the folder containing the software update binary files. Leave the sending priority at the default of medium. Click Next.

12.  On the Distribution Points page, specify the distribution points or distribution point groups to which you want to distribute the package and click Next.

13.  On the Download Location page, select Download software updates from the Internet and click Next.

14.  On the Language Selection page, select the languages supported in your organization and click Next.

15.  On the Summary page, click Save As Template. In the Save As Template dialog box that appears, type Pilot Deployment I in the Name field and click Save.

16.  Click Next to have the wizard create the Automatic Deployment Rule. When it completes, click Close.

You'll now see the Patch Tuesday rule in the list of Automatic Deployment Rules. Manually run that rule by selecting it and clicking the Run Now option on the ribbon, as shown in below screenshot. Click Yes to start the process.

Running the Automatic Deployment Rule Manually