CHiLL

I'm creating a Task Sequence to deploy Windows 10 Education 1607 x64 along with Office 2016 Professional Plus (not click-to-run). Whilst I've created the Task Sequence to do this - I'm a little confused to how to deploy Office 2016 Software Updates. I have Software Update groups created and the ADR set up - that's not the problem. The problem is targetting specific machines with this version of Office. I understand how the OS Software Updates works - Create a device collection to target just that OS and deploy your OS Software Updates to that device collection - done. However, I don't want to target an OS device collection. I want to target only machines that have Office 2016 Professional Plus on. What is the best way to do this? With a device collection for only Office 2016 Professional Plus installations? If so, what targeting method should I use? One to look for the installation folder? WMI/WQL? Something like this? select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name, SMS_R_SYSTEM.SMSUniqueIdentifier, SMS_R_SYSTEM.ResourceDomainORWorkgroup, SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceID where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName = "Microsoft Office Professional Plus 2016" I just want to avoid our clients that don't have Office 2016 Professional Plus installed to download and attempt to process these updates.

Cheers for the replies so far. I'd love to go down the no alterations to the WIM route, but we need .NET 3.5 enabling on the clients. I've tried this via SCCM's Task Sequence, or deploying by script using SCCM's Software Deployment and had no luck.

I'm considering looking at a cloud-based backup store, though not entirely sure where to start. Here's some key details: We use VEEAM to backup (which is encrypted) to a SAN. This is a backup of all of our servers, including all the data/home folders/shares/etc. We also use VEEAM to perform Backup Copy Jobs of the above jobs to two other NAS devices located in separate buildings. The Backup Copy Jobs are currently storing at around the 3TB mark. Ideally I'd like to backup this 3TB of Backup Copy Jobs to an online repository that I can link into VEEAM using WAN acceleration, and to make management easier. Also ideally I'd like to ensure that this would protect us against Ranson-ware attacks, specifically ensuring that the online backups are not also targeted and encrypted, so that I can restore the data if necessary. Do any suppliers match these requirements?

We have upgraded our SCCM to 1610, the server has ADK 1610 installed and we would like to start testing Windows 10 Education 1607 x64. For this I would need to create a reference Windows 10 image that I can use as a base image to create Task Sequences around for our different hardware. I have never done this before, nor have I ever used 'sysprep' before (though I don't believe that is necessary for the later OS's), so I'm after a little advice or a good guide that I can follow that will help me through it step by step. I have followed this guide: https://www.systemcenterdudes.com/sccm-windows-10-build-and-capture-task-sequence/. However, it simply pushed Windows 10 to the VM I was using and immediately captured it. I'd like to perform some necessary changes to the OS before it is captured, such as enabling .NET 3.5 (as I've never got this to work via Task Sequence) Can anybody help?

We use VEEAM to backup our servers. At the moment, they are configured: Backup Jobs perform reverse incremental backups each night to our high capacity SAN, with the first server starting at 9pm each week night and the rest of the servers starting in a chain event from when that one completes. Backup Copy Jobs for each server runs each night to backup the backups to one of our NAS devices in another building. (NAS device limited on space) Backup Copy Jobs for each server runs each night to backup the backups to another one of our NAS devices in a another different building. (NAS device limited on space) The reason I had that configured all within VEEAM is that it keeps it all in one place, however I'm not sure how to configure what I'm after. Ideally I'd like the Backup Jobs to create monthly, quarterly and yearly full archives to the high capacity SAN...however that feature only appears to be available on Backup Copy Jobs. The reason that the Backup Copy Jobs are not configured in that way is because the target NAS devices are not large enough to store the backups and archived data too. How can I configure VEEAM so that it will store the archived data to the large SAN?

I have been doing some testing and I've managed to get our SCCM (1610) server's WOL feature to work on our clients on a different VLAN/Subnet. I enabled the features within SCCM Site Properties, using subnet-directed broadcasts and port 9, however WOL simply was not working. I've since learnt that enabling 'ip directed-broadcast' on our core switch has allowed SCCM to wake clients up across the subnets and VLANs. We have a HP 5406 Core Switch and HP 2530 edge switches. I just have a couple of questions: 1) I've read about the potential dangers of enabling 'ip directed-broadcast', including potential 'smurf attacks'. Since we are only a school environment, does this having it enabled pose that much of a risk? 2) Linked to question 1), I've read about access-lists for 'ip directed-broadcast' a) Are access lists required if question 1) is deemed too much of a security risk? b) What are the commands I would need to use to enable this? I've found the commands to limit the access list, but not to create the access list containing the valid subnets c) If we are to use access lists, would I simply need to allow the source IP/subnet/VLAN that the WOL packets are coming from, or also the destination IP/subnet/VLANs? 3) We had issues with Impero not being able to WOL across subnets/VLANs, so we had to put all our clients on the same VLAN. I've not been able to test this as of yet, and will probably be unable to for a while...could this potentially solve that issue and allow Impero to WOL machines on another subnet/VLAN? Hope that all makes sense!

From what I can tell from that article, I need to enable the following in Computer Configuration > Policies > Administrative Policies > Windows Components > Windows Updates: 1) Allow signed updates from an internet Microsoft update service location > Enabled 2) Automatic Updates detection frequency > Enabled and set to custom interval 3) Specify intranet Microsoft update service location > Enabled and define the server in both boxes (http://sccm:8530) When it mentions about Self Update, I'm not sure what that is on about or if it is referring to a specific setting.

Thanks. Do I need to remove the old WSUS GPO, which is pointing to the same server anyway?

Thanks for the updates so far! This is what I've gathered so far, it's just implementing that. So far, I've: Disabled automatic downloads in WSUS Created Software Update Groups for each of my products to include; Expired - No, Superceeded - No, Product - Windows 8.1, Update Classification - Critical, OR Update Classification - Security. Created a deployment to test groups for each product and downloaded the updates into specifically named folders on a shared folder on one of the drives available on the SCCM server. Created an ADR for monthly update checks to merge them into the existing package. Enabled Software Updates within the SCCM client. Testing so far has been successful. Question: When the ADR triggers and the package is updated - does that updated package automatically send the updates to the client, or do I have to manually deploy the package again?

Cheers for the info. I can see all the recent updates listed in SCCM, for all the products that we need. However despite having no issues with WSUS, the updates in SCCM are showing as not downloaded, despite they should have been by WSUS prior to me enabling it in SCCM. Is this normal? I have followed this guide: https://4sysops.com/archives/unifying-sccm-and-wsus-part-2-baselines-and-automatic-deployment-rules/ However, if my WSUS was configured to download updates to the F:\ drive and SCCM is also downloading the updates, but to the distribution point on E:\ drive...does that mean I'm going to have both WSUS and SCCM downloading updates, so I'm duplicating the data/download?

We have WSUS and SCCM installed on the same server, both of which were installed by a third party contractor at the same time when we upgraded our server infrastructure. The reason we were told why WSUS was used to manage updates, despite the fact that SCCM can manage updates, was because apparently SCCM's update management was problematic. I have recently updated SCCM to 1610 in order to effectively test, deploy and manage Windows 10 and Server 2016. I'm now wondering if it is worth switching to SCCM's update management now? 1) Has SCCM's update management improved and worth using instead of WSUS, or is worth sticking with just WSUS? 2) If I'm to use SCCM, how do I switch from WSUS if its located on the same server? 3) For those using SCCM, what are your experiences compared to using WSUS? Are there any other considerations I need to make?

Well, I think I've had a moment of clarity just after I posted this (isn't that always the way?). I checked the ISO of SCCM, and lone behold, an original copy of the file I'm missing. As soon as I copied that file over and started the SMS_SITE_VSS_WRITER service, it remained as 'Running', rather than stopping after a few seconds. I have just completed a manual backup of the SCCM database by starting the SMS_SITE_BACKUP service, which created the backup of ~9GB, containing both the SiteDBServer and SiteServer. I will also check tomorrow morning to ensure that the scheduled one runs too.

I've encountered an issue where our SCCM backups are not running. The 'Backup Site Server' is enabled within 'Site Maintenance', with a valid path and window of operation. smsbkup.log reads: Registered connection to SQL server SCCMSERVER and database CM_SJW. SMS_SITE_BACKUP 29/11/2016 12:56:09 21872 (0x5570) Registered connection to master database on SQL server SCCMSERVER. SMS_SITE_BACKUP 29/11/2016 12:56:09 21872 (0x5570) Initializing the status message reporting system... SMS_SITE_BACKUP 29/11/2016 12:56:09 21872 (0x5570) The path to the "Status Manager" inbox is "E:\Program Files\Microsoft Configuration Manager\inboxes\statmgr.box\statmsgs". SMS_SITE_BACKUP 29/11/2016 12:56:09 21872 (0x5570) SMS_STATUS_MANAGER is not running as part of this process, the SMS_EXECUTIVE to SMS_STATUS_MANAGER in-memory status message queue will not be used. SMS_SITE_BACKUP 29/11/2016 12:56:09 21872 (0x5570) Registered this process as a source of "SMS Server" events. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Registered this process as a source of "SMS Client" events. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Registered this process as a source of "SMS Provider" events. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Status message reporting system initialized successfully. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Locale set to OS value (English_United States.1252). SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) SMS_SITE_BACKUP service 2012 started. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) STATMSG: ID=500 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_SITE_BACKUP" SYS=SCCMSERVER SITE=SCHOOL SITE=11111 TID=21872 GMTDATE=Tue Nov 29 12:56:10.240 2016 ISTR0="SMS_SITE_BACKUP" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Starting backup - Tue Nov 29 12:56:10 2016 SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) SMS installation root directory = E:\Program Files\Microsoft Configuration Manager. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) SQL installation root directory = \\SCCMSERVER\E$\Program Files\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Site server backup location = E:\SCCM_Backups. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) SQL backup location = E:\SCCM_Backups. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Warning: Backup location and the SQL directory are on the same volume E. Sms Backup creates snapshot of the volume using VSS services and then copies the data to the backup location. It is advisable to have the backup location on a different volume than the one that has SQL database files, so that the writes to the volume is minimal when the volume snapshot is active. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Warning: Backup location and the sms root directory are on the same volume E. Sms Backup creates snapshot of the volume using VSS services and then copies the data to the backup location. It is advisable to have the backup location on a different volume than the one that has SMS data, so that the writes to the volume is minimal when the volume snapshot is active. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Verified that backup folder E:\SCCM_Backups exists. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Verified backup service has permission to access the backup folder E:\SCCM_Backups SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Sql Writer service is running. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) STATMSG: ID=5055 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_SITE_BACKUP" SYS=SCCMSERVER SITE=SCHOOL SITE=11111 TID=21872 GMTDATE=Tue Nov 29 12:56:10.251 2016 ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) LogEvent(): Successfully logged Event to NT Event Log. (4 - 48 - 1,073,746,879) SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Starting VSS initialization... SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Starting Asynchronous GatherWriterMetadata. SMS_SITE_BACKUP 29/11/2016 12:56:10 21872 (0x5570) Number of writers that responded: 16. SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) Error: SMS Writer service either does not exist or is not running . SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) STATMSG: ID=5045 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_SITE_BACKUP" SYS=SCCMSERVER SITE=SCHOOL SITE=11111 TID=21872 GMTDATE=Tue Nov 29 12:56:13.593 2016 ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) Error: GatherWriterMetadata failed. SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) STATMSG: ID=5046 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_SITE_BACKUP" SYS=SCCMSERVER SITE=SCHOOL SITE=11111 TID=21872 GMTDATE=Tue Nov 29 12:56:13.596 2016 ISTR0="" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) SMS_SITE_BACKUP failed. Please see previous errors. SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) STATMSG: ID=5060 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_SITE_BACKUP" SYS=SCCMSERVER SITE=SCHOOL SITE=11111 TID=21872 GMTDATE=Tue Nov 29 12:56:13.597 2016 ISTR0="Error: GatherWriterMetadata failed." ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) SMS_SITE_BACKUP service is stopping. SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) STATMSG: ID=502 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_SITE_BACKUP" SYS=SCCMSERVER SITE=SCHOOL SITE=11111 TID=21872 GMTDATE=Tue Nov 29 12:56:13.599 2016 ISTR0="SMS_SITE_BACKUP" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) Raised backup task failure alert. SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) SMS_SITE_BACKUP service stopped. SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) STATMSG: ID=501 SEV=I LEV=M SOURCE="SMS Server" COMP="SMS_SITE_BACKUP" SYS=SCCMSERVER SITE=SCHOOL SITE=11111 TID=21872 GMTDATE=Tue Nov 29 12:56:13.606 2016 ISTR0="SMS_SITE_BACKUP" ISTR1="" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0 SMS_SITE_BACKUP 29/11/2016 12:56:13 21872 (0x5570) After some Googling, it suggests that the SMS_SITE_VSS_WRITER service is not working correctly. So when I attempt to run the SMS_SITE_VSS_WRITER service from services.msc, it starts, then automatically stops within 10 seconds. After some more Googling of that, it suggests that there is something wrong with the SCCM backup configuration file, located in: E:\Program Files\Microsoft Configuration Manager\Inboxes\Smsbkup.box\smsbkup.ctl. After checking, it appears that we have no smsbkup.box folder at all, let alone its contents. So maybe its failing because it is unable to locate that file? Our earliest VEEAM backup also does not have this file/folder. Some people on the Internet who have had this problem said that they called Microsoft support and they simply gave them the files, however we do not have any support contract with Microsoft that would cover SCCM. Anybody have any ideas?

Unfortunately the disks that we have specifically state that we are not allowed to copy the video files from the disk.

We encountered this issue also, as RM's SafetyNet had Vimeo blocked, though we've managed to implement a workaround. We whitelisted vimeo.com within SafetyNet, meaning everyone could access Vimeo. Then we used Impero and blacklisted vimeo.com on the 'all students' group. That way the teaching staff can access it without any issues and students are still blocked from using it. We have done the same for Youtube too.

I am glad too! We do not have VMotion and I doubt we'd ever get it. For servers we want to edit or move storage, we can just arrange down-time for that.

You may be onto something, it looks like we are massively over-committed on RAM. Host one has 144GB allocated and host two has 180GB allocated, despite both having 128GB each available. I am have devised changes to be made in reduction of RAM on servers that are currently over-powered and movement of servers from one host to another to balance up the usage. Some of the servers are too critical to take down at the moment, so I will perform those changes next week during half term.

The VMWare Balloon driver is what I've found from the Googling. I've checked the host the server is on and it is not over-committed. 34GB free of 128GB. Our other host has 19GB of 128GB free.

We have our cashless catering and door access control system installed on a virtual server which has been allocated 24GB of RAM. Every few days, the server will slow down and the kitchen staff are unable to use the cashless catering system. A reboot of the virtual server will alleviate the issues, until a few days later and the same issue will happen again. Now I've looked into it and found that Task Manager says that ~75% of the RAM is in use, despite it being 10am and in the middle of lessons, so the cashless system is not in use and the door access control system is not being used much. When I sort the RAM, the highest usage application is the cashless catering at a staggering 150MB, which does not account for the 75% usage. When I open Resource Manager and use the Memory tab, 'In Use' memory is at 18.2GB, though none of the values within Resource Monitor add up to any where near this value. I have used RAMMap from Microsoft's SysInternals and that shows more of the picture. It classifies 14.5GB of RAM as being 'Driver Locked'. I could do with it not being locked! So I did some research and came across many arcticles and threads suggesting that the RAM has been increased on the virtual server, but the limit has not, so VMWare will 'lock' the memory it is allocated but unable to use. I have checked our settings, and we do not have a limit, in fact it is set as 'Unlimited'. Can anybody help shed some light on how I can free up this RAM? Thanks!

We are a Windows 8.1/Server 2012 domain, using ADFS and we can use SSO from our domain clients when using IE11 with no problems. However, I have just installed Windows 10 2016 LTSB and have another client on Windows 10 2015 LTSB and SSO does not work on either. It always prompts the user for their password, despite also using IE11. The command "dsregcmd /status" shows the machine as AzureAdJoined NO. I've checked our OU syncing, and we are only syncing the user OUs, not the workstation OUs. Do the workstation OUs need to be synced, despite it working on 8.1 without that syncing?

I'm using VAMT 3.1, which has this version number: Volume Activation Management Tool Microsoft Corporation 10.1.14393.0 I would suggest that you do indeed need to upgrade to the latest version of VAMT.

What version of VAMT are you using?

I've managed to get Windows 10 2016 LTSB and Server 2016 KMS Host keys activated using Active Directory-based Authentication within VAMT 3.1. Now my Windows 10 2016 LTSB has successfully activated! After some research, I stumbled across this Technet thread: https://social.technet.microsoft.com/Forums/en-US/6b05ee31-e6b5-4658-86d1-3015d4ecf79e/mastering-windows-10-enterprise-2016-ltsb-workgroup-kms-activation-issue?forum=win10itprosetup The important item that I found from that article was the fact that KB3172614 was required on the Server 2012 R2 KMS server. It can be downloaded here: https://support.microsoft.com/en-gb/kb/3172614. Once I installed that (requires a server reboot), I was then able to successfully add my Windows 10 2016 LTSB and Server 2016 KMS Host keys into Active Directory-based Authentication. The KMS Host Keys I installed (obtained from our VLSC) are named: Windows 10 Enterprise 2016 LTSB KMS Windows Srv 2016 DataCtr/Std KMS The following KMS Host key is required also, though most will already have it installed for previous Windows 10 KMS activations: Windows Srv 2012R2 DataCtr/Std KMS for Windows 10

I already have two Windows 10 2015 LTSB (1511) clients installed and activated using VAMT 3.1 and Active Directory-based Activation, though it appears the same keys do not work for Windows 10 2016 LTSB (1607). I have those two keys installed using VAMT 3.1, to AD activation using the newly added Windows 10 2016 LTSB KMS Host key, I receive the following error: VAMT encountered an unknown error: System.Runtime.InteropServices.COMException (0xC004F050) at Microsoft.Licensing.VolumeActivation.ActiveDirectoryWorker.RunWorkerSync() at Microsoft.Licensing.VolumeActivation.Presentation.ADForestsFormView.OnlineActivateForestThreadProc(Object job) Researching that error states that the product key is invalid, despite the VLSC support team telling me it is the correct key on numerous occasions. I also receive the exact same error whilst attempting to activate the Server 2016 KMS Host key using ADirectory Activation. The keys are copied, pasted and triple checked from our VLSC agreement. The last time I encountered this issue, I think was when trying to install the key for Office 2016, where I needed to install the Office 2016 Volume License Pack, though it appears nothing like that exists for Windows 10/Server 2016. I'm kind of stuck at the moment.

I kept IIS the same, though removed HAP website and Application Pool. I then followed the installation instructions to create a new instance, however the same problem exists. Update: I have installed IIS on a separate server and installed a fresh version of HAP onto it. Once configured, we have the exact same problem. So my issue lies somewhere else...maybe the way that HAP is attempted to authenticate users from AD? Nothing that we know of has changed and I'm not sure where to look. I've attempted to user different AD domain admin accounts during the setup of HAP, all have the same problem. Update2: We may have inadvertently solved the issue. My colleage was investigating a separate problem with another service and found that a security group was a member of a bunch of other security groups...but that those other security groups were also a member of the single security group. I think this cycle of nested groups was causing issues with both services. Once it was rectified, both services started working again.