ConfigMgr on Anything About IT

Use Microsoft Endpoint Configuration Manager to stop the Windows Print Spooler Service

Sat, 03 Jul 2021 13:23:55 +0000

Hello there,

I guess by now, everyone has heard of the Windows Print Spooler Remote Code Execution Vulnerability (CVE-2021-34527). At this time Microsoft recommends disabling the Print Spooler service on domain controllers and on servers where it is not needed or to Disable inbound remote printing through Group Policy. In this short blog post I will demonstrate how you can use Microsoft Endpoint Configuration Manager to identify systems where the print spooler service is running and how to stop and disable the service.

Extract ConfigMgr Script Status Results with PowerShell

Mon, 09 Sep 2019 18:18:44 +0000

During a recent customer engagement I had to collect the size of user profiles across a large number of devices. I was first thinking of using a script that would collect the information we need, store it into a custom WMI table and then collect the data using ConfigMgr hardware inventory, but since we only needed a one time snapshot of this information I decided against that idea. The next option would be to go old school and run the script through Group Policy processing and store the results in a central location, but hey it’s 2019, no more logon scripts please And then the idea came up to run the script on the target clients via ConfigMgr.

ConfigMgr CMPivot, the PowerShell Script, the Events

Thu, 18 Jul 2019 21:57:46 +0000

While working with CMPivot this week, I wanted to find out how locally on the client the data is collected, I already knew that when you execute a CMPivot query from the ConfigMgr console, it will run the query on the target device and returns the result back to ConfigMgr. While investigating I also came across this blog post CM Pivot Internals that describes how things work, nevertheless I wanted to dig a bit deeper. So here we go.

Monitoring Windows Defender Cloud Protection Service connectivity with ConfigMgr

Fri, 12 Jul 2019 14:30:04 +0000

Hello everyone, earlier this week I wrote a blog post how to test Microsoft Defender Cloud Protection Service (MAPS) with PowerShell. Today I would like to share a possible approach how to actively monitor MAPS Connectivity across all your devices using ConfigMgr configuration baselines.

As mentioned in my earlier blogpost in order to take full advantage of Microsoft Defender protection capabilities, it’s important that clients can communicate with MAPS, if the client cannot communicate with MAPS the client will be unable to provide near-instant, automated protection against new and emerging threats, meaning that Windows Defender will only be using the latest protection updates installed locally, depending on the strategy how you deploy these, these might be a couple of hours if not days old.

ConfigMgr Client Policy Settings - Get-CMclientpolicysettings

Sat, 04 Mar 2017 13:04:23 +0000

Here’s a function i wrote recently to retrieve the ConfigMgr Client Policy settings. To use the function you must have the System Center Configuration Manager Cmdlet library installed.

The System Center Configuration Manager Cmdlet Library

Wed, 17 Jun 2015 18:21:01 +0000

Hey there, usually when I post something I try to post something new, something that ideally hasn’t been posted before. Today, I’ll make an exception. This becasue when recently speaking to others dealing with ConfigMgr I noticed that not everyone is aware yet that back in April the ConfigMgr team released the System Center Configuation Manager CmdLet Library. So i believe it’s worth to spread the word again.

So here we go:

Get-CMTSAgentSetupInfo (Get ConfigMgr Task Sequence Agent Setup Step Info)

Sat, 04 Apr 2015 11:49:35 +0000

We recently performed an upgrade of our ConfigMgr 2012 R2 Infrastructure and due to way how we install the Agent and Agent patches, we had to update the “Setup Windows and ConfigMgr” step within a number of our Task Sequences. I therefore wrote the below Get-CMTSAgentSetupInfo.ps1 PowerShell script which dumps all the ConfigMgr Agent Setup step information from all or specified task sequences.

The script retrieves the following information:

Task Sequence Name

Installing Software using Collection Commander

Wed, 31 Dec 2014 12:25:00 +0000

In the past days I had to provision a number of clients for testing purposes. A specific set of software also needed to be installed on these clients. At our company when deploying software to computers, the deployment for none mandatory software is always set to “Available” so that users can choose themselves when to install the software via the Software Center.

I did not want to logon to each machine and initiate the installation manually nor did i want to create a separate “required” deployment to install the software on these systems. Instead I wrote a few lines of PowerShell code and triggered them using collection commander. I must admit its a bit of a quick and dirty approach but it did the job in just a few minutes.

How to solve “The RPC server is unavailable” when loading the ConfigMgr PowerShell Module

Wed, 29 Oct 2014 17:03:43 +0000

Since a few weeks, I received the below error message when importing the ConfigMgr module in PowerShell, but everything I ran afterwards worked fine, so I kept ignoring it for a while.

But now it was about time to get rid of this annoying message. My friend Claude Henchoz gave me a hint a while ago that helped me solve the issue. Looking at the error message more closely, I noticed the name of our old meanwhile decommissioned POC environment for ConfigMgr 2012 R2.

ToolTip: Collection Commander

Fri, 24 Oct 2014 14:34:05 +0000

Collection Commander

Hey there, today I’d like to talk about an awesome tool called Collection Commander. If you’re working with Microsoft System Center Configuration Manager you probably know Client Center. Now Client Center is also a very cool tool, but it only allows you to work on one client. Collection Commander allows you to do things on multiple clients at the same time. Oh and before I forget, Collection Commander is created by System Center MVP Roger Zander, the same guy who creates Client Center. Just in case you are not using System Center Configuration Manager, don’t walk away. While Collection Commander plays nicely with the System Center Configuration Manager Console, it also works without it.

Use PowerShell to find all collections where the specified device has a membership

Tue, 14 Oct 2014 18:44:28 +0000

Yesterday I deployed a computer with ConfigMgr and then wondered why it got certain software installed. And so another script was born.

The Get-CMCollectionOfDevice command retrieves all collections where the specified device has a membership

The Script can be downloaded from here

<#
.SYNOPSIS
 Get-CMCollectionOfDevice retrieves all collections where the specified device has a membership

.DESCRIPTION
 The Get-CMCollectionOfDevice retrieves all collections where the specified device has a membership

.PARAMETER Computer
 The name of the computer device

 Example: Client01

.PARAMETER SiteCode
 The Configuration Manager Site Code

 Example: PRI

.PARAMETER SiteServer
 The computer name of the Configuration Manager Site Server

 Example: Contoso-01

.EXAMPLE
 Get-CMCollectionOfDevice -Computer Client01

 CollectionID Name Commnent LastRefreshTime 
 ------------ ---- -------- --------------- 
 SMS00001 All Systems All Systems 14.10.2014 14:25:57 
 SMSDM003 All Desktop and Server Cli... All Desktop and Server Cli... 14.10.2014 14:30:02 
 PR100011 ALL Contoso Workstation Lim. Limiting collection used f... 14.10.2014 16:37:53 
 PR100014 Zurich Location Zuerich 14.10.2014 14:45:53 

 The above command lists all collections where computer Client01 is a member of. The default
 parameter values for SiteCode and SiteServer defined in the script are used. 

.EXAMPLE
 Get-CMCollectionOfDevice -Computer Client01 -SiteCode PRI -SiteServer Contoso-01
 
 The above command lists all collections where computer Client01 is a member of within the
 Configuration Manager site PRI connecting to Site Server Contoso-01

.NOTES
 Version 1.0 , Alex Verboon
 Credits to Kaido Järvemets and David O'Brien for the code snippets
#>

function Get-CMCollectionOfDevice
{
 [CmdletBinding()]
 [OutputType([int])]
 Param
 (
 # Computername
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=0)]
 [String]$Computer,

 # ConfigMgr SiteCode
 [Parameter(Mandatory=$false,
 ValueFromPipelineByPropertyName=$true,
 Position=1)]
 [String]$SiteCode = "PRI",

 # ConfigMgr SiteServer
 [Parameter(Mandatory=$false,
 ValueFromPipelineByPropertyName=$true,
 Position=2)]
 [String]$SiteServer = "contoso-01.corp.com"
 )
Begin
{
 [string] $Namespace = "root\SMS\site_$SiteCode"
}

Process
{
 $si=1
 Write-Progress -Activity "Retrieving ResourceID for computer $computer" -Status "Retrieving data" 
 $ResIDQuery = Get-WmiObject -ComputerName $SiteServer -Namespace $Namespace -Class "SMS_R_SYSTEM" -Filter "Name='$Computer'"
 
 If ([string]::IsNullOrEmpty($ResIDQuery))
 {
 Write-Output "System $Computer does not exist in Site $SiteCode"
 }
 Else
 {
 $Collections = (Get-WmiObject -ComputerName $SiteServer -Class sms_fullcollectionmembership -Namespace $Namespace -Filter "ResourceID = '$($ResIDQuery.ResourceId)'")
 $colcount = $Collections.Count
 
 $devicecollections = @()
 ForEach ($res in $collections)
 {
 $colid = $res.CollectionID
 Write-Progress -Activity "Processing $si / $colcount" -Status "Retrieving Collection data" -PercentComplete (($si / $colcount) * 100)

 $collectioninfo = Get-WmiObject -ComputerName $SiteServer -Namespace $Namespace -Class "SMS_Collection" -Filter "CollectionID='$colid'"
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "CollectionID" -Value $collectioninfo.CollectionID
 $object | Add-Member -MemberType NoteProperty -Name "Name" -Value $collectioninfo.Name
 $object | Add-Member -MemberType NoteProperty -Name "Commnent" -Value $collectioninfo.Comment
 $object | Add-Member -MemberType NoteProperty -Name "LastRefreshTime" -Value ([Management.ManagementDateTimeConverter]::ToDateTime($collectioninfo.LastRefreshTime))
 $devicecollections += $object
 $si++
 }
} # end check system exists
}

End
{
 $devicecollections
}
}

How to identify ConfigMgr collections that take long to refresh

Sat, 30 Aug 2014 09:54:14 +0000

I’ve put together the below PowerShell script this week to identify collections in ConfigMgr that require the longest time to refresh. If you ever experience a decrease in ConfigMgr collection update performance, you might want to run this script to find potential collections that have a long refresh duration.

Function Get-CMCollectionRefreshDuration
{
<#
.Synopsis
 Get-CMCollectionRefreshDuration displays the duration of Configuration Manager refresh cycles
.DESCRIPTION
 Inefficient queries can cause long collection refresh cycles. Use the Get-CMCollectionRefreshDuration
 cmdlet to identify collections with long refresh cycles. 
.EXAMPLE
 Get-CMCollectionRefreshDuration -DataSource sqlsrv01\instance1 -Database CM_DB1

 Collection EvaluationStartTime LastRefreshTime Duration
 ---------- ------------------- --------------- --------
 Collection1 30.08.2014 09:20:11 30.08.2014 09:22:45 00:02:33
 Collection2 30.08.2014 09:27:31 30.08.2014 09:30:05 00:02:33
 Collection3 30.08.2014 07:01:23 30.08.2014 07:03:56 00:02:33
 Collection4 30.08.2014 07:20:38 30.08.2014 07:23:11 00:02:33
 Collection5 30.08.2014 07:05:00 30.08.2014 07:07:33 00:02:33 

.EXAMPLE
 Get-CMCollectionRefreshDuration -DataSource sqlsrv01\instance1 -Database CM_DB1 -ShowTopCollections 100

 Lists the top 100 collections
.PARAMETER DataSource
 The name of the SQL Server that hosts the configuration manager database

 <servername\instance>

.PARAMETER Database
 The database name of the configuration manager database

.PARAMETER ShowTopCollections
 The number of collections to show that have the longers collection refresh cycle duration

#>
 [CmdletBinding()]
 Param
 (
 [Parameter(Mandatory=$false,
 Position=0,
 HelpMessage="Enter the SQL Server datasource name <server\instance>")]
 [string]$DataSource="server01\instance1",
 [Parameter(Mandatory=$false,
 Position=1,
 HelpMessage="The database name of the ConfigMgr database")]
 [string]$Database="CMDB1",
 [Parameter(Mandatory=$false,
 Position=2,
 HelpMessage="The number of top collectons to show")]
 [ValidateRange(1,10000)]
 [int]$ShowTopCollections="5" 
 )

Begin{
 # connecting to SQL server
 Try{
 $Connection = New-Object System.Data.SqlClient.SqlConnection
 $Connection.ConnectionString = "Data Source=$DataSource;Integrated Security=True"
 $Connection.Open()
 }
 Catch [Exception]
 {
 write-output "Unable to connect to $DataSource"
 Write-Output $_.Exception
 Throw
 }
 $query = "
 SELECT TOP $ShowTopCollections
 [CollectionName],
 [EvaluationStartTime],
 [LastRefreshTime],
 CAST([LastRefreshTime] - [EvaluationStartTime] as datetime) as Duration
 FROM [$Database].[dbo].[Collections]
 ORDER BY CAST([LastRefreshTime] - [EvaluationStartTime] as datetime) DESC"

 $command = $connection.CreateCommand()
 $command.CommandText = $query
 $result = $command.ExecuteReader()

 $table = new-object “System.Data.DataTable”
 $table.Load($result)
 $Connection.Close()
}

Process{
 $colupdateduration = @()
 ForEach($cud in $table)
 {
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "Collection" -Value $cud.Collectionname
 $object | Add-Member -MemberType NoteProperty -Name "EvaluationStartTime" -Value $cud.EvaluationStartTime
 $object | Add-Member -MemberType NoteProperty -Name "LastRefreshTime" -Value $cud.LastRefreshTime
 $object | Add-Member -MemberType NoteProperty -Name "Duration" -Value ($dur = Get-date $cud.Duration -Format "HH:mm:ss")
 $colupdateduration += $object
 }
}

End{
 $colupdateduration
 }
}

Thanks to Roger Zander and Claude Henchoz for the SQL query to find these collections.

PowerShell Script - Get-CMInstalledSoftware

Fri, 08 Aug 2014 19:23:05 +0000

ConfigMgr 2012 comes with a lot of build-in reports, but often it just does not contain all the information I want. Creating a custom report takes more time than just writing a script.

The Get-CMInstalledSoftware script retrieves all computers that have the specified software installed. Like it? Get your copy of the script from here

<#
.Synopsis
 Get all computers that have the specified software installed
.DESCRIPTION
 Get-CMInstalledSoftware retrieves all computers where the specified software is installed on. 
 The function queries SMS_G_System_INSTALLED_SOFTWARE which contains both 32 and 64 bit software
 installations.

 The following information is collected
 
 Computername,OperatingSystemNameandVersion InstallDate, InstalledLocation, Productname, ProductVersion
 Publisher, UninstallString

.EXAMPLE
 Get-CMInstalledSoftware -ProductName "Client Center for Configuration Manager%"

 Computername : Client01
 OperatingSystemNameandVersion : Microsoft Windows NT Workstation 6.1
 Productname : Client Center for Configuration Manager 2012
 ProductVersion : 1.0.1.0
 Publisher : Zander Tools
 InstallDate : Friday, 1. August 2014 00:00:00
 InstalledLocation : C:\Program Files\Client Center for Configuration Manager 2012\
 UninstallString : MsiExec.exe /X{B299EE26-A664-42A2-8D4E-6BF005EB5E75}

.PARAMETER -ProductName
 The Name of the Software. Use % before or after the productname as a wildcard. 
 
#>

Function Get-CMInstalledSoftware
{
 [CmdletBinding()]
 [OutputType([int])]
 Param
 (
 # Software Product Name
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=0)]
 $ProductName,

 [Parameter(Mandatory=$false,
 ValueFromPipelineByPropertyName=$true,
 Position=1)]
 $SiteCode = "SR1",

 [Parameter(Mandatory=$false,
 ValueFromPipelineByPropertyName=$true,
 Position=2)]
 $SiteServer = "chrv0300.corp.gwpnet.com"
 )

Begin
{
 [string] $Namespace = "root\SMS\site_$SiteCode"
}

Process
{
 $arsw = Get-WmiObject -Namespace $Namespace -ComputerName $SiteServer -Query "SELECT * FROM SMS_G_System_INSTALLED_SOFTWARE where ProductName like '$ProductName'" # and ProductVersion = '11.0.61030.0'"
 $clientswithsw = @()

 ForEach ($res in $arsw)
 {
 $CMResource = (Get-WmiObject -Namespace $Namespace -ComputerName $SiteServer -Query "SELECT Name, ResourceID,Active, SMSUniqueIdentifier,OperatingSystemNameandVersion FROM SMS_R_SYSTEM WHERE ResourceID = '$($res.ResourceID)'")

 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "Computername" -Value $cmresource.Name
 $object | Add-Member -MemberType NoteProperty -Name "OperatingSystemNameandVersion" -Value $cmresource.OperatingSystemNameandVersion
 $object | Add-Member -MemberType NoteProperty -Name "Productname" -Value $res.ProductName
 $object | Add-Member -MemberType NoteProperty -Name "ProductVersion" -Value $res.ProductVersion
 $object | Add-Member -MemberType NoteProperty -Name "Publisher" -Value $res.Publisher
 $object | Add-Member -MemberType NoteProperty -Name "InstallDate" -Value ([Management.ManagementDateTimeConverter]::ToDateTime($res.InstallDate).DateTime)
 $object | Add-Member -MemberType NoteProperty -Name "InstalledLocation" -Value $res.InstalledLocation
 $object | Add-Member -MemberType NoteProperty -Name "UninstallString" -Value $res.UninstallString

 $clientswithsw += $object
 }
}

End
{
 $clientswithsw
}
}

ConfigMgr - How to find the Application Name for a ContentID

Tue, 03 Jun 2014 21:51:08 +0000

While reviewing ConfigMgr status messages for clients reporting problems acquiring package content (Message ID 10025) I found some code snippets on sccmfaq.ch that maps the ContentID to the name of the application. As i had to do several lookups, I decided to create a function for it.

function Get-xCMContentIDforApp
{
<#
.Synopsis
 Get-xCMContentIDforApp
.DESCRIPTION
 This function retrieves the Application name for the provided ContentID. 
 Use this when analyzing status messages (10025) for clients reporting problems
 acquiring package content 

.EXAMPLE
 Get-xCMContentIDforApp -SiteServer cmsrv01 -SiteCode lab -ContentID Content_4783c44a-3f5c-4bf3-a130-a89e5520173a, Content_1d336090-12e4-445b-9c15-718ee5ddf40a

 Application ContentID 
 ----------- --------- 
 Mozilla Firefox_SW10012130 Content_4783c44a-3f5c-4bf3-a130-a89e5520173a 
 Microsoft Excel 2010 x64_SW10011686_V Content_1d336090-12e4-445b-9c15-718ee5ddf40a 

 The above example retrieves the Application name for each contentID provided. 

.NOTES
 Credits to sccmfaq.ch where i found the code snippets
#http://sccmfaq.wordpress.com/2014/03/11/sccm-2012-get-from-content-id-to-the-name-of-an-application-with-powershell/
 Version 1.0 by Alex Verboon
#>

[CmdletBinding(SupportsShouldProcess=$true)]
 Param
 (
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=0)]
 $SiteServer,
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=1)]
 $SiteCode,
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=2)]
 [string[]]$ContentID
 )

Begin{}
Process
{
 $CIDApps = @()

 ForEach ($cid in $ContentID)
 {

 If ($PScmdlet.ShouldProcess("Retrieving Application Name for $cid"))
 {
 $ContenId01 = (("$cid").Split("."))[0]
 $ApplicationID = (Get-WmiObject -Namespace root\sms\site_$SiteCode -ComputerName $SiteServer -Class SMS_Deploymenttype -Filter "ContentID = '$ContenId01' and PriorityInLatestApp = '1'").AppModelName
 $App = (Get-WmiObject -Namespace root\sms\site_$SiteCode -ComputerName $SiteServer -Class SMS_Application -Filter "CI_UniqueID like '$ApplicationID%' and IsLatest = 'True'").LocalizedDisplayName

 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "Application" -Value $App
 $object | Add-Member -MemberType NoteProperty -Name "ContentID" -Value $cid
 $CIDApps += $object
 }
 }
}
End
{
 $CIDApps | Select-Object Application, ContentID 
}
}

ConfigMgr - PowerShell Script to list Image Binary Delta Replication Setting

Sun, 18 May 2014 22:15:09 +0000

Here’s a script that lists all Boot and Operating system images stored within Configuration Manager and shows whether the Binary Delta Replication Setting is enabled or not.

<#
.Synopsis
 List Binary Delta Replication Setting for ConfigMgr Boot and Operating System images
.DESCRIPTION
 This cmdlet Lists ConfigMgr the Boot image and Operating System image Binary Delta Replication Setting
.EXAMPLE

.EXAMPLE
 Another example of how to use this cmdlet
.NOTES
 #http://msdn.microsoft.com/en-us/library/hh948196.aspx
 Version 1.0 by Alex Verboon

#>
function Get-CMImgBDRSetting
{
 [CmdletBinding()]
 Param
 (
 # Param1 help description
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=0)]
 $SiteCode,
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 Position=1)]
 $SiteServer
 )

 Begin
 {
 [string] $Namespace = "root\SMS\site_$SiteCode"
 $allImages = Get-WmiObject -Namespace $Namespace -ComputerName $SiteServer -Query "SELECT Name, Description, Version,PkgFlags, PackageType FROM SMS_PackageBaseclass Where PackageType = '258' OR PackageType = '257' "
 $USE_BINARY_DELTA_REP = "0x04000000"
 }
 Process
 {
 $bdr_images = @()
 ForEach ($img in $allImages)
 {
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "Name" -Value $img.Name
 $object | Add-Member -MemberType NoteProperty -Name "Version" -Value $img.Version
 $object | Add-Member -MemberType NoteProperty -Name "Description" -Value $img.Description
 $object | Add-Member -MemberType NoteProperty -Name "Binary_Delta_Rep" -Value ($ubdr = if($img.PkgFlags -band $USE_BINARY_DELTA_REP) {"Enabled"} Else {"Disabled"})
 $bdr_images += $object
 }
 }
 End
 {
 $bdr_images | Sort-Object Name
 }
}

Good to know: System Center 2012 Configuration Pack for Microsoft User Experience Virtualization

Tue, 14 Jan 2014 20:59:28 +0000

Based on a conversation I had yesterday at the ConfigMgr Community event here , it appears that few people know about the existance of the ConfigMgr pack for Microsoft UE-V. There’s one for UE-V version 1.0 and just a few weeks ago one for UE-V 2.0 was released.

After Microsoft User Experience Virtualization (UE-V) and its required components are installed, UE-V must be configured. This UE-V Configuration Pack provides a way for administrators to use the Compliance Settings feature of System Center Configuration Manager 2012 SP1 to apply consistent configuration across sites where UE-V is installed. The UE-V Configuration Pack for UE-V 2.0 provides tools to do the following: The UE-V Configuration Pack provides tools to do the following: 1. Create UE-V template distribution baselines. a. Defines UE-V templates to be registered or unregistered b. Updates UE-V template configuration items and baselines as templates are added or updated. c. Distribute and register UE-V templates using standard Configuration Item remediation

PowerShell - Finding ConfigMgr Collections and Members

Wed, 08 Jan 2014 00:42:00 +0000

The below script provides a simple and quick method to find ConfigMgr Collections and its members. The script has a -Name parameter that accepts the exact or part of the collection name. Next all collections that match the name are listed. After selecting a collection, its members are listed.

Function Get-CMColContent()
{
<#
.Synopsis
 Get Configuration Manager Collections and Members
.DESCRIPTION
 This script provides an interactive way to find collections and collection members within 
 Configuration Manager. 
.PARAMETER Name
 The exact or partial collection name. 
.EXAMPLE
 Get-CMColContent -Name All
#>

 Param(
 [Parameter(Mandatory=$true,
 ValueFromPipelineByPropertyName=$true,
 HelpMessage="Enter Collection Name or part of collection Name",
 Position=0)]
 [String]$Name
 )

# Change Site Server Name and Site code so it fits your environment
[string] $SiteServer = "servername"
[string] $SiteCode = "010"
[string] $Namespace = "root\SMS\site_$SiteCode"

$CollectionItem = Get-WmiObject -Namespace $Namespace -ComputerName $SiteServer -Query "SELECT Name,LimitToCollectionName,MemberClassName, MemberCount, CollectionType FROM SMS_Collection WHERE Name LIKE '%$Name%'" | Select-Object Name,LimitToCollectionName,MemberClassName, MemberCount, CollectionType, ResourceID | Sort-Object CollectionType| Out-GridView -Title "Collections" -OutputMode Single

$CollectionType = $CollectionItem.CollectionType
$CollectionName = $CollectionItem.Name
$MemberClassName = $CollectionItem.MemberClassName

If ($CollectionType -eq 2) # Computer collections
 {
 Write-Output "Please wait, this can take a while..."
 $colcontent = Get-WmiObject -Namespace $Namespace -ComputerName $SiteServer -Query "SELECT Name, Active, OperatingSystemNameandVersion, ResourceID FROM SMS_R_SYSTEM where ResourceID in (Select ResourceID from $MemberClassName)" | Select-Object Name, Active, OperatingSystemNameandVersion -wait | Sort-Object Name 
 $colcontent = $colcontent | Out-GridView -Title "Collection: $CollectionName Member Class: $MemberClassName" -OutputMode Multiple
 #return $colcontent
 }
Elseif ($CollectionType -eq 1) # User Collections 
 {
 Write-Output "Please wait, this can take a while..."
 $colcontent = Get-WmiObject -Namespace $Namespace -ComputerName $SiteServer -Query "SELECT UserName, UserPrincipalName, ResourceID FROM SMS_R_USER where ResourceID in (Select ResourceID from $MemberClassName)" | Select-Object Username, UserPrincipalName, ResourceID -wait
 $colcontent = $colcontent | Out-GridView -Title "Collection: $CollectionName Member Class: $MemberClassName" -OutputMode Multiple 
 #return $colcontent
 }
Else
 {
 Write-output "No support for other Collection Type $Collectiontype"
 }

return $colcontent
}

Example:

ConfigMgr OSD - Enable .NET Framework 3.5 on Windows 8.1

Sat, 14 Dec 2013 01:17:13 +0000

Windows 8.1 has the .NET Framework 4.5.1 enabled by default. If you need .NET Framework 3.5 which also includes support for .NET 3.0, and 2.0, then you must enable the feature as it is not enabled by default.However to enable it you need access to the content of the Sources\SXS folder that resides on the Windows 8.1 installation media. More details are described in the MSDN article Installing the .NET Framework 3.5 on Windows 8 or 8.1

ConfigMgr PowerShell Script to check if Application or Program is allowed to run in TS without being deployed

Thu, 07 Nov 2013 23:54:46 +0000

Kind of a long title for a blog post, but I could not come up with something shorter to describe the content of this blog post. The below script shows the status of the “Allow this Application / program to be installed from the Application / program install task sequence action without being deployed” setting.

<#
.Synopsis
 Get Application and Package - Program information regarding Task Sequence support
.DESCRIPTION
 The script checks all applications and packages if they are allowed to be installed from a TS without being deployed
.EXAMPLE
 Get-TSInstallEnabled -Site Lab
.NOTES
 Version 1.0
 Written by Alex Verboon
#>

[CmdletBinding()]

param( 
 # ConfigMgr Site
 [Parameter(Mandatory = $true, ValueFromPipeline=$true)]
 [String[]] $Site
 )

if ($Site.Length -eq 0)
 { 
 Throw "ConfigMgr Site code required"
 } 
Else
 {
 $SiteCode = $Site
 }

function Get-TSInstallEnabled ()
{

# Check that youre not running X64
if ([Environment]::Is64BitProcess -eq $True)
 { 
 Throw "Need to run at a X86 PowershellPrompt"
 } 
# Load ConfigMgr module if it isn't loaded already
if (-not(Get-Module -name ConfigurationManager))
 { 
 Import-Module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')
 } 
 
# Change to site
Push-Location
Set-Location ${SiteCode}:

 function Get-AppTSInfo()
 {
 $Apps = @() 
 foreach ($Application in Get-CMApplication)
 {
 $AppMgmt = ([xml][/xml]$Application.SDMPackageXML).AppMgmtDigest
 $AppName = $AppMgmt.Application.DisplayInfo.FirstChild.Title
 $AllowTs = $AppMgmt.Application.AutoInstall
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "Application Name" -Value $Appname

 if ($AllowTs -ne "true") {$AllowTs = "false"}

 $object | Add-Member -MemberType NoteProperty -Name "Allowed TS Install" -Value $AllowTs
 $Apps += $object
 }
 $Apps 
 }

 Function Get-PackageTSInfo()
 {
 $Progs = @() 
 foreach ($Prog in Get-CMProgram)
 {
 $ProgName = $Prog.ProgramName
 $PackageName = $prog.PackageName
 $AllowTs = $Prog.ProgramFlags -band [math]::pow(0,0)
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name "Program Name" -Value $ProgName
 $object | Add-Member -MemberType NoteProperty -Name "Package Name" -value $Packagename

 if ($AllowTs -ne "1") {$AllowTs = "false"} Else {$AllowTs = "true"}

 $object | Add-Member -MemberType NoteProperty -Name "Allowed TS Install" -Value $AllowTs
 $Progs += $object
 }
 $progs 
}

Get-AppTSInfo | Format-Table -AutoSize 
Get-PackageTSInfo | Format-Table -AutoSize 
Pop-Location
}

Get-TSInstallEnabled

Additional Information

PowerShell Script to detect ConfigMgr Task Sequence unfriendly Software Updates

Tue, 05 Nov 2013 23:58:55 +0000

Update: 15 Une 2014 - Added KB2965788

If you’re dealing with ConfigMgr and OS Deployment task sequences you’re probably aware of the KB article recently published by Microsoft called “Task sequence fails in Configuration Manager if software updates require multiple restarts”.

Let’s hope the list of KBs causing this issue isn’t going to grow too much over time, in any case we’ve decided that we would continue to review the article whenever we add new patches to our infrastructure. To simplify the task of checking whether one of the affected KBs has slipped into a software update group, I created the below script.

ConfigMgr - PowerShell Script to collect remote log files

Sun, 13 Oct 2013 14:35:41 +0000

Looking at a client’s ConfigMgr Agent log files is inevitable when managing a Configuration Manager infrastructure. If you are working within a local area network only, then you will most likely just connect to the remote systems configuration manager log folder and drag and drop the appropriate log files into CMTrace.exe. But if your clients are distributed across a WAN network with slow network links opening the log file from a remote location is probably not the most efficient way for analyzing the log files content. And because troubleshooting typically requires looking at multiple log files you finally end up copying multiple log files or just the whole log folder to your client to open them locally.

ConfigMgr–Failed to get following optional attributes warning in adsysdis.log

Wed, 09 Oct 2013 16:27:57 +0000

Should you ever get a warning message in your adsysdis.log that starts with

WARN: Failed to get following optional attributes

then you have probably added an additional active directory object attribute to your Active Directory System Discovery but the value of that attribute of the discovered object is empty.

Let’s look at this in more detail. Within the configuration manager console under Administration \ Hierarchy Configuration \ Discovery Methods \ Active Directory System Discovery the Active Directory computer object property “company” was added.

ConfigMgr–Compliance Baseline for BranchCache on Windows 8

Tue, 08 Oct 2013 14:14:03 +0000

Here’s a ConfigMgr Compliance baseline that checks the BranchCache configuration on Windows 8 clients. With the release of Windows 8 and Server 2012 Microsoft also made available PowerShell cmdlets for BranchCache, so creating a script based configuration item in ConfigMgr becomes a pretty straight forward task.

The below Compliance Baseline checks the following 3 things.

Is BranchCache Enabled
Is the Service Running
Is BranchCache operating in Distributed Cache mode

The following PowerShell commands are included within the configuration items.

List ConfigMgr Software Update Group members with PowerShell

Sun, 22 Sep 2013 20:47:18 +0000

The below script allows you to select a Configuration Manager software update group and then lists the software updates that are assigned to it.

<#
.Synopsis
 Lists assigned software updates in a configuration manager 2012 software update group
.DESCRIPTION
 Lists all assigned software updates in a configuration manager 2012 software update group that is selected 
 from the list of available update groups or provided as a command line option
.EXAMPLE
 Get-UpdateGroupcontent.ps1
.EXAMPLE
 Get-UpdateGroupcontent.ps1 -UpdateGroup "Win7x64_12_11_15"

#>

[CmdletBinding()]

param(

 # Software Update Group
 [Parameter(Mandatory = $false, ValueFromPipeline=$true)]
 [String] $UpdateGroup
 )

$SiteCode = "POC"

Function Get-UpdateGroupcontent
{

# Check that youre not running X64
if ([Environment]::Is64BitProcess -eq $True) 
 { Throw "Need to run at a X86 PowershellPrompt"
 }

# Load ConfigMgr module if it isn't loaded already
if (-not(Get-Module -name ConfigurationManager)) {
 Import-Module ($Env:SMS_ADMIN_UI_PATH.Substring(0,$Env:SMS_ADMIN_UI_PATH.Length-5) + '\ConfigurationManager.psd1')
 }

# Change to site
 Push-Location
 Set-Location ${SiteCode}:

#Set-CMQueryResultMaximum -Maximum 5000

if ($UpdateGroup.Length -eq 0) {
 $UpdateGroup = Get-CMSoftwareUpdateGroup | Select-Object LocalizedDisplayName | Out-GridView -Title "Select the Software Update Group " -PassThru 
 }
Else
 {
 $UpdateGroup = Get-CMSoftwareUpdateGroup | Where-Object {$_.LocalizedDisplayName -like "$($UpdateGroup)"} | Select-Object LocalizedDisplayName 
}

$info = @()

ForEach ($item in $UpdateGroup)
{
 Write-host "Processing Software Update Group" $($item.LocalizedDisplayName)
 forEach ($item1 in (Get-CMSoftwareUpdate -UpdateGroupName $($item.LocalizedDisplayName)))
 {
 $object = New-Object -TypeName PSObject
 #$object | Add-Member -MemberType NoteProperty -Name UpdateGroup -Value $item.LocalizedDisplayName
 $object | Add-Member -MemberType NoteProperty -Name ArticleID -Value $item1.ArticleID
 $object | Add-Member -MemberType NoteProperty -Name BulletinID -Value $item1.BulletinID
 $object | Add-Member -MemberType NoteProperty -Name Title -Value $item1.LocalizedDisplayName
 $info += $object
 }
}

$Title = "Total assigned software updates in " + $item.LocalizedDisplayName + " = " + $info.count
$info | Out-GridView -Title "$Title"
}

# -----------------------------------------------------------------------------------------------------*
# Get the list of software updates in the selected update group
Get-UpdateGroupcontent

ConfigMgr 2012 - Troubleshooting a Software Update Package

Mon, 19 Aug 2013 18:25:42 +0000

Last week I had an issue with a Software Update package in Configuration Manager 2012 SP1 that wouldn’t update properly after i had changed it’s source location. Below a step by step description of what i did to resolve it.

The Content status of the Software Update Package called “Windows 7 Functional Updates” indicated that there was a problem with the package.

The detailed message was as following.

The folder ….\swupd$\workplace\win7upd is the root folder where all Windows 7 functional updates are stored. So i took a look into the distmgr.log on the server and noticed the below shown error message.

ConfigMgr 2012 local GPO settings

Tue, 13 Aug 2013 22:26:06 +0000

When configuring ConfigMgr 2012 client settings, notice that some of these settings result in Local Group Policy Settings being applied to the client. If you’re sure that you have not configured any other local GPOs, then a simple way to find out what settings are applied by ConfigMgr is to open the Local Group Policy Editor (gpedit.msc( and filter for configured settings.

When configuring the Background Intelligent Transfer Settings within ConfigMgr, the settings are applied into a local GPO.

ConfigMgr 2012 Script for Incremental Collection threshold

Mon, 05 Aug 2013 20:07:46 +0000

As described within the ConfigMgr 2012 Best Practices Wiki on TechNet it’s recommended to keep the number of collections with incremental updates enabled to around 200, this to prevent evaluation delays. So I thought it might be a good idea to keep an eye on collections with incremental updates enabled within our infrastructure using a PowerShell script.

The property RefreshType within the SMS_Collection WMI class defines how Configuration Manager refreshes the collection. According to the documentation on MSDN the property can have the following 3 values.

ConfigMgr 2012 Script to retrieve source path locations

Sun, 28 Jul 2013 14:16:44 +0000

Here’s a PowerShell script we recently wrote to show the source path location for all the content that we put into ConfigMgr. The Script lists all the content source paths for the following CM objects.

Applications
Driver Packages
Drivers
Boot Images
OS Images
Software Update Package Groups
Packages

The output is as shown in the example below.

before executing the script, connect to your site.

clear-host

function GetInfoPackages()
{
$xPackages = Get-CMPackage | Select-object Name, PkgSourcePath, PackageID
$info = @()
foreach ($xpack in $xPackages) 
 {
 #write-host $xpack.Name
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name Package -Value $xpack.Name
 $object | Add-Member -MemberType NoteProperty -Name SourceDir -Value $xpack.PkgSourcePath
 $object | Add-Member -MemberType NoteProperty -Name PackageID -Value $xpack.PackageID
 $info += $object
 }
$info
}

function GetInfoDriverPackage()
{
$xPackages = Get-CMDriverPackage | Select-object Name, PkgSourcePath, PackageID
$info = @()
foreach ($xpack in $xPackages) 
 {
 #write-host $xpack.Name
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name Package -Value $xpack.Name
 $object | Add-Member -MemberType NoteProperty -Name SourceDir -Value $xpack.PkgSourcePath
 $object | Add-Member -MemberType NoteProperty -Name PackageID -Value $xpack.PackageID
 $info += $object

 }
 $info
}

function GetInfoBootimage()
{
$xPackages = Get-CMBootImage | Select-object Name, PkgSourcePath, PackageID
$info = @()
foreach ($xpack in $xPackages) 
 {
 #write-host $xpack.Name
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name Package -Value $xpack.Name
 $object | Add-Member -MemberType NoteProperty -Name SourceDir -Value $xpack.PkgSourcePath
 $object | Add-Member -MemberType NoteProperty -Name PackageID -Value $xpack.PackageID
 $info += $object
 
 }
 $info
}

function GetInfoOSImage()
{
$xPackages = Get-CMOperatingSystemImage | Select-object Name, PkgSourcePath, PackageID
$info = @()
foreach ($xpack in $xPackages) 
 {
 #write-host $xpack.Name
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name Package -Value $xpack.Name
 $object | Add-Member -MemberType NoteProperty -Name SourceDir -Value $xpack.PkgSourcePath
 $object | Add-Member -MemberType NoteProperty -Name PackageID -Value $xpack.PackageID
 $info += $object
 
 }
 $info
}

function GetInfoDriver()
{
$xPackages = Get-CMDriver | Select-object LocalizedDisplayName, ContentSourcePath, PackageID
$info = @()
foreach ($xpack in $xPackages) 
 {
 #write-host $xpack.Name
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name Package -Value $xpack.LocalizedDisplayName
 $object | Add-Member -MemberType NoteProperty -Name SourceDir -Value $xpack.ContentSourcePath
 $object | Add-Member -MemberType NoteProperty -Name PackageID -Value $xpack.PackageID
 $info += $object
 
 }
 $info
}

function GetInfoSWUpdatePackage()
{
$xPackages = Get-CMSoftwareUpdateDeploymentPackage | Select-object Name, PkgSourcePath, PackageID
$info = @()
foreach ($xpack in $xPackages) 
 {
 #write-host $xpack.Name
 $object = New-Object -TypeName PSObject
 $object | Add-Member -MemberType NoteProperty -Name Package -Value $xpack.Name
 $object | Add-Member -MemberType NoteProperty -Name SourceDir -Value $xpack.PkgSourcePath
 $object | Add-Member -MemberType NoteProperty -Name PackageID -Value $xpack.PackageID
 $info += $object
 
 }
 $info
}

function GetInfoApplications {
 
 foreach ($Application in Get-CMApplication) {
 
 $AppMgmt = ([xml]$Application.SDMPackageXML).AppMgmtDigest
 $AppName = $AppMgmt.Application.DisplayInfo.FirstChild.Title

 foreach ($DeploymentType in $AppMgmt.DeploymentType) {

 # Calculate Size and convert to MB
 $size = 0
 foreach ($MyFile in $DeploymentType.Installer.Contents.Content.File) {
 $size += [int]($MyFile.GetAttribute("Size"))
 }
 $size = [math]::truncate($size/1MB)
 
 # Fill properties
 $AppData = @{ 
 AppName = $AppName
 Location = $DeploymentType.Installer.Contents.Content.Location
 DeploymentTypeName = $DeploymentType.Title.InnerText
 Technology = $DeploymentType.Installer.Technology
 ContentId = $DeploymentType.Installer.Contents.Content.ContentId
 
 SizeMB = $size
 } 

 # Create object
 $Object = New-Object PSObject -Property $AppData
 
 # Return it
 $Object
 }
 }
 }

# Get the Data

Write-host "Applications" -ForegroundColor Yellow
GetInfoApplications | select-object AppName, Location, Technology | Format-Table -AutoSize 

Write-host "Driver Packages" -ForegroundColor Yellow
GetInfoDriverPackage | Format-Table -AutoSize 

Write-host "Drivers" -ForegroundColor Yellow
GetInfoDriver | Format-Table -AutoSize

Write-host "Boot Images" -ForegroundColor Yellow
GetInfoBootimage | Format-Table -AutoSize

Write-host "OS Images" -ForegroundColor Yellow
GetInfoOSImage | Format-Table -AutoSize

Write-host "Software Update Package Groups" -ForegroundColor Yellow
GetInfoSWUpdatePackage | Format-Table -AutoSize

Write-host "Packages" -ForegroundColor Yellow
GetInfoPackages | Format-Table -AutoSize

Thanks to Claude Henchoz for helping me out with the the Applications function.

Configuration Manager - DCM Import Error

Thu, 04 Jul 2013 11:28:35 +0000

While importing a Configuration Manager Configuration Baseline within our lab infrastructure that I had previously exported from our production environment I received the following error:

“The following files could not be imported because they contain incorrect or missing configuration data:

…..CAB - The cab file references missing content or contains a circular reference”

This configuration baseline contains several configuration items, but sadly the error message doesn’t provide a clear message about which item causes a problem.

SCCM 2012 SP1 Client Settings only configurable within the Default Client Settings

Tue, 04 Jun 2013 20:14:48 +0000

While preparing and documenting the System Center Configuration Manager 2012 SP1 Client settings for our clients and servers I noticed that there are a few settings that cannot be configured within custom client settings meaning they can only be configured within the Default Settings.

The following table lists the settings I identified as only configurable within the Default Client Settings.

 **Agent** **Setting** Compliance Settings Schedule compliance evaluation Hardware Inventory Maximum custom MIF File Size in KB   Collect MIF Files Software Inventory Configure the display names for manufacturer or product Related content: [About Client Settings in Configuration Manager](http://technet.microsoft.com/en-us/library/gg682067.aspx#BKMK_Compliance)

How to install System Center 2012 Endpoint Protection on a standalone client

Sun, 24 Mar 2013 14:48:33 +0000

Suppose you have a need to deploy System Center 2012 Endpoint Protection to a number of clients that later run in standalone mode, meaning that they are not joined to a domain, can’t be managed by SCCM and operate in a network that is not connected to your corporate network.

The installation source scepinstall.exe for the System Center Endpoint Protection agent is stored within the SCCM 2012 client installation folder on the SCCM 2012 SP1 server under C:\Program Files\Microsoft Configuration Manager\Client. Within that same directory we also find the endpoint protection default policy settings stored as ep_defaultpolicy.xml, but we won’t use this , as we are going to prepare our own policy that meets our requirements for a standalone unmanaged client.

List Task Sequence Variables and Values Script

Fri, 21 Dec 2012 13:31:36 +0000

For years I have been using the following script from myITforum to list Task Sequence Environment Variables and Values

Set oTSEnv = CreateObject(“Microsoft.SMS.TSEnvironment”)
For Each oVar In oTSEnv.GetVariables
WScript.Echo oVar & “=” & oTSEnv(oVar)
Next

Because there are so many variables, the only useful way to use the script is to pipe the output into a file, then open that file and search for the variable and its value.

So I have created the created the script below that can do the following: