Best way to setup SCCM for a MAT

[HereIGoAgain2601]

Dear edugeek,

 

 

I work as part of the IT team in a MAT in the north west of England. We are currently using SCCM 1606 to manage our OS and software deployments.

Due to a number of issues we are looking at reconfiguring our environment to be more consistent across the trust.

I wonder whether there are any others out there using this technology, whether individually, or as part of a trust, and would be willing to share how you do things? We have a very experienced SCCM administrator, but believe that the system has become too complicated for end use. Our technicians are struggling to use the software day to day and need to rethink how we do it.

We currently have 1 master task sequence that uses a wide range of variables based on machine name and OU to choose an OS version and appropriate software as part of the PXE boot sequence. This is used across multiple sites that have a wide range of software. Unfortunately the trust has now grown, and we have so much software and so many variables that it is difficult to keep track of, and deployments continuously fail. We also have device collections in a mirror of our active directory to deploy software on the fly using queries.

 

 

I would be interested to know if you deploy software as part of the imaging process or whether you do it through device collections and what your experiences have been? SCCM also manages our antivirus clients and we are starting to use the servicing plans for windows upgrades.

 

 

We are looking to achieve:

 

 

 

• A consistent OS deployment task sequence that can be used across the trust, and can be easily scaled if new schools join.
  
• The ability to deploy software to groups of machines, whether this be individual trust sites or departments.
  

 

 

Thanks in advance - i would appreciate any input

[psydii]

I favour a relatively empty OS deployment sequence, and push applications dependant upon the device role.

 

The device role is implemented in a blended fashion: Location in the OU structure, and AD group membership. Both of which are picked up in collections in SCCM.

 

 

We have collections for things like:

OS Version

Site

Classroom PC

Teacher Laptop

Shared Laptop

Office PC

IT Suite PC

Maths Department PC

 

Many of which are mapped form groups:

sch_comp_Office

sch_comp_ITSuites

etc..

 

It is quite complex, but then so is the requirement, however as long as you know in what role the computer will be used, you just drop it into the correct OU and groups, and never worry about it again. If a classroom gets dual purposed, you add the PC to the other department's computer group and stuff just happens.

 

 

We have hundreds of groups, which can be intimidating, but with a strong naming convention and a well briefed team day to day everything is very straightforward and faults caused by misconfiguration are close to zero.

Increasingly OU structure beyond a certain point is only used to help the team understand what is going on. Most (but not all) capabilities are derived from group membership.

 

We run a similar schema for staff role and capability groups too. This allows us to do things like email budget holders (each budget has a two groups, "member" and "holder"), and deploy appropriate print controls to staff, with the same click that adds them to distribution groups and file shares, and sharepoint sites. It also controls software targets on a per user basis.

 

For example:

a new member of staff is say HoD English, and so we add them to that role (sch_role_department_head), the role group is already a member of the role and capability groups granting budget holder capability (used in PSFinancials, PaperCut and a subset of the finance shared area), access to the dept share, put on the departmental DL, onto the middle management DL, and the common HoD shared folders, various sharepoint sites, granting authoriser rights on YouTube, and access to other departmental resources, including having the departmental software set available for deployment. A new

SLT

departmental link appointment would get the "sch_role_deptartment_slt" role which grants them a subset of the above but access to shared

SLT

resources.

 

 

 

We evolved this from a pre SCCM and Sharepoint Active Directory best practice guidance:

https://hitchcode.com/2011/06/22/roles-based-access-controldan-holme/

http://www.edugeek.net/forums/links/94245-video-active-directory-best-practices-ten-years-later.html

https://www.amazon.co.uk/Windows%C2%AE-Administration-Resource-Kit-Professionals/dp/0735624313

Which in an of itself is derived from a 1996 paper:

http://csrc.nist.gov/rbac/sandhu96.pdf

 

It takes planning, and time.

Once you have developed a schema, you work your way through each department/set of roles and capabilities over time. Anything new gets done this way, and in due course by maintaining the consistent approach you end up with a well organised, reliable consistent system with reduced configuration errors.

Edited December 22, 2016 by psydii

[supawat1]

I have found this website is very useful when I first start off with my SCCM planning deployment. https://technet.microsoft.com/en-us/library/gg682106.aspx and using this website for the actual deployment https://prajwaldesai.com/sccm-2012-r2-step-by-step-guide/.

 

For me, I will include any software that are not likely to change frequently is an ideal solution (e.g. Office suite) or any large size application software that may take longer to install with the OS deployment and then using Collections to deploy any specific software for that particular group.

 

I am assuming that your MAT has got up to 10,000 clients then you may consider just having a SCCM Primary standalone site, a few of Management point servers and a secondary site and distribution point server for each school.

[HereIGoAgain2601]

Hi guys,

 

Thanks so much for taking the time to reply in detail. I like the sound of the security group memberships as a way to manage everything. We already have the SCCM infrastructure setup and scaled appropriately with the distribution points but I will have to check the configuration for the management points as I think we may be running with just one. We are around 3000 clients so we do just have the one standalone site. I think we may need to increase the CPU / disk / RAM allocation on our VMware infrastructure for the SCCM server as it seems to run incredibly slow.

 

We are going to clear everything out and having a fresh start with both our AD and SCCM infrastructure so just wanting to see how others do it and what works well.

I tWe have been doing OS deployments to unknown computers and to existing collections for a while now but the issue we have faced is with overloading the task sequence with every bit of software in the trust and then putting the variables in that don't always work.

 

I think collections is definitely the way to go for us for software deployment groups but maybe using security groups to map the membership would work well, particularly in terms of linking it back to AD for things like printer deployments.

 

If you are free to discuss and talk through it with during the new year I would appreciate it just to get a clearer idea of how your environment is setup?

 

Thanks again and Merry Christmas,

 

Joel

[Watty08]

We use SCCM here and build our device collections on groups (with specific software for different groups). When add a device we specify which collection group then and it will re-build to the right dept.