OSD Part1 done by me for PKI End >>>>Will post the next Part

This step-by-step example deployment, which uses a Windows Server 2008 certification authority (CA), contains procedures that guide you through the process of creating and deploying the public key infrastructure (PKI) certificates that Configuration Manager 2007 requires to operate in native mode. Native mode offers the highest level of security for a Configuration Manager 2007 site, and it is a requirement for Internet-based client management. For more information about native mode in Configuration Manager, see Benefits of Using Native Mode.

The procedures in this example refer to a Microsoft PKI solution, using an enterprise certification authority (CA) and certificate templates. The steps are appropriate for a test network only, as a proof of concept.

Because there is no single method of deployment for the required certificates, you will need to consult your particular PKI deployment documentation for the necessary procedures and best practices to deploy the required certificates for a production environment. For more information about the possible deployment methods, see Deploying the PKI Certificates Required for Native Mode.

Note

The use of a Microsoft PKI solution is recommended to support Configuration Manager 2007, but it is not required. Configuration Manager 2007 uses standard PKI certificates, supporting version 3 of the x.509 certificate format. If your existing PKI deployment can create, deploy, and manage the certificates that Configuration Manager 2007 requires for native mode, you can use your existing PKI infrastructure. Consult your PKI documentation for deployment details.

In This Section

This example contains the following sections, which cover creating and deploying the basic certificates that are required for a Configuration Manager 2007 site to operate in native mode for intranet connectivity:

Test Network Requirements

Overview

Deploying the Site Server Signing Certificate

Deploying the Web Server Certificate

Deploying the Client Certificate

Test Network Requirements

The example has the following requirements:

• The test network is running Active Directory Domain Services with Windows Server 2008, and it is installed as a single domain, single forest.
  
• You have a domain controller running Windows Server 2008 Enterprise Edition, which has installed on it the Active Directory Certificate Services role, and it is configured as an enterprise root certification authority (CA).
  
• You have one computer that has Windows Server 2008 (Standard Edition or Enterprise Edition) installed on it and that is designated as a member server, and you have Internet Information Services (IIS) installed on it.
  
• You have one Windows Vista client with the latest service pack installed, and this computer is configured with a computer name that comprises ASCII characters and is joined to the domain.
  
• You can log in with a root domain administrator account or an enterprise domain administrator account and use this account for all procedures in this example deployment.
  

Overview

PKI certificates must be installed prior to configuring Configuration Manager 2007 to operate in native mode. This example does not include installing and configuring Configuration Manager 2007, but it provides the steps to provision computers with the certificates they require to operate in Configuration Manager 2007 native mode.

The following table lists the three types of PKI certificates that are required and describes how they are used in a native mode Configuration Manager 2007 site:

Certificate Requirement	Certificate Description
Site server signing certificate	This certificate is installed on the server that will be the Configuration Manager 2007 site server. It is used to sign client policies.
Web server certificate	This certificate is installed on servers that will be Configuration Manager 2007 site systems, with roles such as the management point and distribution point. It is used to encrypt data and authenticate the server to clients.
Client certificate	This certificate is installed on computers that will be Configuration Manager 2007 clients, and it is installed on the management point. It is used to authenticate the client to site systems; on the management point it is used to monitor the server's operational status.

For more information about the certificates, see Certificate Requirements for Native Mode.

Follow the steps in this example to achieve the following goals:

• Provision the member server with a Configuration Manager 2007 site server signing certificate so that it can operate as a Configuration Manager 2007 site server in native mode.
  
• Provision the member server with a Web server certificate so that it can operate as a Configuration Manager 2007 site system server in native mode that can run any of these Configuration Manager site system roles: management point, distribution point, software update point, and state migration point.
  
• Provision a workstation and the member server with a client certificate so that the workstation can operate as a Configuration Manager 2007 native mode client, and so that the management point can report its status to the site server.
  

Deploying the Site Server Signing Certificate

This step has four procedures:

• Creating and Issuing the Site Server Signing Certificate Template on the Certification Authority
  
• Requesting the Site Server Signing Certificate for the Server That Will Run the Configuration Manager 2007 Site Server
  
• Approving the Site Server Signing Certificate on the Certification Authority
  
• Installing the Site Server Signing Certificate on the Server That Will Run the Configuration Manager 2007 Site Server
  

Creating and Issuing the Site Server Signing Certificate Template on the Certification Authority

To create and issue the site server signing certificate template

1. On the domain controller running the Windows Server 2008 console, click Start, click Programs, click Administrative Tools, and then click Certification Authority.

2. Expand the name of your certification authority (CA), and then click Certificate Templates.

3. Right-click Certificate Templates, and then click Manage to load the Certificates Templates Console.

4. In the results pane, right-click the entry that displays Computer in the Template Display Name column, and then click Duplicate Template.

5. In the Duplicate Template dialog box, ensure that Windows 2003 Server, Enterprise Edition is selected, and then click OK.

   Important
   Do not select Windows 2008 Server, Enterprise Edition.

6. In the Properties of New Template dialog box, on the General tab, enter a template name for the site server signing certificate template, such as ConfigMgr Site Server Signing Certificate.

7. Click the Issuance Requirements tab, and then select CA certificate manager approval.

8. Click the Subject Name tab, and then click Supply in the request.

9. Click the Extensions tab, make sure Application Policies is selected, and then click Edit.

10. In the Edit Application Policies Extension dialog box, select Client Authentication, press Shift and select Server Authentication, and then click Remove.

11. In the Edit Application Policies Extension dialog box, click Add.

12. In the Add Application Policy dialog box, select Document Signing as the only application policy, and then click OK.

13. In the Properties of New Template dialog box, you should now see listed as the description of Application policies: Document Signing.

14. Click OK, click OK to close the Properties of New Template, and then close the Certificate Templates Console.

15. In the Certification Authority console, right-click Certificate Templates, click New, and then click Certificate Template to Issue.

16. In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr Site Server Signing Certificate, and then click OK.

    Note
    If you cannot complete steps 15 or 16, check that you are using the Enterprise Edition of Windows Server 2008. Although you can configure certificate templates with Windows Server Standard Edition and Active Directory Certificate Services, you cannot deploy certificates using modified certificate templates unless you are using the Enterprise Edition of Windows Server 2008.

17. Do not close the Certification Authority console.

Requesting the Site Server Signing Certificate for the Server That Will Run the Configuration Manager 2007 Site Server

To request the site server signing certificate

1. On the member server, create a folder to contain your certificate files.

2. Open Notepad, or a similar text file of your choice. Copy and paste the following text into the file:

   [NewRequest] Subject = "CN=The site code of this site server is <site-code>" MachineKeySet = True [RequestAttributes] CertificateTemplate = ConfigMgrSiteServerSigningCertificate

3. Replace the text <site-code> with your own site code. For example, if your site code is A01, the line will become: Subject = "CN=The site code of this site server is A01".

   Important
   Both the site code and the name of the template are case sensitive. Make sure that you specify the site code exactly as it appears in the Configuration Manager console, and that you specify the site server signing certificate template exactly as it appears as the Template name (not the Template display name) in the certificate template properties.

4. Save the file with the name sitesigning.inf, and save it in the certificates folder that you created.

5. Open a command window in the certificates folder that you created, type the following command, and then press Enter:

   certreq –new sitesigning.inf sitesigning.req

6. Type the following command, and then press Enter:

   certreq –submit sitesigning.req sitesigning.cer

7. You are prompted to select the issuing CA in the Select Certification Authority dialog box. Select the CA, and then click OK. When the certificate is issued, you see RequestId: <number> displayed, where <number> is the next sequential certificate request to the issuing CA. Make a note of this number.

8. Do not close the command prompt.

Approving the Site Server Signing Certificate on the Certification Authority

To approve the site server signing certificate

1. On the domain controller, in Certification Authority, click Pending Requests.

2. In the results pane, you will see the requested certificate with the Request ID that was displayed with the last Certreq command.

3. Right-click the requested certificate, click All Tasks, and then click Issue.

4. Do not close the Certification Authority console.

Installing the Site Server Signing Certificate on the Server That Will Run the Configuration Manager 2007 Site Server

To retrieve and install the site server signing certificate

1. On the member server, in the command window, type the following command, and then press Enter:

   certreq –retrieve <number> sitesigning.cer

   For example, if the request number previously displayed was 12, type: certreq –retrieve 12 sitesigning.cer

2. You are prompted to select the issuing CA in the Select Certification Authority dialog box. Select the CA, and then click OK.

3. Type the following command, and then press Enter:

   certreq –accept sitesigning.cer

The member server is now provisioned with a Configuration Manager 2007 site server signing certificate.

Deploying the Web Server Certificate

This step has four procedures:

• Creating a Windows Security Group for the Site System Servers
  
• Creating and Issuing the Web Server Certificate Template on the Certification Authority
  
• Requesting the Web Server Certificate
  
• Configuring IIS to Use the Web Server Certificate
  

Creating a Windows Security Group for the Site System Servers (Management Point, Distribution Point, Software Update Point, State Migration Point)

To create a Windows security group for the site system server

1. On the domain controller, click Start, click Administrative Tools, and then click Active Directory Users and Computers.

2. Right-click the domain, click New, and then click Group.

3. In the New Object – Group dialog box, enter ConfigMgr IIS Servers as the Group name, and then click OK.

4. In Directory Users and Computers, right-click the group you have just created, and then click Properties.

5. Click the Members tab, and then click Add to select the member server.

   Note

   In our test environment, there is only one server to add. However, in a production environment, it is likely that various servers will host the Configuration Manager 2007 site systems that require certificates, such as the site's management point and distribution points. It is therefore good practice to assign permissions to a group and add the site systems that require the same type of certificate. Creating a security group for these servers enables you to assign permissions so that only these servers can use these certificates.

6. Click OK, and then click OK again to close the group properties dialog box.

7. Restart your member server (if running) so that it can pick up the new group membership.

Creating and Issuing the Web Server Certificate Template on the Certification Authority

To create and issue the Web server certificate template on the certification authority

1. On the domain controller, while still running the Certification Authority console, right-click Certificate Templates and click Manage to load the Certificate Templates console.

2. In the results pane, right-click the entry that displays Web Server in the column Template Display Name, and then click Duplicate Template.

3. In the Duplicate Template dialog box, ensure that Windows 2003 Server, Enterprise Edition is selected, and then click OK.

   Important
   Do not select Windows 2008 Server, Enterprise Edition.

4. In the Properties of New Template dialog box, on the General tab, enter a template name to generate the Web certificates that will be used on Configuration Manager site systems, such as ConfigMgr Web Server Certificate.

5. Click the Subject Name tab, click Build from this Active Directory information is selected, and then select one of the following for the Subject name format:

   • Common name: Select this option if you will use fully qualified domain names for site systems in Configuration Manager (required for Internet-based client management, and recommended for clients on the intranet).
     
   • Fully distinguished name: Select this option if you will not use fully qualified domain names in Configuration Manager.
     

6. Clear the option User principal name (UPN).

7. Click the Security tab, and remove the Enroll permission from the security groups Domain Admins and Enterprise Admins.

8. Click Add, enter ConfigMgr IIS Servers in the text box, and then click OK.

9. Select the Enroll permission for this group, and do not clear the Read permission.

10. Click OK, and close the Certificate Templates Console.

11. In the Certification Authority console, right-click Certificate Templates, click New, and then click Certificate Template to Issue.

12. In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr Web Server Certificate, and then click OK.

13. Do not close the Certification Authority console.

Requesting the Web Server Certificate

To request the Web server certificate

1. Restart the member server to ensure it can access the certificate template with the configured permission.

2. Click Start, click Run, and type mmc.exe. In the empty console, click File, and then click Add/Remove Snap-in.

3. In the Add or Remove Snap-ins dialog box, select Certificates from the list of Available snap-ins, and then click Add.

4. In the Certificate snap-in dialog box, select Computer account, and then click Next.

5. In the Select Computer dialog box, ensure Local computer: (the computer this console is running on) is selected, and then click Finish.

6. In the Add or Remove Snap-ins dialog box, click OK.

7. In the console, expand Certificates (Local Computer), and then click Personal.

8. Right-click Certificates, click All Tasks, and then click Request New Certificate.

9. On the Before You Begin page, click Next.

10. On the Request Certificates page, select ConfigMgr Web Server Certificate from the list of displayed certificates, and then click Enroll.

11. On the Certificates Installation Results page, wait until the certificate is installed, and then click Finish.

12. Close Certificates (Local Computer).

Configuring IIS to Use the Web Server Certificate

To configure IIS to use the Web server certificate

1. On the member server, click Start, click Programs, click Administrative Tools, and then click Internet Information Services (IIS) Manager.

2. Expand Sites, right-click Default Web Site, and then select Edit Bindings.

3. Click the https entry, and then click Edit.

4. In the Edit Site Binding dialog box, select the certificate that you requested by using the ConfigMgr Web Server Certificates template, and then click OK.

   Note

   If you are not sure which is the correct certificate, select one, and then click View. This allows you to compare the selected certificate details with the certificates that are displayed with the Certificates snap-in. For example, the Certificates snap-in displays the certificate template that was used to request the certificate. You can then compare the certificate thumbprint of the certificate that was requested with the ConfigMgr Web Server Certificates template with the certificate thumbprint of the certificate currently selected in the Edit Site Binding dialog box.

5. Click OK in the Edit Site Binding dialog box, and then click Close.

6. Close Internet Information Services (IIS) Manager.

The member server is now provisioned with a Configuration Manager 2007 Web server certificate.

Deploying the Client Certificate

This step has three procedures:

• Creating and Issuing the Workstation Authentication Certificate Template on the Certification Authority
  
• Configuring Autoenrollment of the Workstation Authentication Template Using Group Policy
  
• Automatically Enrolling the Workstation Authentication Certificate and Verifying Its Installation on Computers
  

Creating and Issuing the Workstation Authentication Certificate Template on the Certification Authority

To create and issue the Workstation Authentication certificate template on the certification authority

1. On the domain controller, while still running the Certification Authority console, right-click Certificate Templates, and then click Manage to load the Certificate Templates management console.

2. In the results pane, right-click the entry that displays Workstation Authentication in the column Template Display Name, and then click Duplicate Template.

3. In the Duplicate Template dialog box, ensure that Windows 2003 Server, Enterprise Edition is selected, and then click OK.

   Important
   Do not select Windows 2008 Server, Enterprise Edition.

4. In the Properties of New Template dialog box, on the General tab, enter a template name to generate the client certificates that will be used on Configuration Manager client computers, such as ConfigMgr Client Certificate.

5. Click the Security tab, select the Domain Computers group, and select the additional permissions of Read and Autoenroll. Do not clear Enroll.

6. Click OK and close Certificate Templates Console.

7. In the Certification Authority console, right-click Certificate Templates, click New, and then click Certificate Template to Issue.

8. In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr Client Certificate, and then click OK.

9. Close the Certification Authority console.

Configuring Autoenrollment of the Workstation Authentication Template Using Group Policy

To configure autoenrollment of the workstation authentication template using Group Policy

1. On the domain controller, click Start, click Administrative Tools, and then click Group Policy Management.

2. Navigate to your domain, right-click the domain, and then select Create a GPO in this domain, and Link it here.

   Note

   This step uses the best practice of creating a new Group Policy for custom settings rather than editing the Default Domain Policy that is installed with Active Directory Domain Services. By assigning this Group Policy at the domain level, you will apply it to all computers in the domain. However, on a production environment, you can restrict the autoenrollment so that it enrolls on only selected computers by assigning the Group Policy at an organizational unit level, or you can filter the domain Group Policy with a security group so that it applies only to the computers in the group. If you restrict autoenrollment, remember to include the server that is configured as the management point.

3. In the New GPO dialog box, enter a name for the new Group Policy, such as Autoenroll Certificates, and click OK.

4. In the results pane, on the Linked Group Policy Objects tab, right-click the new Group Policy, and then click Edit.

5. In the Group Policy Management Editor, expand Policies under Computer Configuration, and then navigate to Windows Settings / Security Settings / Public Key Policies.

6. Right-click the object type named Certificate Services Client – Auto-enrollment, and then click Properties.

7. From the Configuration Model drop-down list, select Enabled, select Renew expired certificates, update pending certificates, and remove revoked certificates, select Update certificates that use certificate templates, and then click OK.

8. Close Group Policy Management.

Automatically Enrolling the Workstation Authentication Certificate and Verifying Its Installation on Computers

To automatically enroll the workstation authentication certificate and verify its installation on the client computer

1. Restart the workstation computer, and wait a few minutes before logging on.

   Note
   Restarting a computer is the most reliable method of ensuring success with certificate autoenrollment.

2. Log on with an account that has administrative privileges.

3. In the search box, type mmc.exe., and then press Enter.

4. In the empty management console, click File, and then click Add/Remove Snap-in.

5. In the Add or Remove Snap-ins dialog box, select Certificates from the list of Available snap-ins, and then click Add.

6. In the Certificate snap-in dialog box, select Computer account, and then click Next.

7. In the Select Computer dialog box, ensure that Local computer: (the computer this console is running on) is selected, and then click Finish.

8. In the Add or Remove Snap-ins dialog box, click OK.

9. In the console, expand Certificates (Local Computer), expand Personal, and then click Certificates.

10. In the results pane, confirm that a certificate is displayed that has Client Authentication displayed in the Intended Purpose column, and that ConfigMgr Client Certificate is displayed in the Certificate Template column.

11. Close Certificates (Local Computer).

12. Repeat steps 1 through 11 for the member server to verify that the server that will be configured as the management point also has a client certificate.

The workstation and member server are now provisioned with a Configuration Manager 2007 client certificate.

Thanks,

Samuel Goldwyn  - "I don't think anyone should write their autobiography until after they're dead."

Native Mode Steps- Reference

First, make sure you really want to do this.

Choose between Native Mode and Mixed Mode
http://technet.microsoft.com/en-us/library/bb632431.aspx

Second, review the (quite detailed) checklist

Administrator Checklist: Migrating a Site to Native Mode
http://technet.microsoft.com/en-us/library/bb632727.aspx

For most installations, you will have to do the following

1. Create a custom web site

Configure Custom Web Sites for Configuration Manager Sites
http://technet.microsoft.com/en-us/library/bb693482.aspx

Configure a Configuration Manager Site to Use a Custom Web Site
http://technet.microsoft.com/en-us/library/bb693662.aspx

2. Create the necessary PKI Infrastructure

SCCM 2007 PKI with Windows Server 2003 CA
http://technet.microsoft.com/en-us/library/bb694035.aspx

SCCM 2007 PKI with Windows Server 2008 CA
http://technet.microsoft.com/en-us/library/cc872789.aspx

3. Configure a Fallback Status Point (less secure, but really useful)

Create a Fallback Status Point in Configuration Manager
http://technet.microsoft.com/en-us/library/bb680830.aspx

4. Switch to native mode

Configure the Site Server with its Site Server Signing Certificate
http://technet.microsoft.com/en-us/library/bb680769.aspx

Specify the Root Certification Authority Certificates for Operating System Deployment Clients
http://technet.microsoft.com/en-us/library/bb632596.aspx

Migrate the Site Mode from Mixed Mode to Native Mode
http://technet.microsoft.com/en-us/library/bb633152.aspx

-------------------
Thanks,

Joan Crawford  - "I, Joan Crawford, I believe in the dollar. Everything I earn, I spend."

SCCM V4 Document

http://msaadexpert.googlepages.com/SCCM_NativeMode.pdf

 

-------------------
Thanks,

Jonathan Swift  - "May you live every day of your life."

MP Error "Failed to get WebDAV settings on the machine (0x80070003)" in Windows 2008

 

 

 

<01-05-2010 08:48:45>         ======== Completed Installion of Pre Reqs for Role SMSMP ========
<01-05-2010 08:48:45> Installing the SMSMP
<01-05-2010 08:48:45> Passed OS version check.
<01-05-2010 08:48:45> IIS Service is installed.
<01-05-2010 08:48:45> checking WebDAV configuraitons
<01-05-2010 08:48:45> Failed to get WebDAV settings on the machine (0x80070003)
<01-05-2010 08:48:53> ====================================================================

 

Resolution

To install and configure WebDAV for IIS 7.0 to support management point and BITS-enabled distribution point site system computers

1. Depending on your server operating system platform, download either the x86 or x64 version of WebDAV from: http://go.microsoft.com/fwlink/?LinkId=108052.

2. Depending on which version was downloaded, run either the webdav_x86_rtw.msi or the webdav_x64_rtw.msi file to install WebDAV IIS 7.0 extensions.

3. Enable WebDAV and create an Authoring Rule, as follows:

   1. Navigate to Start / All Programs / Administrative Tools / Internet Information Services (IIS) Manager to start Internet Information Services 7 Application Server Manager. In Server Manager, select the Features node, and click Add Features to start the Add Features Wizard.
      
   2. In the Connections pane, expand the Sites node in the navigation tree, and then click Default Web Site if you are using the default Web site for the site system or SMSWEB if you are using a custom Web site for the site system.
      
   3. In the Features View, double-click WebDAV Authoring Rules.
      
   4. When the WebDAV Authoring Rules page is displayed, in the Actions pane, click Enable WebDAV.
      
   5. After WebDAV has been enabled, in the Actions pane, click Add Authoring Rule.
      
   6. In the Add Authoring Rule dialog box, under Allow access to, click All content.
      
   7. Under Allow access to this content to, click All users.
      
   8. Under Permissions, click Read, and then click OK.
      

4. Change the property behavior as follows:

   1. In the WebDAV Authoring Rules page, in the Actions pane, click WebDAV Settings.
      
   2. In the WebDAV Settings page, under Property Behavior, set Allow anonymous property queries to True.
      
   3. Set Allow Custom Properties to False.
      
   4. Set Allow property queries with infinite depth to True.
      
   5. If this is a BITS-enabled distribution point, under WebDAV Behavior, set Allow hidden files to be listed to True.
      
   6. In the Action pane, click Apply.
      

5. Close Internet Information Services (IIS) Manager.

To add Remote Differential Compression for site server and branch distribution point computers

In Server Manager, on the Features node, click Add Features to start the Add Features Wizard.

1. On the Select Features page, select Remote Differential Compression, and then click Next.

2. Complete the rest of the wizard.

3. Close Server Manager.

 

=====================================================================================

 

Issue 2:

 

 

<01-10-2010 05:20:29> Installing the SMSMP
<01-10-2010 05:20:29> Passed OS version check.
<01-10-2010 05:20:29> IIS Service is installed.
<01-10-2010 05:20:29> checking WebDAV configuraitons
<01-10-2010 05:20:30>  WebDAV settings is not setup appropriately
<01-10-2010 05:20:30>  [Allow property queries with infinite depth] should be true (false)
<01-10-2010 05:20:30>  [Allow Custom Properties] should be false (true)
<01-10-2010 05:20:30>  [Allow anonymous property queries] should be true (false)
<01-10-2010 05:20:30>  Allow [All users read access to All content] authoring rule should exist (exist)

 

I fixed the problem. The settings were setup OK but for some reason they were not been recognized by the WebDAV component. What I did was open and edit the C:\Windows\System32\inetsrv\config\schema\WEBDAV_schema.xml file. The following parameters were changed:

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
<element name="properties">
      <attribute name="allowAnonymousPropfind" type="bool" defaultValue="true" />
      <attribute name="allowInfinitePropfindDepth" type="bool" defaultValue="true" />
      <attribute name="allowCustomProperties" type="bool" defaultValue="false" />
<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

After that, I restarted the service SMS_SITE_COMPONENT_MANAGER and the log shows: "SMS Site Component Manager successfully installed this component on this site system.". I will wait to see if all components change to OK status.
-------------------
Thanks,

Mike Ditka  - "If God had wanted man to play soccer, he wouldn't have given us arms."

Windows 2008 Core Server Commands in MY LAB I Used

============================================================================================================================================

****************To rename the server Name

Default installations of Windows Server 2008 give the server a name like WIN-94CX1930EF21 or some other obscure pattern that doesn't fit into most computer infrastructures. You can change the computer name using the netdom command. Netdom (which isn't a new tool) is an easy way to change the computer name after Windows Server 2008 is installed on Core Editions. You can also use it on the full installation versions.

It's pretty straightforward to use the netdom command. For example, let's go from the default name WIN-94CX1930EF21 to a computer name of SERVER13. This is the command you would enter:

netdom renamecomputer WIN-94CX1930EF21 /Newname SERVER13

============================================================================================================================================

****************To Add the IP address

In Windows Server 2008 Core installation, the only way to setup IP Address eithe Static or DHCP is from the command line. The following procedure helps setting the IP Address from the command Line using "netsh". This procedure works in Windows Server 2008 (No core installation as well), Windows Server 2003, Windows XP, Windows Vista.

To setup Static IP Address:

From the command prompt:

1. Type

C:\Users\Administrator> netsh interface ipv4 show interfaces

Idx Met MTU State Name

- – — —- ——-

1 50 4294967295 connected Loopback Pseudo-Interface 1

10 20 1500 connected Local Area Connection

This should show the Network Connections. We are looking for the name here. On mine, I have one LAN interface and is named as "Local Area Connection"

2. To set a static IP Address type the following command

C:\Users\Administrator>netsh interface ipv4 set address name="Local Area Connect

ion" source=static address=192.168.0.5 mask=255.255.255.0 gateway=192.168.0.1

The syntax is

netsh interface ipv4 set address name="<ID>" source=static address=<StaticIP> mask=<SubnetMask> gateway=<DefaultGateway>

Where:

ID is the name of the LAN Connection

StaticIP is the static IP address that you are setting

SubnetMask is the subnet mask for the IP address

DefaultGateway is the default gateway

===========================================================================================================================================

****************TO set the DNS Servers :---

set the DNS Servers one at a time with the followind command. For each DNS server, increase the index number.

C:\Users\Administrator>netsh interface ipv4 add dnsserver name="Local Area Connection" address=192.168.0.1 index=1

C:\Users\Administrator>netsh interface ipv4 add dnsserver name="Local Area Conne

ction" address=192.168.0.10 index=2

The syntax is

netsh interface ipv4 add dnsserver name="<ID>" address=<DNSIP>index=1

Where:

ID is the name of the Network Connection

DNSIP is the IP address of your DNS server

This should do. To confirm, do an "ipconfig"

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :

Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controller

Physical Address. . . . . . . . . : 00-1D-09-D4-2C-8F

DHCP Enabled. . . . . . . . . . . : No

Autoconfiguration Enabled . . . . : Yes

IPv4 Address. . . . . . . . . . . : 192.168.0.5(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.0.1

DNS Servers . . . . . . . . . . . : 192.168.0.1

192.168.0.10

127.0.0.1

NetBIOS over Tcpip. . . . . . . . : Enabled

============================================================================================================================================

****************TO ADD INTO DOMAIN.. cALLED MYDC.COM WITH THE COMPUTER NAME DHCPSRV

netdom join dhcpsrv /domain:mydc /userd:administrator /passwordd:*

or else you can use the below

netdom join dhcpsrv /domain:mydc

　

============================================================================================================================================

-------------------
Thanks,

Mike Ditka  - "If God had wanted man to play soccer, he wouldn't have given us arms."

MSI tools

Here's Sherry Kissinger's review of MSI studio.
 
http://myitforum.com/cs2/blogs/skissinger/archive/2008/09/28/scriptlogic-msi-studio-quick-review.aspx
 
If you're looking for free ones there's a few out there that have hit the ConfigMgr list:
 
http://www.advancedinstaller.com/
 
http://www.appdeploy.com/tools/repackager/
 
http://www.scalable.com/wininstall-le
-------------------
Thanks,

Joan Crawford  - "I, Joan Crawford, I believe in the dollar. Everything I earn, I spend."

WOL:: Wake ON LAN :: Ins and Outs

With Wake On LAN feature, Configuration Manager 2007 activities can be scheduled to take place outside business hours.

1.                 Wake On LAN (WOL) benefits:

·         Achieve a higher success rate for Configuration Manager Activities.

·         Reduces the associated network traffic during business hours.

·         Conserve power by not requiring computers to be left on outside business hours.

 

2.                 Wake On LAN can be used on the following scenarios:

·         Software updates deployment with deadline:

Configuration manager 2007 Send a wake-up transmission prior to the configured deadline for a software update deployment

Wake-up packets are sent only to computers that require the software updates and have not already installed them.

·         Mandatory advertisement for software distribution or task sequence:

Configuration manager 2007 Send a wake-up transmission prior to the configured schedule of a mandatory advertisement, which can be for software distribution or a task sequence.

 

3.                 Walk On LAN overview:

·         Wake-up packet transmissions are sent only from primary site servers only.

·         The default port used by Configuration Manager 2007 to send wake-up packets to target computers is UDP port 9 and can be changed form site settings

·         Secondary site servers or other computers cannot be configured as proxies to send wake-up packets.

·         Wake-up transmissions are not sent to clients when they are on the Internet. Wake On LAN transmissions are always sent at the scheduled time.

·         Wake On LAN independently enabled or disabled for any site in the Configuration Manager 2007 hierarchy

·         Due to advertisements and software update deployments are inherited to child sites, the site server in the child site is responsible for sending the wake-up transmissions to its assigned clients if the site is enabled for Wake On LAN.

·         If Wake On LAN is disabled on a child site, child site will not send the wake-up transmissions to its assigned clients, and client computers in that site will not be sent wake-up packets.

·         ConfigMgr 2007 Client registers the system as busy for the specific wake-up task it receives, this prevents the computer from going back into a sleep state based on its power management settings before the task can complete.

·         Wake On LAN does not return computers to a sleep state and you need to configure power management schemes to shut down or hibernate after a period of inactivity.

·         Computers are woken up before the scheduled activity by 3 minutes before the scheduled activity to ensure that they have completed startup, this setting can be configured with the transmission offset option in a Wake On LAN advanced setting.

·         Mobile devices do not support Wake On LAN capability.

·         Clients running Systems Management Server (SMS) 2003 do not support Wake On LAN.

·         Wake On LAN in ConfigMgr 2007 supports waking up computers in sleep states S1 through S5

4.                 WOL transmission methods

 

·         Unicast transmission

o    Unicast transmission wake-up packet uses the IP address of the target computer from hardware inventory to route to the target computer's subnet, and it uses the Media Access Control (MAC) address of the target computer from hardware inventory to construct the wake-up packet. When the wake-up transmission reaches the target computer's subnet, the wake-up packet is sent directly to the target computer, and If the target computer has changed its IP address since it last sent its inventory information, the wake-up packet will reach the wrong computer but it will not wake it up because the MAC address in the wake-up packet transmission will not match.

o    Switches must forward UDP packets

o    Unicast transmission is secure solution than subnet-directed broadcasts because the packet is sent directly to a computer rather than to all computers on a subnet.

o    Consumes less network bandwidth than subnet-directed broadcast transmissions.

o    Unicast transmission is supported with IPv6.

 

·         Subnet-directed broadcasts

o    Subnet-directed broadcasts transmission wake-up packet uses the Media Access Control (MAC) address and IP subnet address of the target computer from hardware inventory,  The wake-up transmission is sent to the computer's last known subnet, and it is then broadcast to all computers on that subnet, and the computer that has the MAC address specified in the wake-up transmission will respond.

o    Routers must be configured to forward subnet-directed broadcasts.

o    Subnet-directed broadcasts are not supported with IPv6

5.                 Wake On LAN Prerequisites

·         Network cards must support the standard magic packet format.

·         Computers must be configured for wake-up packets on the network card and in the computer BIOS.

·         If subnet-directed broadcast configured, all routers between the site server and target computers must allow IP directed broadcasts, and support IPv4.

·         Hardware inventory must be enabled, and completed an inventory schedule.

·         Client computers must be running the Configuration Manager 2007 client. 

6.                 Sleep States for Wake On LAN

 

·         S0: The computer is on and fully functional.

·         S1: The computer appears to be off with the CPU stopped. RAM is refreshed, and the computer is running in a low power mode.

·         S2: The computer appears to be off with the CPU stopped. RAM is refreshed, and the computer is running in a lower power mode than S1.

·         S3 (Standby): The computer appears to be off with no power to the CPU. RAM is in slow refresh.

·         S4 (Hibernate):  The computer appears to be off with no power to the hardware. System memory has been saved as a temporary file on the hard disk.

·         S5 (Off):  The computer is off with no power to the hardware, and the operating system has been shut down without saving system memory to disk.

-------------------
Thanks,

Stephen Leacock  - "I detest life-insurance agents: they always argue that I shall some day die, which is not so."

Windows 7 64 bit RAM limitations

Here are the upper RAM limits for the different editions of Windows 7:

• Starter: 8GB
• Home Basic: 8GB
• Home Premium: 16GB
• Professional: 192GB
• Enterprise: 192GB
• Ultimate: 192GB

These limits are similar to those for Vista editions, expect that Vista Enterprise and Vista Ultimate have had their upper limits raised from 128GB to 192GB
-------------------
Thanks,

Joan Crawford  - "I, Joan Crawford, I believe in the dollar. Everything I earn, I spend."

windows 2003 slipstreeming

Windows Server 2003 Service Pack 2 Released!

　

Microsoft has just released Windows Server 2003 SP2, currently available for all architectures (x86, x64, & Itanium) in English and German.

New features and bug fixes

Security updates

Download Links:

Windows Server 2003 SP2 for x86

Windows Server 2003 SP2 for x64

Windows Server 2003 SP2 for IA64

Integrating the Service Pack

You can slipstream SP2 into your Windows Server 2003 CD by copying the contents of your CD to a folder on your hard-drive, and issuing the following command:

WindowsServer2003-KB914961-SP2-x86-ENU.exe /integrate:C:\W2k3\

In the example above, this is the x86 installer being used and the Windows Server 2003 CD has been copied to C:\W2k3\

After the process completes, download Microsoft Corporation.img and use it as the bootsector for your CD.

If you're using Nero, it'll look something like this:

Choose CD-ROM (Boot) from the New Compilation's Boot page.

Under Source of boot image data choose "Image file" and Browse to the Microsoft Corporation.img.

Select Enable expert settings (for advanced users only) and set the following: Kind of emulation - No Emulation
Number of loaded sectors - 4
Load segment of sectors - 07C0

-------------------
Thanks,

Mike Ditka  - "If God had wanted man to play soccer, he wouldn't have given us arms."

Vitamin’s – What to Eat

Vitamin C

 

Rapid Search

Looks this site also good for rapid search http://www.filecrop.com
-------------------
Thanks,
Paddy

Administering Windows Server 2008 Server Core Machines

Administering Windows Server 2008 Server Core Machines

Now that your machine has been more or less configured and is ready to be deployed, it's time to discuss how you go about preparing the server for installation in different scenarios. As you know from earlier in this book, Windows Server 2008 offers groups of services, and the associated software, wrapped in "roles" that correspond to the likely environments in which you will deploy a machine. On a full installation of Windows Server 2008, these roles are installed using the Server Manager MMC console. On a Server Core machine, that is obviously not possible, as the graphical shell largely doesn't exist.

There is a command-line utility called oclist that allows you to view available roles to install on a machine with Windows Server 2008 Server Core. Once you have run oclist and identified any given role name, you can use that name in conjunction with the ocsetup utility to install or uninstall that server role or optional feature.

Some sample output from oclist

Note that the DHCPServerCore role is listed as not installed. Let's say that we wanted our Server Core machine deployed as a headless, GUI-less, stripped-down DHCP server for our enterprise. To prepare the machine, we need to install the DHCP Server role. Using the name we obtained from the oclist command output, we can start the role installation process with the ocsetup command, as follows:

ocsetup DHCPServerCore 

The system will trundle for a while, and the process should complete without errors. To verify that the role installation process is complete, run oclist again and then check to see whether the DHCPServerCore role is listed as "installed."

To uninstall a role, use the following command (in our case, should we want to uninstall the DHCP Server role):

ocsetup DHCPServerCore /uninstall 

Installing Active Directory Domain Services on Server Core

One role that you would likely want to install on a Server Core machine is the domain controller role. Installation of this role on a Server Core machine is a bit different, because installing the role using ocsetup has a large dependency on the graphical shell—meaning that using that method of setup can result in a very unstable Server Core machine that thinks it's a domain controller in some ways, but in other ways it doesn't.

The only supported way to install the domain controller role on a Server Core machine is to use the dcpromo utility in unattended mode. Using unattended mode requires setting up a simple text file with some parameters that will allow dcpromo to proceed without needing to prompt the user for any information, and ultimately you will be able to successfully promote a Server Core member server to a domain controller.

You need, at a minimum, the following nine parameters in a file called unattend.txt (or anything you want, as long as you remember the name):

[DCInstall] ReplicaOrNewDomain=Domain NewDomain=Forest NewDomainDNSName=hasselltech.local AutoConfigDNS=Yes DNSDelegation=Yes DNSDelegationUserName=username DNSDelegationPassword=password RebootOnSuccess=NoAndNoPromptEither SafeModeAdminPassword=breakincaseofemergency 

Then, to run the utility, just issue the following command:

dcpromo /unattend:unattend.txt 

Windows Remote Shell

Included with Windows Vista and full installations of Windows Server 2008 is the Windows Remote Shell, or WinRS. You'll also find WinRS on installations of Windows Server 2003 R2. WinRS consists of a listener portion that runs on the Server Core machine itself, and the client software on other machines. The client software sends commands addressed to specific machines to the listener port on that machine, and the WinRS software on the Server Core machine receives the command, executes, and transmits the output back to the originating client machine.

First, you'll need to activate the WinRS listener on the Server Core machine. Use the following command:

WinRM quickconfig 

 

Setting up the Windows Remote Shell listener on the Server Core machine

 

Once the listener is configured, you can simply go to any Windows Vista or Windows Server 2008 (full edition) machine, and funnel your Server Core-destined commands through winrs. For example, to see the results of the oclist command, issue the following at a command line on a Vista machine:

winrs -r:WS08-CORE-1 "oclist" 

Controlling Server Core Via Group Policy

Many administrators find setting up Server Core machines with a consistent configuration can be achieved most easily through the use of a targeted Group Policy attack. You can create a group policy object (GPO) that only applies to Server Core machines by limiting the application of the GPO's attributes via WMI to only machines operating with the Server Core SKU, or by creating an organizational unit (OU) within Active Directory Domain Services, placing only Server Core machines within that OU, and then linking the GPO to the newly created OU. I prefer the WMI method, as it doesn't force you to construct your AD hierarchy based on operating systems, although both methods ultimately work equally as well in terms of the desired effect.

To use the WMI method, filter the OperatingSystemSKU property under the Win32_OperatingSystem class. The applicable values are as follow: 12 represents the Datacenter Server Core edition, 13 represents the Standard Server Core edition, and 14 represents the Enterprise Server Core edition.
-------------------
Thanks,
Paddy

Available roles and features on Windows Server 2008 Server Core machines

Available roles and features on Windows Server 2008 Server Core machines
Roles available in Server Core	Features available in Server Core
Active Directory and Active Directory Lightweight Domain Services (LDS)	BitLocker Drive Encryption
DHCP Server	Failover Clustering
DNS Server	Multipath I/O
File Services (including DFSR and NFS)	Removable Storage Management
Print Services	SNMP Services
Streaming Media Services	Subsystem for Unix-based Applications
Windows Server Virtualization	Telnet Client
	Windows Server Backup
	WINS Server

-------------------
Thanks,
Paddy

Here are some other things you don't get with Windows Server 2008 Server Core:

Here are some other things you don't get with Windows Server 2008 Server Core:

• No .NET Framework, or even the common language runtime (CLR)

• No Microsoft Management Console, and no related snap-ins

• The vast majority of Control Panel applets are not present

• No Run box, and no Start menu to go with it

-------------------
Thanks,
Paddy