~ Larry Mosley

Every once in a while, we here in product support will get a call where someone has deployed a task sequence that formats and installs a new OS to the ‘All Systems’ collection, or to a collection that contains many computers. Please, always be vigilant and careful when targeting OSD task sequences (or any software, really) to the ‘All Systems’ collection, or any other collection with a large number of important computers in it. Configuration Manager doesn’t have an intention checker, and if you deploy a Task Sequence that does something like format the hard drive and apply an OS image, Configuration Manager will happily tell the clients to follow those instructions, wiping the disks and installing a new image to all the machines that receive the policy.

Needless to say, this can have serious consequences, and there is no ‘UNDO’ or ‘I didn’t meant to do that!’ button in Configuration Manager.

Larry Mosley| Senior Escalation Engineer | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

ConfigMgr 2007 ConfigMgr 2012 R2

Forefront Endpoint Protection 2010 clients managed by System Center Configuration Manager 2007 (ConfigMgr 2007) may appear in the “Out of Date” deployment status collection after an anti-malware platform update is installed via Microsoft Update.

This issue occurs because the “Out of Date” collection checks for the version of the 'Microsoft Forefront Endpoint Protection 2010 Server Management' entry in Add/Remove programs data, however this data is not updated by anti-malware platform updates released to Microsoft Update.

For information about a hotfix that addresses this issue please see the following article in the Microsoft Knowledge Base:

KB2975384 - Up to date Forefront Endpoint Protection 2010 clients listed in the “Out of Date” collection (http://support.microsoft.com/kb/2975384)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

When you upgrade an enrolled Windows RT-based device to Windows 8.1 RT General Availability, all modern apps that were installed through the Company Portal app before the upgrade may not function immediately, and an "X" may be displayed on the apps tile.

This occurs because even though you can open the Company Portal app, you cannot use the apps that were installed from the Company Portal app until the device is connected to the Windows Intune service. After the device is connected, the Windows "side-loading" keys are re-provisioned and the functionality of the apps is restored.

For all the details for this issue as well as a resolution, please see the following:

KB2901698 - Some apps may not function after an enrolled Windows RT-based device is upgraded to Windows 8.1 RT General Availability (http://support.microsoft.com/kb/2901698)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

When you upgrade from the Windows 8.1 Preview release to Windows 8.1 General Availability on a Windows RT-based device, any deployed application that you may have had on the device is removed. This problem occurs because during the upgrade of a Windows RT-based device from the Windows 8.1 Preview release to Windows 8.1 General Availability, there is no "keep settings, files, and apps" option that you can select. This causes both management ability and deployed applications to be removed from the device.

For all the details for this issue as well as a resolution, please see the following:

KB2905780 - Deployed applications are removed during upgrade to Windows 8.1 General Availability on a Windows RT-based device (http://support.microsoft.com/kb/2905780)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

Support for Windows XP ends on April 8, 2014. After that date, Microsoft will not provide any public support for Windows XP. This includes security patches, non-security hotfixes as well as assisted support. To continue receiving assisted support and security updates you should upgrade to a more recent version of Windows. For more information see the following Microsoft website:

Support is ending for some versions of Windows

The end of support for Windows XP may affect you if you use System Center Configuration Manager because certain versions support the deployment of only certain versions of Windows. You can use Operating System Deployment (OSD) to deploy the Windows operating system and to upgrade to a newer version, however depending on the version of Windows that you want to deploy, you may have to first upgrade the version of System Center Configuration Manager that you're using. The article below provides details about which version of ConfigMgr 2007 or ConfigMgr 2012 you need in order to deploy a particular version of Windows.

KB2909893 - Which version of System Center Configuration Manager do you need to deploy a particular version of Windows? (http://support.microsoft.com/kb/2909893)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Rafid Ali

Hello Everyone, Rafid Ali here with another support tip for you on configuring a ConfigMgr 2012 reporting service point for HTTPS. I have typically seen this requirement when the ConfigMgr site is configured to only accept HTTPs client communication, so to improve reporting security, here is how to setup your reporting services point to use HTTPS as well.

Introduction to reporting in Configuration Manager

Reporting in System Center 2012 Configuration Manager provides a set of tools and resources that help you use the advanced reporting capabilities of SQL Server Reporting Services (SSRS) and the rich authoring experience that Reporting Services Report Builder provides. Reporting helps you gather, organize, and present information about users, hardware and software inventory, software updates, applications, site status, and other Configuration Manager operations in your organization. Reporting provides you with a number of predefined reports that you can use without changes, or that you can modify to meet your requirements, and you can create custom reports.

In this example, we will use a scenario where my Report Server is at a remote location hosting SSRS (SQL Server Reporting Services) and the ConfigMgr Site Database is local. However, you can have your Report Server local as well.

Requirements

A Certificate (with Server OID or Web Server Certificate) on the Report Server where SQL Reporting Service is hosted.

NOTE The Report Server instance and ConfigMgr Site Database instance can be on different servers but they must be the same version in order to communicate properly.

The Steps Involved

1. Issuing a Certificate and Enrolling it on Report Server.
2. Configuration of the Report Database and URLs
3. Installation of the Reporting Services Point role.

Step 1: Issuing a Certificate and Enrolling it on Report Server

We need a certificate (with Server OID or Web Server Certificate) on our Report Server. The ‘Subject Name’ of the Certificate should be the FQDN of Report Server as the URLs will be created using the same name. You can ask your PKI expert to provide you with this certificate on the Report Server or you can refer to the article below for information on creating, issuing and requesting the certificate.

Configure the Web Server certificate template: http://technet.microsoft.com/en-us/library/ee649187(v=WS.10).aspx

Request a Certificate: http://technet.microsoft.com/en-us/library/cc730689.aspx

To verify certificate enrollment, check the Personal Store of your Report Server and verify with the ‘Template Name’ you provided initially while issuing the certificate.

NOTE Make sure that “Issued To” has your ‘Report Server FQDN’, as the URLs will be created using this name.

Step 2: Configuration of the Report Database and URLs

Open the “Reporting Services Configuration Manager” by connecting to the correct Instance. Verify that the version of ‘Reporting Service Instance’ is the same as ‘SCCM Database Instance’. If not, upgrade the Reporting Service Instance first.

Go to “Web Service URL”. You will find that the URL is already created on Port:80 but is not active. To make it active click on “Apply”.

NOTE You need to make the URL active only if Reporting Services is not configured during installation of SQL Reporting Services.

Do the Same for “Report Manager URL”:

Next select “Database”.

NOTE If the Database is already created and configured then skip this part (Database Configuration), else proceed accordingly for configuring the Report Server Database.

In my case the Database named “ReportServer_New” is already created and configured but I am proceeding with configuration of a New Database just so that you can see how this is done.

Click on “Change Database”:

Select “Create a new report server database”:

Provide the server name where the SCCM Database instance is hosted:

Provide the name of Report Server Database you want to create. Here I have provided the name “ReportServer”:

Provide the credentials as per your environment configuration. I suggest “Local System” as a good one to use.

Finish the configuration:

Once the Report Database is created you can verify the same by opening the SQL Management Console on the Site Database Server:

NOTE You can also verify the version of ‘SQL Instance’ on which the SCCM Site Database is hosted and compare it with ‘SQL Reporting Services Instance’ hosted on the Report Server.

Now go back to “Web Service URL” to configure it for HTTPS. Click on “Advanced..”:

Remove the TCP Port 80 (HTTP) identity and add the SSL identity by clicking on “Add”:

SSL Port 443 will be already selected. Select the Web Server certificate we previously enrolled:

This will create the required HTTPS URL automatically that you can verify here:

Click OK to finish the Web Service URL configuration:

You will find that the HTTPS (Web Service) URL (https://<Report Server FQDN>:443/ReportServer) is created as per your Report Server FQDN:

Click on the URL to verify that its running and verify that it’s connecting via HTTPS:

Now do the same for Report Manager URL:

You will find that the HTTPS Report Manager URL (https://<Report Server FQDN>:443/Reports) is created as per your Report Server FQDN:

Step 3: Installation of the Reporting Services Point role

Go ahead and add the Reporting Service role on the Report Server hosting the SQL Reporting Services.

IMPORTANT While adding the role make sure that you specify the following:

• “SCCM Site Database Server Name” at ‘Site Database Server Name’ (Example: PRI.contoso.com)
• “SCCM Site Database Name” at ‘Database Name’ (Example: CM_MUM)
• “Reporting Service Instance Name” at ‘Reporting Services Server Instance’ (Example: MSSQLSERVER)
• Set the “User Name”

Below is the screen shot for the same:

Once the role is added you can verify the initiation of role installation and start of the Bootstrap Service in Sitecomp.log. Do this by looking at the Site System name (i.e. Report Server):

Verify that the role was added successfully by looking in SRSRPsetup.log on the Site System (located at \\<Drive>\SMS\Logs):

If the role installation is successful, look in the SRSRP.log created at the same location and verify the HTTPS URL you created. Also verify the SSRS Instance Version as well as the creation of the Source Folder and Data Source:

Once all of the above things are verified and configured, it will start deploying Reports and creating respective folders of those reports:

Once all the reports are deployed it will check the SRS Web Service health and keep checking at regular intervals:

Once all of the reports deployed successfully, you can verify the URLs in the ConfigMgr 2012 console as well:

Now you can go ahead and start running the reports from the ConfigMgr 2012 console using HTTPS mode by using the HTTPS URL.

Summary

In Step 1 we issued a Web Server certificate and enrolled it on the Report Server, with the configuration of the URLs being the most important step that you need to focus on. In Step 2 we configured the URLs and verified that they were running properly, and that the Report Server Database was created successfully under the Master Database. Once the SSRS configuration was complete we then proceeded towards Steps 3 for the configuration of Reporting Service Point Role on our Site System (hosting the SSRS). We closely looked into the desired inputs (with examples) in the wizard while adding the role, we went through the logs and verified the configuration settings that Configuration Manager 2012 verifies before installing the Role, then we verified the successful installation of role and deployment of reports on Report Server.

Additional Information

1. Refer to the following article for more information on configuring the Report Server: http://msdn.microsoft.com/en-us/library/aa545752(v=CS.70).aspx

2. Refer to the following article for more information on configuring SSRS URLs: http://msdn.microsoft.com/en-us/library/ms159261.aspx

3. See the following for more information on configuring a Report Server Database Connection (SSRS Configuration Manager): http://msdn.microsoft.com/en-us/library/ms159133.aspx

Rafid Ali

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

This month we released a document series that serves as a best practice guide for using Task Sequences in System Center 2012 R2 Configuration Manager. The scenario is presented as a case study for the fictitious company named Fourth Coffee and goes through the follow scenarios of using Task Sequences in ConfigMgr 2012 R2:

• Bare Metal Task Sequence and examination of steps
• Lessons learned from the bare metal process
• Create Computer Refresh Task Sequence Wizard and examination of the steps
• Lessons learned from the Create Computer Refresh Task Sequence

There are five parts in all and you can find them here:

Sequences in System Center 2012 Configuration Manager R2

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Eric Ellis

Hi everyone, Eric Ellis here with a quick support tip for you about how a bad report in System Center Configuration Manager 2007 can potentially cause the admin console to crash. 

The last time I ran into this, the customer was using ConfigMgr 2007 R3 in their environment, and when they would run the "Compliance 1 - Overall Compliance" report in the ConfigMgr console it caused the console to crash. The same behavior didn’t happen with any of the other reports, nor did it occur when running the same report via the SQL Server Reporting Services URL.

The details of the console crash included the following:

An error occurred in ConfigMgr. The ConfigMgr console will continue to function, however you should save your work and restart the console. After restarting the console, verify that your last configurations have been applied.

A related SMSAdminUI.log contained the following entry:

The report definition is not valid or supported by this version of Reporting Services. This could be the result of publishing a report definition of a later version of Reporting Services, or that the report definition contains XML that is not well-formed or the XML is not valid based on the Report Definition schema. Details: The element 'TablixMembers' in namespace 'http://schemas.microsoft.com/sqlserver/reporting/2010/01/reportdefinition' has incomplete content. List of possible elements expected: 'TablixMember' in namespace 'http://schemas.microsoft.com/sqlserver/reporting/2010/01/reportdefinition'.

What we ultimately discovered was that the default report had been edited in a later version of SSRS Report Builder than is supported by ConfigMgr 2007. This introduced schema differences to the RDL file, thus causing the console to crash.

The Configuration Manager product team touches on this issue here:

FAQ - SQL Reporting Services Integration with System Center Configuration Manager 2007 R2

The article linked above states the following:

“Partial support for authoring and running reports in a SQL Server 2008 environment
- The Configuration Manager 2007 R2 release uses the SQL Reporting Services 2005 report schema underneath and hence reports authored using Business Development Studio 2008 (as bundled with SQL Server 2008) and Report Builder 2.0 will not run from the Configuration Manager 2007 R2 administration console. However you can author reports using any of the tools available with SQL Reporting Services 2008 and can run these reports from the SQL Reporting Services Web UI directly.”

If you’re unsure whether this is your issue, you can easily tell by looking at the RDL file itself. For example, here’s the relevant snippet from a correct, working RDL file:

<?xml version="1.0"?><Report Name="Compliance 1 - Overall Compliance" xmlns="http://schemas.microsoft.com/sqlserver/reporting/2005/01/reportdefinition">

Here’s an example of one edited using a later version:

<?xml version="1.0" encoding="utf-8"?><Report xmlns:rd="http://schemas.microsoft.com/SQLServer/reporting/reportdesigner" xmlns:cl="http://schemas.microsoft.com/sqlserver/reporting/2010/01/componentdefinition" xmlns="http://schemas.microsoft.com/sqlserver/reporting/2010/01/reportdefinition">

So with this in mind, that gives us three possible ways to go forward:

Option 1: View the reports in question via the SQL Server Reporting Services Report Manager.

Option 2: Replace the modified copy of the report in question using the following steps:

a. Obtain an unmodified/default copy of the report file (*.RDL).

b. Open SSRS Report Manager and navigate to the location of the report.

c. Make a copy of the report by clicking the pull down menu associated to this report, clicking on the “Download” option, and saving the copy to a desired location, as shown below.

d. Overwrite the existing copy of the report in SSRS Report Manager:

- Open SSRS Report Manager and navigate to the location of the report.
- Click on the pull down menu associated with the report and click on the “Manage” option.
- In the report Properties window, click the “Replace” button.

- Click the Browse button, navigate to the location of the unmodified/default copy of the report file, click OK, and Apply.

- Click the “Home” link to return to the home page of the Report Manager.
- Browse to the location of the report in the Report Manager, run the report, and ensure that it functions properly.
- If running the report in Report Manager is successful, run the report from within the ConfigMgr 2007 console to ensure that the report is rendered without crashing.

Option 3: If the edits made to the report are required, and you need to be able to open the modified reports in the ConfigMgr 2007 console, modifications to the report must be done within the SSRS 2005 edition of Report Builder. Once this has been done, upload the SSRS 2005 version of the report into the SSRS 2008R2 Report Manager and override the previous version of the report using steps similar to those in Option 2 above.

Eric Ellis| Senior Support Escalation Engineer | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

When you try to install an application package (.cmmac file) that is larger than 4 gigabytes (GB) on an Apple Mac by using the ConfigMgr 2007 or ConfigMgr 2012 client, the package cannot be extracted. This issue occurs because the unzip tool located in "/usr/bin/unzip" does not support extracting files that are larger than 4 GB, even though the inbox ZIP utility can create a compressed (.zip) file that is larger than 4 GB. As of 8/19/2014, this is a known issue of using the System Center Configuration Manager client on a Mac. The issue will be fixed when an updated unzip tool that supports large files is available for Mac.

For all the details and the latest information regarding this issue, please see the following:

KB2990325 - You cannot install applications larger than 4 GB on a Mac by using the System Center Configuration Manager client (http://support.microsoft.com/kb/2990325)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Radu Tomoiaga | Support Engineer

This article is a follow up to my original post titled How to determine who deleted what objects in the Configuration Manager console (http://blogs.technet.com/b/configurationmgr/archive/2013/10/01/how-to-determine-who-deleted-what-objects-in-the-configuration-manager-console.aspx). As in System Center 2012 Configuration Manager (ConfigMgr 2012), we have only SQL Reporting Services for the reporting component and I decided to write this article to fill in the blanks that were left behind from that first post.

Once in a while you may face an issue where you discover that some clients are missing in the Configuration Manager console and you’re not able to figure out what happened. You suspect that one of the ConfigMgr admins might have accidentally removed them but how can you figure out which one did what? Here’s a tip showing how you might be able to figure this out.

As in my original post, we want to look for a status message ID of 30066 or 30067. These mean that a user has either deleted a resource or all resources from a collection.

To do this we need to create a new report in Configuration Manager 2012 and we will use a custom SQL query to do it.

The SQL query is below:

SELECT     TOP (100) PERCENT dbo.v_StatMsgAttributes.AttributeValue AS 'User', dbo.v_StatusMessage.MessageID AS 'has deleted', dbo.v_StatMsgInsStrings.InsStrValue AS 'this computer', dbo.v_StatusMessage.RecordID , dbo.v_StatMsgAttributes.AttributeTime as 'on' FROM         dbo.v_StatusMessage INNER JOIN  dbo.v_StatMsgInsStrings ON dbo.v_StatusMessage.RecordID = dbo.v_StatMsgInsStrings.RecordID INNER JOIN dbo.v_StatMsgAttributes ON dbo.v_StatMsgInsStrings.RecordID = dbo.v_StatMsgAttributes.RecordID WHERE     ((dbo.v_StatusMessage.MessageID = 30066) OR (dbo.v_StatusMessage.MessageID = 30067))  AND (dbo.v_StatMsgInsStrings.InsStrValue LIKE @variable ) and (dbo.v_StatMsgInsStrings.InsStrIndex='2') ORDER BY 'this computer' DESC

We need to create a new report that will use the query above and it will look something like this:

When running the report we need to provide a search string which is the computer name of the client or clients that are missing:

This will show you the user name and the record they deleted. Below is another example with a % wildcard (which means all).

Hope this helps!

Radu Tomoiaga | Support Engineer | Microsoft

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

~ Jagat Singh Kathiar

Hi folks, Jagat Singh Kathiar here from the Configuration Manager team with another support tip for you. I came across this issue a while ago where a System Center 2012 Configuration Manager (ConfigMgr 2012) Management Point was configured for HTTPS and it was failing to do its health check. When we look in MPcontrol.log we found the following:

Failed in CertStrToName(...) API: 0x80092023      SMS_MP_CONTROL_MANAGER              8/29/2014 10:07:29 AM  20132 (0x4EA4)

The Error 500 stated above is pretty generic but if you look closely it is clearly stating that it is failing in GetCertificateBySelectingCriteria. This means we probably have an issue with our certificate so here’s how you can verify that:

Connect to the ConfigMgr console and go to Administration –> Site configuration –> Site properties and select the Client Computer Communication tab, then click on Modify and check the Clients Certificate Selection Settings. In this case, we found that the certificate selection criteria was set to use a certificate with a certain Subject name and SAN field although there were no matching certificates present in the personal computer store.

To resolve the problem, we set the client certificate selection criteria to the default which is Client authentication capability and chose the radio button for Select the certificate with the longest validity period as shown below.

Default settings are shown above

IMPORTANT Changing these settings will apply them to every single client assigned to your site which may result in unintended consequences. Please ensure that you are fully aware of how this change may impact your environment before implementing this solution. 

Jagat Singh Kathiar| Sr. Technical Lead | Microsoft

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

When you run the New-CMSiteSystemServer cmdlet that's included with Microsoft System Center 2012 R2 Configuration Manager, PowerShell may exit unexpectedly. If you experience this issue we have a new hotfix available to address it.

For additional details on the issue as well as a link to a ConfigMgr 2012 R2 hotfix that resolves this issue please see the following:

KB2984644 - PowerShell exits unexpectedly when you run the New-CMSiteSystemServer cmdlet (http://support.microsoft.com/kb/2984644)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/

Today we released Cumulative Update 3 (CU3) for Microsoft System Center 2012 R2 Configuration Manager (ConfigMgr 2012 R2).

For details on the fixes included in this update as well as a download link, please see the following:

KB2994331 - Description of Cumulative Update 3 for System Center 2012 R2 Configuration Manager (http://support.microsoft.com/kb/2994331)

J.C. Hornbeck| Solution Asset PM | Microsoft GBS Management and Security Division

Get the latest System Center news onFacebookandTwitter:

System Center All Up: http://blogs.technet.com/b/systemcenter/
System Center – Configuration Manager Support Team blog: http://blogs.technet.com/configurationmgr/
System Center – Data Protection Manager Team blog: http://blogs.technet.com/dpm/
System Center – Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
System Center – Operations Manager Team blog: http://blogs.technet.com/momteam/
System Center – Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center – Virtual Machine Manager Team blog: http://blogs.technet.com/scvmm

Windows Intune: http://blogs.technet.com/b/windowsintune/
WSUS Support Team blog: http://blogs.technet.com/sus/
The AD RMS blog: http://blogs.technet.com/b/rmssupp/

The Forefront Endpoint Protection blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/