blog.saalmink.nl

Another great feature of SCCM is deploying operating systems.
Although you can deploy a whole range of Windows versions, i’m going to focus on deploying Windows 7 with SP1 included.

In order to support Windows 7 (with SP1), you’ll going to have to download and install an extra update from microsoft here kb2489044.

Also, there is an extra issue to deal with.
With the update above installed, it would be possible to support and deploy Windows 7 to known systems, meaning systems that are allready member of the domain and registered with sccm.
Since we’re talking about deploying Windows 7, it is very well possible that a brand new system has been unboxed and you want to deploy it right away. So we’re dealing with unkown systems here.
To support unkown systems, we need to have at least update R2 installed for SCCM 2007 SP2. But update R3 is out so we’re going to install R3.
Before installing R3, there’s a prerequisite here: kb977384.
Then download and install: Update R3 for SCCM 2007 SP2.

Build a reference system
The most easy way to deploy an image is to build a reference system first. This means a plain Windows 7 installation with only the essential software installed that you want to have on every pc. A virtual workstation, like one in VMWare, will do just fine.

• Download the latest installation media from Microsoft. As of this point: Windows 7 with sp1 included.
• Create a virtual machine with only the basic requirements (1cpu, 512MB ram, 24GB thin provisioned disk will do just fine). As of Windows 7 we don’t need to think about the fact that hardware we are going to deploy this image to is likely to be using a different HAL since Windows 7 will do a HAL autodetect on boot. If you don’t know what that means, don’t bother :)
• Boot the virtual machine and boot from the installation medium
• Keep all the settings default. At the point where Windows setup asks for a username and computername press Control+Shift+F3
• Windows now boots into audit mode. More on that on my website: Windows 7 Audit Mode
• Do not close the small sysprep (”Hulpprogramma voor systeemvoorbereiding”) window!!!
• Now install all the software you want. You can reboot as many times as you like, just don’t close the sysprep window. In my case i’m only installing:
  • vmware client installation
  • from a dosprompt: “powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c” to set the power profile to high performance. This prevents the client from going into standby every time (very annoying!)

  As you’ll see, after every reboot, Windows will automatically reboot into Audit Mode again.

• Copy the content of “C:\Program Files\VMware\VMware Tools\Drivers” to a shared folder on your SCCM server, e.g. “\\sccm01\clientdrivers\x86\vmware client\”. This is to ensure we have the appropriate drivers for this system. We’re going to need this to create bootable media for capturing this system.
• Leave the computer as it is for now

Create capture media
Capturing the installation of the reference system is done through capture media.
This is basically a Windows PE cd/dvd or usb stick that copies the content of the harddisk to a .wim file on an external disk or network share.
When you think about that, it’s easy to understand that the PE environment needs to have access to the local harddisk and network interface.
And that’s why you have to make sure these drivers are available and that’s why we have copied al the drivers to “\\sccm01\clientdrivers\x86\vmware client\” in the last step above.
Now we have to update the capture media with those drivers.

• From the SCCM Console, expand site database, computer management, operating system deployment, drivers and rightclick drivers and click Import
• Choose “import all drivers in the following network path” and browse to “\\sccm01\clientdrivers\x86\vmware client\” and click Next
• In the overview you’ll see that all drivers for the audio, mouse, scsi controller and network controllers are found. Click Next
• Click “New Package”, Name = “VMWare Client” and Drive Package Source = “\\sccm01\clientdrivers\x86\vmware client\”, select “Update distribution points when ready” and click Next
• Do not update any boot images at this point and click Next, Next, Close
• From the SCCM Console, expand site database, computer management, operating system deployment, Boot Images and rightclick “Boot Image (x86)” and click Properties
• On the tab “Windows PE” select “enable command support (testing only)” and then click the yellow icon to import drivers
• Add all drivers, one by one (although only the scsi and network drivers are really relevant) . Eventually click OK and click YES to update the distribution point, Next, Next, Close.
• Repeat the steps for the x64 boot image
• From the SCCM Console, expand site database, computer management, operating system deployment, Task sequences, rightclick Task sequences and click Create Task Sequence Media
• Select “Capture media” and click Next, select “CD/DVD set” and click browse to select an output .iso file (e.g. sccm2007capture.iso) and click Save and click Next
• Click on Browse and select the boot image that matches your installation (x86 or x64) and click OK and Next, Next, Close

Capture the image

• Make sure you have a shared folder on your sccm server e.g. “\\sscm01\images” to store the image on.
• If you are working with a physical system, make sure you have burned the iso that has been created above. If you are working with vmware, put the iso on the datastore.
• Put the capture media in the dvd player. Autorun will start.
• “Welcome to the Image Capture Wizard” click Next
• Destination = “\\sccm01\images\win7sp1referencesystem.wim” and specify the correct network credentials so that after rebooting into PE mode, the capture media knows how to store the image on the SCCM server! Click Next
• Specify the information asked, click Next and Finish
• You may see some screens popping up, just wait and the client will reboot automatically and you´ll see the System Center background and the capture in action
• If all goes well, you’ll eventually get a message “Image successfully captured …”. press OK and the client will reboot. You can then power it off.
  If you let it run, it’ll do some sort of “unattended” installation, but it’s pretty useless since the machine isn’t instructed properly what to do (e.g. like joining the domain, install extra components etc).

Import the image in SCCM

• Now that the image has been captured, we have to import it to SCCM
• From the SCCM Console, expand site database, computer management, operating system deployment, Operating System Images and rightclick “Operating System Images” and click “Add Operating System Image”.
• Point to the share where the images is located, e.g. “\\sccm01\images\win7sp1referencesystem.wim” and click Next, Next, Next, Close
• Rightclick the just created Operating System Image and click “Manage Distribution Points” and click Next, select “Copy the package to …” and click Next, select your SCCM server and click Next, Next, Close.

Prepare the PXE server

• Expand (in order) site database, site management, <your site>, site settings, site systems, <your server> and rightclick your server, select New Roles, Next, select “PXE service point” + Next
• Click yes at the warning.
• Select “Enable unkown computer support” and click OK at the warning dialog
• Deselect “require a password …” and click Next, Next, Next, Close

Create the Configmgr package

• Expand site database, computer management, software distribution and packages
• Rightclick Packages, select New, Package from Definition and click Next
• Select the “Configuration Manager Client Upgrade” and click Next
• Select “Always obtain files from a source directory” and click Next
• Select UNC path and your SCCM server should have a default share called \\<SERVERNAME>\sms_<SITECODE>\ with a client folder in it, so in my case “\\Sccm01\sms_vl3\Client”. Point to that directory and click Next and Finish
• Rightclick the just created “Microsoft Configuration Manager Client Upgrade 4.0 ALL” package and select “manage distribution points” and click Next
• Select “Copy the package …” and click Next
• Select only the primary distribution point and click Next, Next, Close
• Rightclick the just created “Microsoft Configuration Manager Client Upgrade 4.0 ALL” package and this time select “Update distribution points” and click Yes

Specify network access
If we’re going to boot from the network later on, and we need to access the distribution points, we need to authenticate.

• On the SCCM console expand site database, site management, <your site>, site settings, client agents and rightclick “Computer Client Agent” and select properties.
• Click on the “Set” button at Network Access Account.
• Specify the Administrator account for now and click OK and OK
• As of a security perspective this might not be best practice but for now it’s OK

Pretty much everything is covered now.
So if we would unbox a new computer, connect all the wires and execute a network boot, this is what we would see:

In red: The WDS (or SCCM) server is not responding.
In green: the mac address of this client.

What we need to do next is create a task somehow to deploy Windows 7 to this computer.

Create a collection

• On the SCCM console expand site database, computer management, collections, and richtclick collections en click on “New Collection”.
• Name = “Deploy Win7 with SP1” and click Next
• No membership rules are needed so just click Next and click OK on the warning.
• Click Next Next Close.

Add the computer (mac address) to the collection

• On the SCCM console expand site database, computer management, operating system deployment, computer association, and richtclick computer association and click on “Import Computer Information”.
• Select “Import Single Computer” and click Next.
• Provide the desired computername, e.g.”win7-001”, and provide the mac address of the client. Click Next, Next
• At “Choose Target Collection” select the collection that we’ve created above “Deploy Win7 with SP1”, Next, Next, Close

Create a Task Sequence

• On the SCCM console expand site database, computer management, operating system deployment, Task Sequences, and rightclick Task Sequences and click on “New, Task Sequence”.
• Select “Install an existing image package” and click Next.
• Give the sequence a name like “Install Windows 7 with SP1 on new systems” and select the boot image that corresponds with the architecture, e.g. x86, and click Next
• Select the Image Package (which is your previously captured image) and at Image select “All Images” (this is because a normal Windows 7 installation also contains a 100MB boot partition). Fill in the rest of the information, like the license code and type, and click Next.
• Specify the domain to join with the right credentials and the OU you want to place the computeraccount in and click Next
• Click Browse to select the Configuration Manager package. Click Next.
• Deselect all Stage Migration settings, we’re not going to do that on new systems. Click Next
• “Don’t install any software updates” and click Next, Next, Next, Close.

Modify the task sequence
There is a small “bug” in the default task sequence if you ask me.
If you edit the task sequence, you’ll see that the network configuration is taking place before the device drivers are installed. This should be in reversed order.

• On the SCCM console expand site database, computer management, operating system deployment, Task Sequences, and rightclick the sequence created above and click on Edit.
• Select the green item called “Apply network settings” and drag it just below “Setup Operating System”

With that out of the way there is something with the partitioning to worry about:

• Select the green item called “Partition Disk” and in the “Volume” overview, you’ll see two volumes. One Primary volume with a fixed size of 100MB and one Priamary volume with a fixed size of the original disk of the reference system. Select that volume and click edit. Select “Use a percentage…” and set it to 100%. Click OK and OK.
• Select “Apply Operating System” and make sure that at “Apply operating system from a captured image” image 2-2 is selected
• Select “Apply data image 1” and make sure that at “image” image 1-1 is selected
• Drag task “Apply data image 1” above “Apply Operating System” and beyond “Partition disk”

If you want you can add custom taks or edit. Just look around, very cool! :-)
Hint: look at the partitioning settings and when formatting the disks, make sure you select quick format. Saves a lot of time!

Assign (advertise) the task sequence to new computers

• On the SCCM console expand site database, computer management, operating system deployment, Task Sequences, and rightclick the sequence created above and click on Advertise.
• Click on the browse button to select a collection and select the “Deploy Win7 with SP1” collection that we have created before. Also select “Make this task sequence available to boot media and PXE”. Click Next, Next.
• At the Distribution Point screen, make sure you also select “When no local distribution point is available, use remote distribution point” and click Next, Next, Next, Next, Close.

If you go to the “Deploy Win7 with SP1” collection, doubleclick on the “Win7-001” and go to the advertisements tab, you’ll see that the “Install Windows 7 with SP1 on new systems” is assigned to this computer.

That’s it. Perform a network boot and sit back!

SCCM is capable of managing Software Updates, but it relies on WSUS for that. So you need to have that installed. If you’ve followed this guide, you have.
Whereas for WSUS you need to configure group policies, for SCCM everything runs through the SCCM client so you don’t need to worry about that.

Enable the Software Updates part in SCCM

• Expand (in order) site database, site management, <your site>, site settings, site systems, <your server> and rightclick your server, select New Roles, Next, select “software update point” + Next
• At the Active Settings window, check the “Use this server as the active software update point” + click next
• Enable a schedule (1 day for now) and click next
• Select classifications and click next
• Select the products and click next
• Select and deselect the appropriate languages and click next
• Next, Next, Close

If you want to change any settings later, expand site database, site management, <your site>, site settings, component configuration and rightclick “Software Update Point Component” and click properties.

Start initial synchronization

• Expand site database, computer management, software updates, Update Repository
• Rightclick Update Repository and click Run Synchronization

Download the System Center Configuration Manager 2007 Toolkit V2 and use Trace32 to tail the logfile “c:\program files (x86)\Microsoft Configuration Manager\Logs\wsyncmgr.log” to watch the progress of the synchronization.

Configure the Software Updates Client

• Expand (in order) site database, site management, <your site>, site settings, client agents
• Rightclick Software Updates Client Agent and click properties
• Adjust the schedule to 1 day
• On the tab Update Installation select “Enforce all mandatory deployments” and set it to 1 hour. Also enable the “Hide all deployments from end users”. Click on OK

Create templates

• Expand site database, computer management, software updates, deployment templates
• Rightclick deployment templates and select new deployment template.
• Name it “Windows 7 updates”, since we’ve created a collection of Windows 7 stations previously, and click next
• Browse for the “All Windows 7 Systems” that we’ve created in Part 4 of this SCCM series, click OK and next
• Select Suppress notification, since the end user doesn’t have to be bothered with this, and set the Duration to 1 hours, which means that updates will be deployed fast. Click next
• Select Workstations to suppress the reboot notifications for the end user and click next
• Select the “Generate Operation Manager alert when a software update installation fails” and click next
• Select “Download software updates from distribution point and install” on both scenarios and click next
• Click next on the “SMS 2003” window
• Next, Close

Now before you can continue, you have to make sure that the software updates are synchronized with Microsoft. Use the Trace32 mentioned above.

Create a search folder and an update list

• Expand site database, computer management, software updates, update repository, search folders
• Rightclick search folders and select “new search folder”.
• Name it “All Windows 7 updates” and press OK
• Step 1 = Product, Step 2 = Windows 7, Step 3 = enable all subfolders, step 4 = “All Windows 7 updates” and press OK
• Rightclick the “All Windows 7 updates” search folder and click on refresh
• In the right pane, select all updates and then rightclick and select Update List.
• In the window that opens select “Create a new update list” and name it “Windows 7 update list” and press next, finish, next, close

  (with this method you can add extra updates to the list later too)

Deploy the Update list to the template

• First, we need to create a share on the SCCM computer to where the updates can be temporary downloaded to.
• Create something like “E:\tmp_downloads”
• Share this folder and add “domain admins” and the sccm computeraccount to the sharing and ntfs permissions with full control
• In the SCCM console, expand site database, computer management, software updates, update lists AND deployment templates so you see them both.
• Drag the “Windows 7 update list” on to the “Windows 7 workstations” deployment template
• If there are any license terms you need to accept, you’ll have an extra window in where you need to accept the license terms
• Next, at “create a new deployment package”, specify a name like “Windows 7 update package” and point the package source to the share you’ve created (”\\SCCM01\tmp_downloads”). Enable “Enable binary differential replication” and click Next
• Browse to select your distribution point, which is your sccm server, and click Next
• “Download the updates from the internet” and click Next
• Choose your languages but they should already match your template and click Next
• Choose a schedule or leave it to the defaults and click Next
• Next, Next (updates will be provisioned)
• Close

Now from time to time keep updating your list and drag it to the deployment template. Since you’ve enabled binary differential replication, clients that already have received most of the list, will only transfer the differential.
Best practice is to create a couple of deployment templates, based on the priorities, so for example you can deploy critical updates faster than other updates.

One of the main reasons (amongst others) that you are going to use SCCM is probably to distribute software to clients and servers on your network.

To enable this functionality

• Expand (in order) site database, site management, <your site>, site settings, site systems, <your server> and on the right pane, rightclick “ConfigMgr distribution point” and properties.
• Select “Allow clients to transfer content from this distribution point using bits, http, and https ….)” and click OK

Add a package to the inventory

• First, let’s download a nice utility called DoPDF. On that url, you’ll find a setup file. I’m saving it in the Downloads folder but in a subfolder called “DoPDF 7”.
• On the SCCM console, expand (in order) site database, computer management, software distribution, packages
• Rightclick packages and click “new -> package” and fill in the details (DoPDF, 7.x, DoPDF, English) and click Next.
• Select “This package contains source files” and click on Set, “Local Drive …” and point to the folder where you’ve downloaded the msi file to. Click OK, Next, next, next, next, finish, close.

Add a program to the package
After creating the package, you can add one or more programs to the package.

• Expand “DoPDF DoPDF 7.x English” and beneath that rightclick Program. Select New Program.
• Name will be (again??) “DoPDF 7”, for commandline, browse to the directory and select the “dopdf-7.exe” but append the commandline with “/VERYSILENT /NORESTART”. These are however specific commands for this utility, so you’ll have to adapt for other installations. Click Next
• Enter an estimation of the disk usage (so that the sccm client can abort the installation if a computer runs out of space) and the time the installation will approximately take. Optionally select specific platforms. Click Next.
• At the environment level, you can specify whether the setup will run as the user currently logged on or with administrative rights. I suggest you set it to administrative rights and do not select “Allow user to interact with this program”. Click Next, Next, Next, Finish, Next, Close.

Distribute the package to a distribution point
There can be more than one distribution point in a bigger organization but in this case we only have to distribute it to one point.

• Rightclick Distribution point and click “manage distribution points”. Click next, “copy the package to the new distribution points” + Next, select your SCCM server + Next, Next, Next, Close.
• Expand “package status” untill you see your SCCM site, refresh, and in the right pane you’ll see the status of your package being copyed to your distribution point. “Installed” means it is transfered to the distribution point.

Assign the package to clients

• Expand (in order) site database, computer management, software distribution, advertisement
• Rightclick advertisement, New, Advertisement. I’m naming this taks “DoPDF 7.x for Windows 7 Clients”. Click on browse to select the DoPDF 7.x package. And click on browse to select a collection, in my case “All Windows 7 Systems” and click Next.
• On schedule you can schedule this deployment to a specific date or time, you can even enable Wake-on-LAN if you want (but you’ll have to enable wake on lan on the site properties first!), but for now click on the yellow icon that looks like a sun and select “as soon as possible” and press OK. Click next.
• On Distribution Point select “download from distribution point and run locally” on both occasions and click next, next, next, Finish, next, close.

The default polling interval of your clients is 60 minutes, so with a maximum of 60 minutes the installation will start.
You can set the interval higher at site settings -> client agents -> computer client agent properties. For this test environment it’s safe to set it to a really low value like 1-5 minutes, but in a bigger environment you don’t want to stress the SCCM server and your network.

Maybe a bit late ….

Windows 7 offers a very handy feature called the Audit Mode. I’ve blogged about that before. This enables you to prepare the computer for the end-user, therefore it skips the whole OOBE (Out Of Box Experience) and the creation of local user accounts.
Windows XP does not have that feature so on the end of a fresh installation of Windows XP you’ll be prompted to create a user account and Windows will then automatically log in with that account. Microsoft doesn’t allow you to skip this, so you will always have to create a second local account (besides the Administrator account).

I recently found out a way to bypass this. Ok, resetting the machine does the trick also. But a more friendly way is to type SYSTEM in the first field.

sysprep.inf:

[Identification]
    JoinDomain=DOMAIN
    DomainAdmin=sysprepadmin
    DomainAdminPassword=password
    MachineObjectOU="OU=Desktops,OU=Machines,DC=Domain,DC=local"

How to make sure your client is in the right timezone and synchs with your preferred ntp server?

Control.exe TIMEDATE.CPL,,/Z (GMT+01:00) Amsterdam, Berlijn, Bern, Rome, Stockholm, Wenen
net time /setsntp:ntp.xs4all.nl
net time /querysntp
w32tm /Resync

Event viewer nicely logs the resync action:

Type gebeurtenis: Informatie
Bron van gebeurtenis: W32Time
Categorie van gebeurtenis: Geen
Gebeurtenis-ID: 35
Datum: 12-8-2009
Tijd: 10:04:10
Gebruiker: n.v.t.
Computer: HUGO7900SSF
Beschrijving:
De tijdservice is nu bezig met het synchroniseren van de systeemtijd met de tijdbron ntp.xs4all.nl (ntp.m|0×1|10.0.11.76:123->194.109.22.18:123).

Zie Help en ondersteuning op http://go.microsoft.com/fwlink/events.asp voor meer informatie.

If you want to make changes to the registry for the “default user” there is one BIG misunderstanding that i want to clarify here.

HKEY_USERS\.DEFAULT is NOT the Default User!

This is actually the registry for the Local System account. Changes in this hive will be applyed before a user logs in.
A clear example: when making the following change:

Windows Registry Editor Version 5.00

[HKEY_USERS\.DEFAULT\Control Panel\Desktop]
"Wallpaper"="C:\Windows\mywallpaper.bmp"

the background called “mywallpaper.bmp” will be loaded onto the background while pressing ctrl+alt+del and entering your credentials. (e.g. this is how Dell or HP use their own backgrounds on a pre-installed system).

Ok so how do you make changes to the default user?

It’s actually pretty simple.
As you should know the registry for a user is placed in a file called ntuser.dat in the %userprofile% directory. Therefor, in c:\documents and settings\Default User you’ll find the registry for the default user (doh!).

Now load this file as a temporary hive to enabled making changes to it.
Start a dos prompt. Then type:

reg load HKU\Temp "c:\documents and settings\Default User\NTUSER.DAT"

Start regedit and go to HKEY_USERS\Temp and you’ll see the registry for the default user.
Make the desired changes. When done, close regedit to avoid locking issues and back in your dos prompt type:

reg unload HKU\Temp

And you’re done!
New users without existing profile will inherit the Default User profile and therefor inherit the changes you just made.

“Ok one question though, why not use (domain) policies for such purposes?”
Good question. Policies will always be a better solution because changes to the policies will automatically be applied to existing user profiles and changes to the default user profile will only be used when a user logs in and the user has no existing profile.
There are, however, settings that can not be changed from (domain) policies (at least not in current Windows versions…). Examples:

• Power management (screensaver, disks going to stand-by), etc
• Schemes for audio/sounds
• (one of my favorites) Quick Launch behaviour (e.g. the number of items, the locked status, etc)
• … etc!

Conclusion
Now you know how to edit the default user registry.
Think about making these changes when preparing an image that you’re going to deploy to a network. Or at least apply the changes to the clients before all users are going to log in!

The IntelPPM should be enabled on all Intel systems. If not, the processor will overheat.
But it can not be enabled on systems with an AMD processor. The system won’t boot and result in a 0×000007 bluescreen.

This is something you need to know if you want to create images and deploy it on different systems.

_disable_intelppm.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intelppm]
"Start"=dword:00000004

_enable_intelppm.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intelppm]
"Start"=dword:00000001

RunDll32 advpack.dll,LaunchINFSection %windir%\INF\msmsgs.inf,BLC.Remove