Switching from MDT to MCM

[jthompson]

I'm looking to move up from MDT to MCM for our OS deployment. I'm looking for some basic tips on getting started with it. I've got a fresh server, fresh install of SQL Server, latest ADK and WinPE pack installed.

 

I like MDT quite a lot, but the writing is very much on the wall for it now. I want to start off with MCM by basically replicating what we're doing with MDT (a near vanilla OS being deployed along with Office and maybe the .Net 3.5 feature added). MCM seems like a beast, and I'm feeling the ick right away with having to have the WSUS role involved (we happily ditched WSUS a while back).

 

Can anyone give me or point me towards some good guidance for getting started with MCM for relatively basic OS deployment to PXE clients? I'm finding it hard to get a good feel for MCM, given that it's quite a slippery thing to Google (most of the Internet wants to reference SCCM, which is a few product names ago now).

[CHiLL]

Most SCCM guides are still appliable, despite it now being badged as MECM, as long as you aren't seeing screenshots for Server 2012 R2, you'll probably be fine for the most part. The best sites to use as reference are:

 

https://www.prajwaldesai.com/

https://www.systemcenterdudes.com/

https://www.anoopcnair.com/

 

Those sites have guides ranging from entry/basic to advanced configurations and have been a life saver for me over the years.

 

For Windows Updates and your workstations, you could consider moving to WufB via Intune, if you are licensed for Intune that is. Earlier this year, we started properly testing Windows 11 and I also decided to utilise WufB for these, so I created a pilot ring and told MECM to use Intune for the update workload instead of itself. As my Windows 11 deployment grows bigger, as does my pilot ring and it will eventually become my production ring. However, I haven't even looked at how to manage server updates, so you may well need MECM and WSUS for those.

 

I'd probably look at starting off small; focus on OS deployment, client settings and updates as a priority. Once you have that up and running, then you can look at extra things, such as application deployment, Office/Edge deployment/updates and configuration baselines.

 

My main bugbear with MECM is how difficult it can be to fix/troubleshoot. The logs are usually pretty good and you should definitely utilise CMTrace (not even just for MECM - it's great for any logs), but sometimes it can lead you down the wrong path. For example, connectivity issues might occur because one of the certificates has expired and it doesn't tell you, so I'd recommend setting reminders to renew certificates in 12/24 months.

Edited October 22, 2024 by CHiLL

[jthompson]

Currently using WUfB for both clients and servers. Is there some way that I can "just use WUfB" in MCM? It seems like it wants to do things the WSUS way, with synchronisations, approvals, packaging updates into deployment packages, etc. I just want it to be able to check for and install directly from Windows Update.

[CHiLL]

Currently using WUfB for both clients and servers. Is there some way that I can "just use WUfB" in MCM? It seems like it wants to do things the WSUS way, with synchronisations, approvals, packaging updates into deployment packages, etc. I just want it to be able to check for and install directly from Windows Update.

Not really and I don't see the need to consider MECM for updates if you're already using WufB, it would just add extra complication and unnecessary storage requirements on your end. MECM will get updates directly from Microsoft, but by the way of WSUS and the configuration specified in MECM and store them on the server. However, clients will be pulling updates from the MECM server, rather than pulling from Microsoft online servers directly.

 

The simplified way at looking at the way MECM uses WSUS is that you create software update groups for each product and specify the updates, which then creates a deployment package and deployed to clients. You would also create automatic update rules, which you configure to sync on a schedule (such as patch Tuesday) and it will pull any updates as defined in the rule and add them into the existing deployment package. You don't interact with WSUS at all, you just install the role and don't even configure it! MECM manages WSUS entirely itself.

[jthompson]

Okay, I think I'm over-thinking things. I'm going to ignore the whole updates thing, and assume that when I get as far as sorting out a task sequence, I'll be able to include steps in there that can check for and install updates from Windows Update directly, just like I've been doing with MDT. i.e. either updating during deployment TS or updating during a build & capture TS.

 

I've managed to finally get a VM to PXE boot from it, but encountering errors about the boot image not being located on a distribution point. I'm not likely SCCM/MECM/MCM so far - it's like a big bowl of jargon soup.

[altecsole]

 

I've managed to finally get a VM to PXE boot from it, but encountering errors about the boot image not being located on a distribution point. I'm not likely SCCM/MECM/MCM so far - it's like a big bowl of jargon soup.

 

Any content you add, you need to Distribute to your Distribution Point - just right-click and Distribute Content.

[jthompson]

Any content you add, you need to Distribute to your Distribution Point - just right-click and Distribute Content.

 

Thank you. Yes, a mix of that and also not having any boundaries or boundary groups configured. My "Hello World" TS that just installs a vanilla 24H2 image now appears to be progressing.

[aac]

Once you've got MECM up and running consider looking at Big Bang LLC UIU utility (MECM Plugin). I have been using this for 15 years now and it makes life so much easier not having to worry about drivers, support is also first class...

[jthompson]

I've been working on this quite a bit now and my level of knowledge of SCCM/MECM/MCM is now comfortably into the 'Dangerous' zone

 

I know that the build & capture approach is out of fashion now, but that's what I've been working at (that's what we currently do with MDT). I've got Office, .NET 3.5, some custom PowerShell tweaks and Windows updates (using PSWindowsUpdate to pull them direct from MS) in the build & capture TS, and then able to deploy that image out using a basic OS deployment TS.

 

The way MCM handles drivers is pretty unweildy, but I've imported drivers packs for our various Dell models regardless, with model-specific TS steps to install them.

 

Longer term I imagine shifting towards a thinner image and deploying Office and other big apps after imaging. I still like capturing an image with the most recent cumulative updates applied, though.

 

All very interesting.

[PotNoodleTech]

Yeh still using MDT here too it just works so darn good you can build 100 pcs a day for like 5 years straight, no issues.

 

I said I'd upgrade and upskill myself when something better comes along............still waiting as none of the newer stuff I've seen so far is better, infact, it's not even as good or reliable.

[jthompson]

TBF, whilst MCM still feels in places like MS have lost interest (applying Windows updates in a TS without using its WSUS-based approach requires some custom PS scripting), the application deployment looks like something we'll be able to lean in to more, as an alternative to doing all of our app deployments via GPOs.

[ITGuyNW]

Yeh still using MDT here too it just works so darn good you can build 100 pcs a day for like 5 years straight, no issues.

 

I said I'd upgrade and upskill myself when something better comes along............still waiting as none of the newer stuff I've seen so far is better, infact, it's not even as good or reliable.

 

Same boat. Microsoft prefer MCM/Intune, but MDT *just works* , and like you, can do 100+ pcs in a day if I wish and it'll work every time.

 

I keep thinking about learning what Microsoft wants us to use but it just doesn't work as well as the current solution.