[sccm 2007] IS my software installation correct?

[deano]

We have SCCM R3 installed on our network and i'm pretty new to using it. I'm currently using SCCM for software installation, which i have learnt from various guides.

 

My question is around the allocation of software to be installed by SCCM. What i have been doing is creating seperate collections for the diffrerent software and then adding computers to the collection.

 

I could group these by department or even room if needed but before i install any more software, can somebody tell me whether this is one of the correct ways of allocating software through SCCM?

[riffleman]

SCCM can be configured in any way you want to. It's a tool that helps simplify the management of your systems so use whatever works best for you.

 

I have mine set up by classroom collections, then group those classrooms by department. I've also got it setup so that workstations with IWBs are in their own group too. I then deploy software to those collections,rather than creating collections for each app.

 

Go with whatever works for you.

[deano]

SCCM can be configured in any way you want to. It's a tool that helps simplify the management of your systems so use whatever works best for you.

 

I have mine set up by classroom collections, then group those classrooms by department. I've also got it setup so that workstations with IWBs are in their own group too. I then deploy software to those collections,rather than creating collections for each app.

 

Go with whatever works for you.

 

That's good to hear! As I said above, I have only done the software title as of yet but had plans of using rooms as well to make things easier for remote support.

 

I did find an interesting article about matching your collections to AD OU's, which would be even easier as this structure would give the ideal collection setup. Going to have a go today and will let you know the outcome.

[Gatt]

My collections are setup like this.

 

I then assign Software to either:

 

Workstations - if it is for the whole school

Staff - for staff only apps

Pupils - for pupil only apps

I can also deploy to each room or department as needed.

 

If it is for a single PC - I tend to create a new collection

[deano]

@Gatt

 

what is the scheduled deployment collection for?

[Gatt]

it rebuilds the PC at a certain time (eg 4pm - it must be able to boot to at least the logon screen)

PXE boot forces a rebuild the next time the PC boots...

[hofsteda]

Pretty much what riffleman said. If you have a need to group machines, create a collection structure for it. I try to have all but optional software query based.

 

Advertisements

->All Machines

----> allmachines phase3

----------->FacStaffph3

----------->Classroomsph3

------------>allmachinesphase2

------------------>facstaffph2

------------------>classroomsph2

------------------>allmachinesphase1

----------------------->facstaffph1

----------------------->classroomsph1

------------------------>testgroup

---------------------------->facstafftest

---------------------------->classroomtest

-->Staff Only (laid out and linked to same collections above just facstaff)

-->Labs/classrooms (laid out and linked to same collections above but just labs)

 

Grouped By Model

---->Optiplex270s

---->Optiplex280s

etc.

Specific Apps->

----> Itunes

---------->Itunes test/install

----------->Itunes remove

etc

 

The ads that go on all machines or all of a class of machine are walked up from testing to phase3. Software updates use these trees also.

Machines are auto-assigned to the appropriate phase2 collection by query unless assigned to one of the other collections.

 

Model collections are for bios settings and updates

 

Specific apps is used to target optional software

root collections of an app are query based using add\remove. New installs are manually be assigned to install collection. On upgrade roll out, we add queries to the install collection for machines with software and member of phase1,2,3.

The queries for Java are a little trickier as we have a collection of machines not to update.

Each lab has a collection-Lab specific software is assigned there.

 

I like the idea of the scheduled one as we've been toying with the idea of re-imaging some of our machines on a weekly schedule.

Edited February 4, 2011 by hofsteda

[Gatt]

I'll be testing the weekly rebuilds of IT Suites from Feb Half Term on 1 suite to begin with, if successful will add another IT suite and build it up a suite at a time..

 

Still trying to get Quicktime / iTunes to deploy via SCCM..

[hofsteda]

 

Still trying to get Quicktime / iTunes to deploy via SCCM..

Most of what I use came from appdeploy.com. Some of the transforms I use have came forward several versions so some of the edits may no longer be necessary. 10 is better than 9. I used to curse apple soundly back then.

 

Start an itunes install and dig the msi's out of the temp folder.

I have transforms created with orca for bonjour.msi, AppleMobileDeviceSupport.msi, quicktime.msi, itunes.msi.

 

Quicktime is installed/updated with

msiexec.exe /qn i appleapplicationsupport.msi /L*v %systemdrive%\scripts\appleappsupport.log Reboot=ReallySuppress

msiexec.exe /qn /i quicktime.msi /t quicktime.mst /L*v %systemdrive%\scripts\quicktime.log Reboot=ReallySuppress

 

Itunes has those two lines plus similiar lines for

applemobiledevicesupport.msi, bonjour.msi, itunes.msi.

 

The scripts folder is a logging folder we have on every machine. You can drop the whole /L*v section. We use it on most msi installs to trace install failures.

 

Transforms:

applemobiledevicesupport.msi

-->LaunchCondition table->Drop Not BNEWERPRODUCTINSTALLED Had issues with false positives at one point.

-->Property Table->IAcceptLicense Value=Yes

Bounjour.msi

-->LaunchCondition drop NOT BNEWWERPRODUCTINSTALLED

-->Property table IAcceptLicense value=Yes

-->Shortcut Table-> AboutBonjour -> Don't remember why I dropped this one.

Quicktime.msi

-->LaunchCondition table drop NOT BNEWERPRODUCTINSTALLED

-->Property table SCHEDULE_ASUW value=0

-->Registry Table Drop Quicktime Task (key=SOFTWARE\Microsoft\Windows\currentversion\run)

-->shortcut tables dropped QuicktimePlayer_desktop, QuicktimeUninstaller, QuicktimeReadme (apple really pissed me off I guess to get rid of the readme)

 

Itunes.msi

-->Component Table ItunesDesktopShortcuts ->Condition DESKTOP_SHORTCUTS="0"

-->CustomAction table drop QuicktimeInstallFailed

-->Property table

IAcceptLicense Value=Yes

SCHEDULE_ASUW value=0

-->Shortcut table Drop AboutItunes

Looks like I missed the ituneshelper run key in itunes.msi.

 

Quicktime is a fully supported application. Itunes we just patch to keep it up to date and to curtail the number of times we give out admin rights. So far no one has complained about it not working.

[Gatt]

Cheers, will have a bash at that....

[tarquel]

Did you (gatt) get any luck with this?

 

I'm only trying the apple application support and the quicktime installs, and i get fatal error messages in my SCCM OS build log with regards to the QT install. The Application Support Software installs fine tho.

 

Must be something I'm overlooking.... or its just Apple's super bloat 2011 software hehe

 

Nath.

[hofsteda]

Check the log location for the quicktime log. What are the errors listed? What is the error code thrown in the TS?

 

If pushing in an OSD ts, make sure the log path exists or remove the logging, /l*v filepath/filename. That one bit me as I usually log in the pwd. If you have the log path set for PWD and you run the osd packages off the DP instead of downloading you will get a failure due to file perms. We create %systemdrive%/scripts early in the TS on all our builds, so I now tend to log there for packages that get pushed in an OSD.

 

For the Dell Bios, Since I haven't posted enough to answer PMs yet, I've used the Dell Client Configuration Utility to create executables with the bios passwords embedded. If you use passwords and try to do bios updates either through the dell System Center Update Publisher cab, from the update executable directly, the updates will fail unless you remove the passwords first. This is also all done outside the OSD on our machines as Software distribution ads on the model collections. James Avery - Deploying Dell BIOS Updates with and without Bitlocker through ConfigMgr (SCCM) has directions on creating a TS for removing the bios password, bitlocker, doing the update, and resetting afterwards.

[Gatt]

@tarquel - yeah got it sorted - you need to edit the QuickTime.msi file (I used ORCA for this) and remove the following line from "LaunchConditions"

 

NOT BNEWERPRODUCTISINSTALLED

 

Full article: HOWTO: Install itunes using SCCM - www.windows-noob.com (Though I just extracted the MSI's and edited the above in QuickTime.msi)

[broon]

This is really a question to "hofsteda"

 

I have managed to deploy iTunes through SCCM but in your post you say

 

"Itunes we just patch to keep it up to date and to curtail the number of times we give out admin rights"

 

What I would like to know is how do you patch the software? I do not want to have to put out a new complete package every time there is an update as they are to frequent so patching would be the best option but do not know if there is a way to do this

 

Would really appreciate some advice

Thanks

[hofsteda]

That was bad phrasing on my part. With Itunes/quicktime and some other software it's a software distribution and install the new version for every update. I prefer to push updates through SCCM software updates, but I'm not willing to beat my head against the wall trying to get apple stuff packaged well enough for that to work. The BTNewerProduct broken logic with the MSI installs was bad enough.

 

I'd love it if they would publish msp patches or even a msi that actually worked. The last few shockwave/flash cycles, I've imported the standard msi's into software updates with relatively good results. Acrobat patches install nicely through software updates. I did java that way for a update or two, but went back to an Software Ad with 1.6u24.

[broon]

Thanks for the quick response, back to the drawing board! Will do as you say and just install latest as a whole package

[hofsteda]

Just a FYI for the Itunes stuff.

I just noticed with the latest updates the AppleMobileDeviceService is locking dll files for the update.

The update completes, but I'm going to try a sc stop "Apple Mobile Device" prior to the install to avoid this.

[Nate]

I followed your directions for doing this install, but instead of a transforms I just edited the .msi using Orca. I am doing iTunes 10.2.2.14 and am having issues with the iTunes part of this.

 

Quicktime installs perfectly via SCCM, but when it installs iTunes and I open it for the first time, it pops up a box that is trying to either repair or install the MSI. The box says the following:

 

"The feature you are trying to use is on a network resource that is unavailable."

"Click OK to try again, or enter an alternate path to a folder containing the installation package 'iTunes.msi' in the box below."

 

I want to note that I tried the following:

 

Using the same exact command to install, I installed it 1. Manually from an admin Command prompt as well as via a vbscript that was launched from an admin command prompt.

 

When installing it using these methods, everything was perfect. iTunes opened straight away, no MSI box popped up and it just worked.

 

I put the command into SCCM and everything installs (No MSI installer errors in the logs), *but* I get the box described above and it refuses to install since I am not caching it. I suspect this is due to being installed in a different context from an admin command prompt, but I'm not sure what I need to do in order to get this to work as nicely as it does with when installed via command prompt.

 

Thanks in advance,

 

Nate

[hofsteda]

I followed your directions for doing this install, but instead of a transforms I just edited the .msi using Orca. I am doing iTunes 10.2.2.14 and am having issues with the iTunes part of this.

 

Quicktime installs perfectly via SCCM, but when it installs iTunes and I open it for the first time, it pops up a box that is trying to either repair or install the MSI. The box says the following:

 

"The feature you are trying to use is on a network resource that is unavailable."

"Click OK to try again, or enter an alternate path to a folder containing the installation package 'iTunes.msi' in the box below."

 

I want to note that I tried the following:

 

Using the same exact command to install, I installed it 1. Manually from an admin Command prompt as well as via a vbscript that was launched from an admin command prompt.

 

When installing it using these methods, everything was perfect. iTunes opened straight away, no MSI box popped up and it just worked.

 

I put the command into SCCM and everything installs (No MSI installer errors in the logs), *but* I get the box described above and it refuses to install since I am not caching it. I suspect this is due to being installed in a different context from an admin command prompt, but I'm not sure what I need to do in order to get this to work as nicely as it does with when installed via command prompt.

 

Thanks in advance,

 

Nate

 

Sorry about the delay. We just went through a break week and I was busy breaking things.

sccm runs under the system account, but I doubt this is related to your issue. You used to be able to do an at /interactive cmd.exe from an admin command prompt to get a cmd shell running under the system context. That would help isolate if it was a permission issue.

Compare the hklm\software\microsoft\windows\currentversion\uninstall (f3 search for itunes) installsource value for the path to the cached msi for both the sccm install and admin prompt install. Verify the user has access to this location for the sccm version. If there is any install on first use, or install on first run by each user the lack of access to the msi on the sccm verison will cause these errors.

 

I didn't roll 10.2.2.14 out. I'm going from 10.2.2.12 to 10.3.1.55.

[synaesthesia]

Gatt: can I ask for the reasoning behind weekly rebuilds? Is it just the obvious - clean stations, performance etc?

[Gatt]

Gatt: can I ask for the reasoning behind weekly rebuilds? Is it just the obvious - clean stations, performance etc?

yeah pretty much - we seem to have an issue where profiles aren't being unloaded properly and getting loads of username.domain.xxx folders!!

 

Anyway I gave up with these as our aging Network infrastucture couldn't cope!!

[synaesthesia]

Cheers