SCCM 2012 Device Collections

[tmcd35]

Okay, so I've finally got around to using the SCCM server I setup some weeks ago. Now looking to get our first one or two SCEP installations done. So, I created a new Device Collection called "Endpoint Protection Clients" and used a direct rule to add two test machines to it. So far so good. I then used the Client Push Wizard to install the Client Manager on the two machines. The Client manager installed without a hitch. But, now the Device Collection is empty? All firewalls on clients and server are disabled. The SMSAdmin user is a local and domain admin. The clients are installed. Why can't I see them anymore in the Device Collection? They appear in the "All Systems" Collection and show us being active there.

 

Anyone got any ideas/pointers?

 

I want to verify that SCEP is running correctly on these two machines before a roll it out to a wider audience.

 

 

Also, any one got any pointers on how to set up windows updates through SCCM as I think that's the next part of this project?

 

Thanks.

[FN-GM]

How are they members of the collection? Are you using a query?

[tmcd35]

No, no query. Just a straight manual direct add. Wasn't expecting to see any difference either with or without the client installed. Just reading Windows-noob now and it appears I have a few more steps to get SCEP working, but that doesn't answer this question.

[FN-GM]

Hmmm to be honest i dont see why that would happen. Where the machines discovered or the you manually add them with a MAC to SCCM?

[tmcd35]

Auto discovered, I assume by interrogating AD. It's almost as if there's a hidden rule or DNS issue but the only thing to have changed is the SCCM client has been installed on these machines. I haven't even done a restart.

[FN-GM]

@Gatt might know but i really don't know why that would happen

[sonofsanta]

Do you just need to update membership on the collection? Or is the limiting collection for this collection incorrect?

[tmcd35]

I've decided to ignore the problem until I really need it. At the moment I've gone back to Windows-noob and found that theres a lot more to do for SCEP, not least of which WSUS needs setting up first

 

Still, live and learn.

[tmcd35]

Do you just need to update membership on the collection? Or is the limiting collection for this collection incorrect?

 

The limiting collection was "All Systems", I'm sure that was correct. As for updating membership I deleted the collection and recreated it, adding the two devices with SCCM Client manually, same problem. Not listing in the collection, although the collection does say it has 2 devices in it.

[sonofsanta]

The limiting collection was "All Systems", I'm sure that was correct. As for updating membership I deleted the collection and recreated it, adding the two devices with SCCM Client manually, same problem. Not listing in the collection, although the collection does say it has 2 devices in it.

 

All Systems should be fine, it was an outside shot anyway.

 

I have no idea how it is reporting two devices but just not displaying them even after forced updates. Can't say I came across it

[Gatt]

Is the SCEP role installed (Administration -> Overview -> Site Configuration -> Servers and Site System Roles -> -> Endpoint Protection point

(The only options are to accept the T's & C's and at least Basic Membership)

 

Then, in Administration -> Overview -> Default Client Settings (or a custom one if used) -> Endpoint Protection - make sure at least the 1st THREE options are set to YES

The other option you can configure as needed

 

Once the clients to a Machine Policy refresh they should install the SCEP Client... and it will appear in the notification area

[Gatt]

Windows Update via SCCM is fairly easy in 2012 - a heck of a lot better in 2012 than it was in 2007

in fact it does everything for you - including the installation of WSUS (if it doesn't install it but dont configure it)

 

The Windows-Noob site has everything you need to get it up and running so I wouldn't stress too much about SUP in 2012!

[brainchylde]

As a rule, unless you are doing something quick and dirty you should not use "direct rule". Always use query based rules.

 

The resource ID of a machine can change - for example, by re-imaging the machine from PXE boot. If you re-image via OSD through the OS then it'll maintain the resource ID. There are other circumstances in which the resource ID may change and in this instance a directly added resource will be lost from the collection.

 

A better approach is to use a query based rule. So, let's say for example you want to add machines with name "1" and "2" to a collection, create a query based upon the machine name and use this to form the collection. On that basis, even if the resource ID of the machine should change, the device (although actually a different resource) will maintain its place within that collection.

 

What I suspect has happened in your instance is that the resource ID has changed when the client installed on the machines. In SCCM 2007 this would have resulted in duplicate resources being shown (you may have seen multiple computer resources for one device), but in 2012 I think the behaviour is different and the duplicate is automatically removed.

 

Does that help? :-/