Things to Consider When Configuring System Center ConfigMgr 2007 R2
This posting is 1 of a monthlong series of postings on the Microsoft System Center family of products. This is an excerpt from my book “System Center Enterprise Unleashed” with more postings on the System Center family of products up at http://www.networkworld.com/community/morimoto
The following are best practices in Software Distribution, Updates, and OS Deployments relative to ConfigMgr 2007 R2:
► Extend the Active Directory schema to support global roaming. Global roaming can be achieved when the Active Directory schema has been extended. If the schema hasn’t been extended, only regional roaming is available. Regional roaming only allows client roaming to sites lower in the hierarchy. If the client roams to a peer site, or parent site, content cannot be downloaded from Resident Distribution Points.
► To override protected boundary behavior, enable the Allow Clients to Fall Back to Unprotected Distribution Points when the Content Is Not Available on the Protected Distribution Point on the Package Advertisement option.
► It is important to only assign an Internet Management Point from the client’s assigned site. Assigning an Internet Management Point from a different site than the client’s assigned site is not supported.
► In a multisite Configuration Manager hierarchy, the client agents are independent and can be uniquely configured for each site depending on business requirements. Use the Site Setting Transfer Wizard to copy settings from one site to another.
► Be cautious if lowering the default polling cycle for either policies or state messages because this directly increases the load on the Management Point and the underlying network infrastructure.
► Customize the collection settings to control the polling interval for specific groups of computers. This is typically used to increase the polling cycle of Branch Distribution Points to improve how quickly they become aware of new content.
► For more granular BITS configuration, consider using a group policy to control BITS communication for specific sites and/or groups of systems. Domain-level group policies override the settings configured through the Configuration Manager console.
► It is important to make sure the Branch Distribution Point has access to a standard Distribution Point and isn’t completely isolated due to protected boundaries.
► When using a Branch Distribution Point, it is important to ensure this system is relatively static. For example, assigning a Branch Distribution Point to a laptop that roams to different sites is not recommended.
► If the scope of a collection is limited based on another collection, be sure to set the appropriate collection update schedule. The source collection should update before the target collection, or the results of the collection could be a complete update cycle behind. By default, a collection is updated every 24 hours, starting from when it was created.
► It is important to understand how maintenance windows work. When more than one maintenance window affects a system, the maintenance windows are effectively combined.
► Review the Status report of a specific advertisement to monitor software and operating system deployments. Look for status message ID 10073 to indicate an advertisement has been received but not run because no maintenance window is currently available.
► It is beneficial to leverage a DFS namespace for the Configuration Manager content source folders. This allows the back-end server hosting the content to be moved or replaced without needing to update all of the software distribution packages.
► Only MSP files can be placed in the Office Updates folder. Copying the downloaded Microsoft Office 2007 EXEs to the Updates folder directly is not supported. The EXE needs to be extracted first, and then the extracted MSP files need to be placed in the Updates folder within the source directory.
► Do not include Microsoft Office 2007 service packs or hotfixes in the Additional Content section of the Office Customization Tool. Updates need to be placed in the Updates folder; adding them as part of the installation is not supported.
► It is recommended to set the estimated disk space requirements for the program high enough to ensure enough space for both the installation and continued normal operation after the software package has been deployed.
► It is important to take advantage of the ability to support multiple programs with the same software package. This prevents the same application from being stored multiple times on the Site Server, Distribution Points, and in the clients’ local cache.
► With large software packages, downloading software with BITS and running it locally is considered a safe option because network interruptions do not affect the installation process. However, downloading the package locally requires a potentially large amount of disk space, and on older computers, can place heavy I/O on the disk subsystem as the software is decompressed and installed. If the network is very reliable, consider installing the software from the Distribution Point for local intranet clients.
► A large software package deployment can negatively impact performance of the target system. A user might restart the system to address the perception of sluggish performance, possibly causing a corrupt installation. Establish an effective change-control and communication process prior to silently deploying software and making changes to systems in the environment.
► Select the Schedule Home Page Summarization action to change how often the page is refreshed. Select the Run Home Page Summarization action to execute the summary process manually. The status of the summarization process can be seen in the statesys.log file on the Site Server.
► Use the Overall Compliance report located in the Software Updates – A Compliance folder to show the compliance of a specific collection against a specific update list.
► Keeping the source folder name and the software update deployment package name the same makes it easier to identify and clean up old patches and reclaim space on the file server.
► Establish baseline update lists and update deployments to get the environment current.
► The deployment of server operating systems to enterprise server hardware can be greatly simplified by leveraging vendor-specific Configuration Manager add-ons. HP, Dell, and IBM have all published add-ons and whitepapers for Configuration Manager 2007 available at no additional cost. These publications contain detailed guidance for deploying server operating systems to their hardware and include things like configuring the RAID controller and performing hardware firmware updates from within the WinPE environment.
► If CRL checking is enabled, ensure the PXE Service Point certificates contain the HTTP path to the CRL. If only the default LDAP CRL path was specified on the OS deployment certificates, the deployment process will fail because the WinPE environment cannot authenticate to Active Directory to access the LDAP path to check the CRL.
► The command line used to install the package during OS deployment should never initiate a reboot. Instead, the return code 3010 should be used to tell the Configuration Manager client to restart the system and continue the deployment after the reboot. With Microsoft Installer (MSI)–based packages, reboots can be suppressed with the REBOOT=ReallySuppress command.
► As a best practice, use a limited user account that has been delegated the ability to join systems to the domain as the domain join account for OS deployments.
► If the unknown computer support is used for OS deployments, make sure to advertise the OS deployment task sequence to the All Unknown Computers collection.
► If a computer has been recently removed from the Configuration Manager database, it is not automatically considered “unknown” for about an hour. To speed up this process, restart the Windows Deployment Services Server service on the PXE Service Point.
► When possible, it is highly recommended to establish a scripted installation to automatically create the baseline. This allows new base images to be created very quickly through a controlled and reproducible method. This is key to eliminating human error when manually installing and configuring the operating system and software packages.
