Things to Consider When Planning your ConfigMgr Design
This posting is 1 of a monthlong series of postings on the Microsoft System Center family of products. This is an excerpt from my book “System Center Enterprise Unleashed” with more postings on the System Center family of products up at http://www.networkworld.com/community/morimoto
The following are best practices in designing and planning your ConfigMgr 2007 R2 rollout:https://technet.microsoft.com/en-us/solutionaccelerators/dd407791.aspx.https://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=948e477e-fd3b-4a09-9015-141683c7ad5f.https://technet.microsoft.com/en-us/library/cc725793(WS.10).aspx.
► For organizations with existing configuration management database (CMDB) implementations, use Configuration Manager to supply data for Windows-based managed assets. This can be accomplished several different ways, including through the predefined SQL views and the WMI provider.
► Manage the Configuration Manager hierarchy from the central site, as this provides access to the entire infrastructure and all managed systems. Opening a Configuration Manager Administration Console on a lower-level primary child site only provides access to clients assigned to that site and child sites below that site.
► By default, the contents of a package are pushed to Distribution Points from the Site Server that created the package. Enable the Send Package from the Nearest Site in the Hierarchy option to make effective use of Senders and Addresses.
► To achieve global roaming, the Active Directory schema has to be extended. If the schema hasn’t been extended, only regional roaming is available. Regional roaming only allows client roaming to child sites below the client’s assigned site.
► Use software publishing to provide users with the ability to execute the software when it’s convenient for them. This is often beneficial for more savvy technical users, such as IT staff.
► Use the Microsoft Deployment Toolkit (MDT) 2010 for additional OS deployment functionality, including full-file scripted-based installation without needing to capture an image. MDT integrates directly into the Configuration Manager console and can be downloaded from
► Don’t use Configuration Manager as an authoritative source for making licensing purchases. The actual counts of licenses should be tracked as systems are provisioned and deprovisioned throughout the enterprise. Configuration Manager should be used to validate those numbers. For example, each SQL component is tracked separately. This artificially increases the count of some of the license reports.
► Don’t modify existing reports. Always make a copy of the report and make changes to the copy. During Configuration Manager service pack upgrades, the original reports can be updated by Microsoft; if the reports are customized, your changes will be lost.
► Use the PolicySpy utility from the Configuration Manager 2007 toolkit to review policies on the client system. The PolicySpy utility simply provides a view into the correct location within the WMI repository, where all policies are stored. The Configuration Manager 2007 toolkit can be downloaded from
► The Site Server database cannot be backed up while the SMS Executive service is running. Backing up the database while the SMS Executive service is running might result in inconsistencies between information in the database and the Configuration Manager site control file, which will prevent the site from being successfully restored in a disaster recovery scenario. Use the backup tasks from within the Configuration Manager Administration Console to schedule backups.
► Software information that is uploaded and eventually categorized by Microsoft is made available to all Microsoft customers through System Center Online Services. Avoid uploading private software information that could be used to identify your business to other customers.
► To override protected boundary behavior, enable the Allow Clients to Fall Back to Unprotected Distribution Points when the Content Is Not Available on the Protected Distribution Point option on the package advertisement.
► Avoid customizing the default collections; they can be changed and reverted back to default during subsequent service pack upgrades.
► Use the Network Access Account to allow network access from clients who are not in the same forest or workgroup. Normally, communication is done with the computer$ account; if the computer$ account fails, communication with the Network Access Account is attempted.
► When programmatically executing client actions on a 64-bit system, make sure the 32-bit script interrupter is used. The 32-bit version of cscript.exe is located here: %SystemRoot%SysWow64cscript.exe.
► Never configure overlapping boundaries. This can cause managed systems to use the wrong Site Server or Distribution Management Point. This often happens when using a combination of IP and Active Directory boundaries.
► Site-specific settings are not replicated down to lower-level primary sites or up to parent sites. To copy site-specific settings, such as the client agent configuration, use the Transfer Site Settings Wizard.
► The Windows Server 2008 Enterprise certificate template option is not compatible with System Center Configuration Manager 2007 R2 with Service Pack 2. Choosing the Windows Server 2008 Enterprise option results in a version 3 template. To create a version 2 template, select the Windows Server 2003 Enterprise template version.
► The certificate enrollment website provides a convenient way to generate the Document Signing and OS Deployment certificates. As an alternative to using the web enrollment site, certificates can be requested with the Certreq.exe command-line tool. For more information, visit the Certreq TechNet site at
► Use the simple schedule and a throttled agent deployment to distribute load and improve scalability of the infrastructure.
► Use a certificate with Subject Alternate Name (SAN) configured to allow the Site Server to support both intranet and Internet clients with two unique FQDNs.
