sonofsanta Posted July 13, 2012 Posted July 13, 2012 Just setting up SCCM2007 for the first time (need it now, will look at 2012 later) and right now, all I want to do is get FEP ready to push out to Windows 7 and I'll look at the rest of the possibilities later (although not OS deployment, contrary to the forum - FOG already does that for us). I'm guessing I can just set up a collection for all Windows 7 machines to push FEP out to, but it does have me thinking: how do you all use collections for deploying software? At the moment we only use MSIs with GPOs, and beyond an Essentials GPO for Flash, Java etc. every package gets its own GPO as they often end up being assigned rather randomly - e.g. Science have booked the tech computer room for a lesson, need package X, can I push it out in time please. I don't want to start creating a security group for every SCCM software package to replicate this, so wondered what the various approaches were. Do you just have "IT rooms" as a collection and push all IT-related software to that collection? Do you then add other rooms into that collection if you suddenly need the software elsewhere? Do you just use collections tied to AD OUs? (a lot of this comes from the fact I've forgotten everything I learnt about collections and what they actually represent, and I havenae the time to go through TechNet again this close to needing it all just working. Can I push software to multiple collections? Can computers be in multiple collectons? Will we ever find out why toast always lands butter side down? So many questions, so little time)
Theblacksheep Posted July 13, 2012 Posted July 13, 2012 In 2007 I created manual groups and directly added them. In 2012 I link to OUs, nice and simple. Computers can be in any number of collections and software can be advertised to any number of collections. 2012 is much better tighter product, highly recommend switching to this. 1
Gatt Posted July 13, 2012 Posted July 13, 2012 I create an AD group called, say, Office 2010 - then add all the PCs that I want Office 2010 to be deployed to , to that group I then create a Collection in SCCM with a query that populates that Collection with the members of the group... The rest of my Collections are created to mimic my AD layout - however in SCCM 2007 this is a manual procoess of creating collections and then a query to read the appropriate OU so that it populates with the members of the OU.. I can post screenshots and queries if needed 1
CAWJames Posted July 13, 2012 Posted July 13, 2012 You do know 2012 is available? And if you are currently licensed for System Center with SA, then you can go straight to it? James 1
5tu Posted July 13, 2012 Posted July 13, 2012 I create an AD group called, say, Office 2010 - then add all the PCs that I want Office 2010 to be deployed to , to that group I then create a Collection in SCCM with a query that populates that Collection with the members of the group... The rest of my Collections are created to mimic my AD layout - however in SCCM 2007 this is a manual procoess of creating collections and then a query to read the appropriate OU so that it populates with the members of the OU.. I can post screenshots and queries if needed I do it the same as @Gatt. Application groups in AD which individual computers and/or Location groups are members of, and Collection membership based on AD group membership. 1
Gatt Posted July 13, 2012 Posted July 13, 2012 Quick screenshot of my layout: GCS = This mimics my OUs in AD Software Deployment = All the sub collections are populated using AD groups zz_Builtin Collections = These are the standard collections that ship with SCCM - I have a VBScript that moves them to this collection so they stay tucked away.. Here's an example of my AD Group Query: select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.SystemGroupName = "GCS\\G SCCM - BGInfo" 1
sonofsanta Posted July 13, 2012 Author Posted July 13, 2012 (edited) I thought the licensing for SC2012 had switched to a per-processor license? At the moment I have the various management suites renewed annually along with the EES stuff, SysCtrSvrMgmtSteDataCtr, SysCtrCnfgMgrSvrwSQL and SysCtrSvrMgmtSteDataCtr. My renewal is due in a couple of weeks so this may be a good time to switch if I need to, mind. Also: my SCCM runs as a VM so how does the processor licensing work with that? Edited July 13, 2012 by sonofsanta
CAWJames Posted July 13, 2012 Posted July 13, 2012 The transfer of licences is one that you get a certain amount of licences of 2012 in exchange for your 2007 licences. See this document for ratios : http://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=3&ved=0CGQQFjAC&url=http%3A%2F%2Fdownload.microsoft.com%2Fdownload%2F8%2F7%2F0%2F870B5D9B-ACF1-4192-BD0A-543AF551B7AE%2FSystem%2520Center%25202012%2520Licensing%2520FAQ.pdf&ei=ri4AULyrOMHU0QXo36moBw&usg=AFQjCNGnNu3ZAOHZGzWT7jwnVjOTgafphQ&sig2=B3SN4Azl6fwBoBon1imntA
CAWJames Posted July 13, 2012 Posted July 13, 2012 And, if you log into the MS VLSC and check your licence entitlement, you should find numbers in the SC 2012 boxes, showing how many you are entitled too. As far as I know, 1 virtual machine = 1 SC2012 licence needed. James 1
sonofsanta Posted July 13, 2012 Author Posted July 13, 2012 And, if you log into the MS VLSC and check your licence entitlement, you should find numbers in the SC 2012 boxes, showing how many you are entitled too. As far as I know, 1 virtual machine = 1 SC2012 licence needed. James Servers System Center DataCenter 2012 1 Servers System Center Standard 2012 2 Hmmm... tempting. Although annoying, as I just (just!) got bl%&dy native mode working in 2007...! With 4 days of term left, I am tempted to give this a crack next Monday, and upgrade to 2012 now while the only installed agent is on a Win7 test VM.
CAWJames Posted July 13, 2012 Posted July 13, 2012 Do you actually need native mode? I was told it was more of an arse than was it was worth. Unless you need the super secret squirellynes of the full https though. James
Gatt Posted July 13, 2012 Posted July 13, 2012 I find Native mode helps with regards to Conflicting records that plagues me with Mixed Mode Getting the same fun here as they are in mixed mode, and I'm trying to convince them to go to native mode..
sonofsanta Posted July 13, 2012 Author Posted July 13, 2012 Do you actually need native mode? I was told it was more of an arse than was it was worth. Unless you need the super secret squirellynes of the full https though. James It just seemed that if something was worth doing, it was worth doing right. And it's been an occasional pain, but not overly so - although as I haven't yet started using SCCM properly yet, it may turn out that it's a massive pain and I just don't know yet.
sonofsanta Posted July 13, 2012 Author Posted July 13, 2012 I find Native mode helps with regards to Conflicting records that plagues me with Mixed Mode Getting the same fun here as they are in mixed mode, and I'm trying to convince them to go to native mode.. Are 2012's requirements for Native similar to 2007? As the PKI is all set up ready (finally, stupid SHA1 client cert requirement, CA was set higher than that) so it could potentially be as easy to set it up again Native as in Mixed.
CAWJames Posted July 13, 2012 Posted July 13, 2012 I believe the requirements are the same, when I was looking into it. But I could be wrong! James
Gatt Posted July 13, 2012 Posted July 13, 2012 Technically there is no Mixed or Native modes anymore - its all to do with HTTP and HTTPS.. What Wally Said: Native mode in ConfigMgr 2012 1
sonofsanta Posted July 13, 2012 Author Posted July 13, 2012 Technically there is no Mixed or Native modes anymore - its all to do with HTTP and HTTPS.. What Wally Said: Native mode in ConfigMgr 2012 May as well leave all clients using HTTPS then seeing as it's all in place anyway. Although I bet SCCM2012 supports SHA512 as a hashing algorithm, just to rub it in.
sparkeh Posted July 13, 2012 Posted July 13, 2012 Just to give my answer to the original question: I can't really see the point in mimicing AD structure, surely the the beauty of SCCM collections is that you aren't limited to the restrictions of AD OU (with machines being in one group only). Here is a stripped down version of my collections: Entire site --Servers --Workstations ----Desktops ------SMART machines ------Computer suite ------Year 1 machines ------Year 2 machines ----Laptops ------Teacher laptops ------SIMS laptops ------SMART laptops An AD discovery is run on a schedule and new machines are added to 'Entire site'. Most groups below are updated on a schedule by running an SQL query and machines are put in the right group based on their name. For example I name machines on the format --(optional)-, therefore a teacher laptop would be abc-tl-01, this automatically goes into the 'teacher laptop' group, abc-st-suite-01 goes into 'computer suite', abc-sr-sccm (sccm server) goes into 'servers' etc etc. Therefore when I migrated to Office 2010 I advertised the package at the 'Workstation' level and chose to apply to sub groups.
sonofsanta Posted July 16, 2012 Author Posted July 16, 2012 Just to give my answer to the original question: I can't really see the point in mimicing AD structure, surely the the beauty of SCCM collections is that you aren't limited to the restrictions of AD OU (with machines being in one group only). This is why I ask - if there's a more useful way of doing this than by AD. My OUs are organised in a proper tree structure anyway by location->department->room so it's always worked fairly well for targetting software, but SCCM seems a different way of thinking. I'm looking at 2012 this morning anyway so I'll replicate the OUs in collections for targetting IT rooms in a straightforward way (useful when hotswap machines go in and out, as well) but collections for specific packages might be worthwhile as well.
sonofsanta Posted July 17, 2012 Author Posted July 17, 2012 Right, 2012 is in, which was actually fairly painless - all the HTTPS stuff worked straight off the bat, possibly as a result of fiddling with 2k7 - and despite the Metro interface and ribbon and everything, it does seem a nicer product; the FEP integration certainly seems nicer. In 2012 I link to OUs, nice and simple. I am guessing, and I hope incorrectly, that this is a manual process still, and there's no automatic LDAP lookup to generate them?
Theblacksheep Posted July 17, 2012 Posted July 17, 2012 (edited) Right, 2012 is in, which was actually fairly painless - all the HTTPS stuff worked straight off the bat, possibly as a result of fiddling with 2k7 - and despite the Metro interface and ribbon and everything, it does seem a nicer product; the FEP integration certainly seems nicer. I am guessing, and I hope incorrectly, that this is a manual process still, and there's no automatic LDAP lookup to generate them? No but its super simple: select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.SystemOUName = "top.level/maincontainer/Computers/Laptops/TeacherLaptops" I use this to cover all teachers, then specific sub group for departments that require extra software: Art, dt,ict, maths, media. You can then just add "direct rules" for those teachers laptops that aren't in the specificed OU. Software deployed to those groups and away you go. Software Center is 100% better than the old optional deployments, allows them to install/uninstall software easy and you can provide lots of info on the software. Me likey. Edited July 17, 2012 by Theblacksheep 1
sonofsanta Posted July 17, 2012 Author Posted July 17, 2012 No but its super simple: select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.SystemOUName = "top.level/maincontainer/Computers/Laptops/TeacherLaptops" I use this to cover all teachers, then specific sub group for departments that require extra software: Art, dt,ict, maths, media. You can then just add "direct rules" for those teachers laptops that aren't in the specificed OU. Software deployed to those groups and away you go. Software Center is 100% better than the old optional deployments, allows them to install/uninstall software easy and you can provide lots of info on the software. Me likey. And just repeat that for every OU I want replicated to a collection? Again, I suspect I know the answer here, but can I create a query based collection and directly exclude some? e.g. collection for the Science OU, but exclude the S9 OU as that's the computer room and would be better off with its own collection. I imagine it doesn't work as the collection is repopulated overnight/on set schedule, but I suppose it doesn't matter if S9 is in multiple collections, either. And one last question*: the software centre, can that be restricted so that teachers can install software but not kids? Guessing this will tie into User Collections if so. *for this post
Theblacksheep Posted July 17, 2012 Posted July 17, 2012 (edited) And just repeat that for every OU I want replicated to a collection? Again, I suspect I know the answer here, but can I create a query based collection and directly exclude some? e.g. collection for the Science OU, but exclude the S9 OU as that's the computer room and would be better off with its own collection. I imagine it doesn't work as the collection is repopulated overnight/on set schedule, but I suppose it doesn't matter if S9 is in multiple collections, either. And one last question*: the software centre, can that be restricted so that teachers can install software but not kids? Guessing this will tie into User Collections if so. *for this post Yeah. IF you want them replicated. Personally I don't replicate AD, I just create deployment groups for what I'm working with. Generally 'all systems of a type' or top level OU, then something specific for room deployment (like all IT classes). You can add multiple queries to a collection and multiple direct rules to a collection. You can also exclude. I do this for 'all systems inactive' that includes all systems, but excludes 'unknown computers', 'mobile devices' and 'all systems active'. At the moment Software Center only works for admins/power users or all users. You could direct software to the user rather than the machine but you might get something for the office installed on the curricular desktop. At the moment I use a mix of optional software for teachers laptop groups and mandatory software for curricular machines (doesn't appear in software center). Hope that helps. Edited July 17, 2012 by Theblacksheep 1
sonofsanta Posted July 17, 2012 Author Posted July 17, 2012 Yeah. IF you want them replicated. Personally I don't replicate AD, I just create deployment groups for what I'm working with. Generally 'all systems of a type' or top level OU, then something specific for room deployment (like all IT classes). You can add multiple queries to a collection and multiple direct rules to a collection. You can also exclude. I do this for 'all systems inactive' that includes all systems, but excludes 'unknown computers', 'mobile devices' and 'all systems active'. At the moment Software Center only works for admins/power users or all users. You could direct software to the user rather than the machine but you might get something for the office installed on the curricular desktop. At the moment I use a mix of optional software for teachers laptop groups and mandatory software for curricular machines (doesn't appear in software center). Hope that helps. Reckon I'll replicate to an extent - big classrooms would be handy, and general departmental structure - but not worth going down to the individual classroom level where there's a single teacher PC for registers. I intend to make good use of collections of collections as well, as it'll decouple collections from the geographical nature of our OUs. Shame on the Software Centre front but I was only thinking about the times our Head of IT asks for software to be put on the tech staff room PCs anyway so I'll not lose too much sleep over it. I shudder to think what would happen if I tried to explain it to most members of staff, after all! Thanks again, best get on with my collection creation then... time for another cuppa to go with that I reckon.
TheScarfedOne Posted July 17, 2012 Posted July 17, 2012 Another one into the mix... I use AD groups, with Search Collections pointed at them... 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now