Check the SMSTS.log for following:
Network Access Account Not Set
Resolution: Go into the Client Policy in SCCM and set a Network Access Account. It sometimes "disappears" even after everything has been working fine.
http://www.myitforum.com/forums/m_177370/mpage_1/key_/tm.htm#177370
PXE CERT Not Set
Resolution: Check the PXE Certificate in the SCCM console. Verify that the Root CA is trusted. Alternatively, reset the expiration date.
http://www.myitforum.com/forums/m_177312/mpage_1/key_/tm.htm#177312
GetHostByName Failed
Resolution: Ensure the FQDN is properly set.
http://www.myitforum.com/forums/m_177318/mpage_1/key_/tm.htm#177318
2008-09-30
2008-09-28
SCCM capture media is not bootable
The capture media you created from SCCM task sequence is not bootable.
Interesting discussion here:
http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=2378477&SiteID=17
Interesting discussion here:
http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=2378477&SiteID=17
Hardware devices not installed in Sysprep image
http://support.microsoft.com/kb/837691
SYMPTOMS
When you use the Microsoft System Preparation tool (Sysprep) to deploy a Sysprep image of Microsoft Windows XP to a computer, some devices may appear in Device Manager as not installed even when the driver for the device exists in the path that is set by the oempnpdriverspath entry in the Sysprep.inf.
If you double-click on a device in Device Manager, you receive the following error message in the Device status box on the General tab:
The drivers for this device are not installed. (Code 28)
Additionally, a yellow exclamation mark appears next to the device when you view it in Device Manager.
Back to the top
CAUSE
This problem occurs when you create a Sysprep image on a computer and then deploy that image to a computer that has the same type of hardware. Any devices that do not have their drivers installed will remain in this state after the deployment of the Sysprep image. The minisetup program that is used by Sysprep does not perform a full Plug and Play re-enumeration of all devices.
WORKAROUND
Before you run Sysprep to prepare a computer for duplication, remove any devices in device manager that are set to Code 28. To remove these devices, follow these steps:
1. Click Start, and then click Control Panel.
2. Double-click Administrative Tools.
3. Double-click Computer Management.
4. Click Device Manager.
5. Locate any device that has a yellow exclamation mark next to it.
6. Verify that the device status for the device has the error message that is listed in the "Symptoms" section of this article. To do so:
a. Right-click the device icon.
b. Click Properties.
c. The Device status box lists the error message:
The drivers for this device are not installed. (Code 28)
7. Right-click the device icon, click Uninstall and then click OK.
Repeat steps 5 through 7 for each device that has the Code 28 error message.
SYMPTOMS
When you use the Microsoft System Preparation tool (Sysprep) to deploy a Sysprep image of Microsoft Windows XP to a computer, some devices may appear in Device Manager as not installed even when the driver for the device exists in the path that is set by the oempnpdriverspath entry in the Sysprep.inf.
If you double-click on a device in Device Manager, you receive the following error message in the Device status box on the General tab:
The drivers for this device are not installed. (Code 28)
Additionally, a yellow exclamation mark appears next to the device when you view it in Device Manager.
Back to the top
CAUSE
This problem occurs when you create a Sysprep image on a computer and then deploy that image to a computer that has the same type of hardware. Any devices that do not have their drivers installed will remain in this state after the deployment of the Sysprep image. The minisetup program that is used by Sysprep does not perform a full Plug and Play re-enumeration of all devices.
WORKAROUND
Before you run Sysprep to prepare a computer for duplication, remove any devices in device manager that are set to Code 28. To remove these devices, follow these steps:
1. Click Start, and then click Control Panel.
2. Double-click Administrative Tools.
3. Double-click Computer Management.
4. Click Device Manager.
5. Locate any device that has a yellow exclamation mark next to it.
6. Verify that the device status for the device has the error message that is listed in the "Symptoms" section of this article. To do so:
a. Right-click the device icon.
b. Click Properties.
c. The Device status box lists the error message:
The drivers for this device are not installed. (Code 28)
7. Right-click the device icon, click Uninstall and then click OK.
Repeat steps 5 through 7 for each device that has the Code 28 error message.
2008-09-27
How to fix blue screen error 0x0000007B
So, you've decided to move your drive with Windows 2000 (or XP) to a new system, or upgraded your motherboard, and you now get the dreaded blue screen of death before the operating system gets to the desktop.
All you get is a blue screen with STOP 0x0000007B error (INACCESSIBLE_BOOT_DEVICE). Here are some solutions to fix it.
Solution 1
check this page for detailed how to:
http://thinkinginpixels.com/quick-fixes/fix-stop-error-0x0000007b/
1.) download Bart PE, RunScanner, and FixMoveHD.reg file.
2.) Prepare the Bart PE Recovery CD
3.) Use the new created CD to boot the problem computer
4.)Load FixMoveHD.reg file from PE
5.)Extract 'Atapi.sys,' 'Intelide.sys,' 'Pciide.sys,' and 'Pciidex.sys' to %systemroot%\system32\drivers" folder from '%SystemRoot%\Driver Cache\i386\Driver.cab or sp2.cab'.
In my case (Winxp sp2 deployment) I used the following commands :
expand sp2.cab -f:atapi.sys c:\windows\System32\Drivers
expand sp2.cab -f:intelide.sys c:\windows\System32\Drivers
expand driver.cab -f:pciide.sys c:\windows\System32\Drivers
expand driver.cab -f:pciidex.sys c:\windows\System32\Drivers
6.)Reboot the system to normal mode and it should work fine now
solution 2:
Check this page for more detailed steps:
http://www.mostlycreativeworkshop.com/article11.html
Well, the first thing you need to do is to get the system working again, so, put the system back in the original working configuration. If you changed the motherboard, change it back to the original. If you moved the drive to a new system, place it in the old one.
Now, for people that understand what they are doing, and how to do it, here are the "quick" steps:
1 - Extract 'Atapi.sys,' 'Intelide.sys,' 'Pciide.sys,' and 'Pciidex.sys' from '%SystemRoot%\Driver Cache\i386\Driver.cab' (or SPx.CAB if it exists, where x is the latest service pack)
2 - Copy those four files to the following location: '%SystemRoot%\System32\Drivers' (do not replace files already there)
3 - Merge the registry file found below (copy the text to notepad and save as a .reg file), or better, download it here
4 - THAT'S IT! Move it to the new system (or change the motherboard), and your system should start up.
All you get is a blue screen with STOP 0x0000007B error (INACCESSIBLE_BOOT_DEVICE). Here are some solutions to fix it.
Solution 1
check this page for detailed how to:
http://thinkinginpixels.com/quick-fixes/fix-stop-error-0x0000007b/
1.) download Bart PE, RunScanner, and FixMoveHD.reg file.
2.) Prepare the Bart PE Recovery CD
3.) Use the new created CD to boot the problem computer
4.)Load FixMoveHD.reg file from PE
5.)Extract 'Atapi.sys,' 'Intelide.sys,' 'Pciide.sys,' and 'Pciidex.sys' to %systemroot%\system32\drivers" folder from '%SystemRoot%\Driver Cache\i386\Driver.cab or sp2.cab'.
In my case (Winxp sp2 deployment) I used the following commands :
expand sp2.cab -f:atapi.sys c:\windows\System32\Drivers
expand sp2.cab -f:intelide.sys c:\windows\System32\Drivers
expand driver.cab -f:pciide.sys c:\windows\System32\Drivers
expand driver.cab -f:pciidex.sys c:\windows\System32\Drivers
6.)Reboot the system to normal mode and it should work fine now
solution 2:
Check this page for more detailed steps:
http://www.mostlycreativeworkshop.com/article11.html
Well, the first thing you need to do is to get the system working again, so, put the system back in the original working configuration. If you changed the motherboard, change it back to the original. If you moved the drive to a new system, place it in the old one.
Now, for people that understand what they are doing, and how to do it, here are the "quick" steps:
1 - Extract 'Atapi.sys,' 'Intelide.sys,' 'Pciide.sys,' and 'Pciidex.sys' from '%SystemRoot%\Driver Cache\i386\Driver.cab' (or SPx.CAB if it exists, where x is the latest service pack)
2 - Copy those four files to the following location: '%SystemRoot%\System32\Drivers' (do not replace files already there)
3 - Merge the registry file found below (copy the text to notepad and save as a .reg file), or better, download it here
4 - THAT'S IT! Move it to the new system (or change the motherboard), and your system should start up.
Error: This computer is not registered with the configuration manager
When deploy Winxp from bootable CD, after the DHCP setting window, got an error:
This computer is not registered with the configuration manager site.
Detailed error from smsts.log:
Client does not have an ID. Please ensure you have created a record for this client in the SMS database.
Invalid advise flags (Error: 80040001; Source: Windows)
Answer 1:
From: http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3827655&SiteID=17
When starting from boot media or PXE (as this task sequence appears to be doing) there is no way for ConfigMgr to query AD or the SLP for a site. So, PXE and boot media can only communicate to the site they were created on. In practice, this means you should create boot media on the site you plan to use it.
Answer 2:
http://blogs.technet.com/mniehaus/archive/2008/01/19/microsoft-deployment-configmgr-boot-media-unknown-computers-web-services.aspx
To deploy an operating system to a new computer without stand-alone media that is not currently managed by Configuration Manager 2007, the new computer must be added to the Configuration Manager 2007 database prior to initiating the operating system deployment process. Although Configuration Manager 2007 can automatically discover computers on your network that have a Windows operating system installed, if the computer has no operating system installed you will need to import the new computer information by using the Import Computer Information Wizard. This wizard supports importing information about a single computer, or importing information about one or more computers from an external .csv file.
When you boot a computer using ConfigMgr boot media, a wizard will start. The first screen don't require that the computer be present in the ConfigMgr database, but in order to complete the wizard it must be. So how can we hook into this wizard to do something about this? That's where the pre-execution hook, described at http://technet.microsoft.com/en-us/library/bb694075.aspx, comes in.
This computer is not registered with the configuration manager site.
Detailed error from smsts.log:
Client does not have an ID. Please ensure you have created a record for this client in the SMS database.
Invalid advise flags (Error: 80040001; Source: Windows)
Answer 1:
From: http://forums.microsoft.com/TechNet/ShowPost.aspx?PostID=3827655&SiteID=17
When starting from boot media or PXE (as this task sequence appears to be doing) there is no way for ConfigMgr to query AD or the SLP for a site. So, PXE and boot media can only communicate to the site they were created on. In practice, this means you should create boot media on the site you plan to use it.
Answer 2:
http://blogs.technet.com/mniehaus/archive/2008/01/19/microsoft-deployment-configmgr-boot-media-unknown-computers-web-services.aspx
To deploy an operating system to a new computer without stand-alone media that is not currently managed by Configuration Manager 2007, the new computer must be added to the Configuration Manager 2007 database prior to initiating the operating system deployment process. Although Configuration Manager 2007 can automatically discover computers on your network that have a Windows operating system installed, if the computer has no operating system installed you will need to import the new computer information by using the Import Computer Information Wizard. This wizard supports importing information about a single computer, or importing information about one or more computers from an external .csv file.
When you boot a computer using ConfigMgr boot media, a wizard will start. The first screen don't require that the computer be present in the ConfigMgr database, but in order to complete the wizard it must be. So how can we hook into this wizard to do something about this? That's where the pre-execution hook, described at http://technet.microsoft.com/en-us/library/bb694075.aspx, comes in.
2008-09-25
Unknown Computers in SCCM 2007 R2 - overview
Unknown Computers in SCCM 2007 R2 - overview
http://blogs.msdn.com/steverac/archive/2008/09/21/unknown-computers-in-sccm-2007-r2-overview.aspx2008-09-24
Windows domain migration senario
How to migrate a domain from one forest to another forest.
Answer:
Usually you use the ADMT for restructuring an Active Directory environment.
Planning is the key as with anything but you've asked what the best practice would be and to answer that what I'll say one must understand core concepts of domains, forests and trees in Active Directory, how Active Directory works, how DNS services work because Active Directory relies upon DNS to function,, along with trust relationships between domains, trees and forests and Active Directory partitioning, and restructuring before one attempts at migration or restructuring.
For that basic knowledge set I'll suggest reading the following MS KB article on Forests, domains and trees in a MS Active Directory Environment. http://support.microsoft.com/kb/310996/en-us
I recommend you also read up on the ADMT for restructuring an Active Directory environment.
here's a link on downloading the ADMT which provides a brief intro of what it's used for. http://www.microsoft.com/downloads/details.aspx?
I'll also suggest going to Tech Net for white papers on most things Active Directory.
http://technet.microsoft.com/en-us/default.aspx
Answer:
Usually you use the ADMT for restructuring an Active Directory environment.
Planning is the key as with anything but you've asked what the best practice would be and to answer that what I'll say one must understand core concepts of domains, forests and trees in Active Directory, how Active Directory works, how DNS services work because Active Directory relies upon DNS to function,, along with trust relationships between domains, trees and forests and Active Directory partitioning, and restructuring before one attempts at migration or restructuring.
For that basic knowledge set I'll suggest reading the following MS KB article on Forests, domains and trees in a MS Active Directory Environment. http://support.microsoft.com/kb/310996/en-us
I recommend you also read up on the ADMT for restructuring an Active Directory environment.
here's a link on downloading the ADMT which provides a brief intro of what it's used for. http://www.microsoft.com/downloads/details.aspx?
I'll also suggest going to Tech Net for white papers on most things Active Directory.
http://technet.microsoft.com/en-us/default.aspx
Error " The hash value is not correct" when creating stand-alone TS media
Problem:
I ran thru the create media from task sequence media wizard once with cd/dvd and once with usb. Both give me errors:
-Error Creating Media. Error message is : The hash value is not correct.
Solution:
This error indicates that the files on the DP for one of the packages referenced by your task sequence does not match the hash we calculated when the package was imported. The CreateMedia log (in the AdminUILog directory) should indicate what package does not match. My guess is that it is your boot image (since we have seen some issues with this getting out of sync). Using the Manage Distribution Points Wizard try refreshing the boot image package on all distribution points and see if this fixes the problem.
And make sure you do "Refresh DPs" and not "Update DPs". You get to "Refresh DPs" from the "Manage DPs" wizard. "Update DPs" checks the versions number in the database to decide if new content needs to be copied to the DP. If the database thinks everything is OK, it will do nothing. "Refresh DPs" assumes something might be messed up on the DP and always copies the latest version out to the DP.
Do a refresh of the distribution point followed by and immediate update fo the DP. Sounds crazy but it has worked everytime for us.
I ran thru the create media from task sequence media wizard once with cd/dvd and once with usb. Both give me errors:
-Error Creating Media. Error message is : The hash value is not correct.
Solution:
This error indicates that the files on the DP for one of the packages referenced by your task sequence does not match the hash we calculated when the package was imported. The CreateMedia log (in the AdminUILog directory) should indicate what package does not match. My guess is that it is your boot image (since we have seen some issues with this getting out of sync). Using the Manage Distribution Points Wizard try refreshing the boot image package on all distribution points and see if this fixes the problem.
And make sure you do "Refresh DPs" and not "Update DPs". You get to "Refresh DPs" from the "Manage DPs" wizard. "Update DPs" checks the versions number in the database to decide if new content needs to be copied to the DP. If the database thinks everything is OK, it will do nothing. "Refresh DPs" assumes something might be messed up on the DP and always copies the latest version out to the DP.
Do a refresh of the distribution point followed by and immediate update fo the DP. Sounds crazy but it has worked everytime for us.
DFS resources
Distributed File System (DFS)
http://technet2.microsoft.com/windowsserver/en/library/370f16f9-dd08-45dc-8cf2
-d9e2bfeada881033.mspx?mfr=true
Designing and Deploying File Servers
http://technet2.microsoft.com/windowsserver/en/library/42befce4-7c15-4306-8edc-a80b8c57c67d1033.mspx?mfr=true
Best practices for Distributed File System (DFS)
http://technet2.microsoft.com/WindowsServer/en/Library/007e4e66-af67-4bfe-bf70-780412aeed6f1033.mspx?mfr=true
http://technet2.microsoft.com/windowsserver/en/library/370f16f9-dd08-45dc-8cf2
-d9e2bfeada881033.mspx?mfr=true
Designing and Deploying File Servers
http://technet2.microsoft.com/windowsserver/en/library/42befce4-7c15-4306-8edc-a80b8c57c67d1033.mspx?mfr=true
Best practices for Distributed File System (DFS)
http://technet2.microsoft.com/WindowsServer/en/Library/007e4e66-af67-4bfe-bf70-780412aeed6f1033.mspx?mfr=true
2008-09-22
WSUS troubleshooting,
http://www.wsus.info/forums/index.php?showtopic=9312
Client-related
Do my clients meet the requirements to run WSUS?
Have you cloned your computers on the network? If yes, did you run Sysprep, Ghostwalker, or NewSID on the computers after they have been deployed with the new image?
Active Directory
Did you apply your GPO to the appropriate OU? Did you apply the GPO to an OU that contains computer objects?
Are you waiting long enough for your GPOs to be applied to your computers?
Is the GPO even applying to your computer?
Do you have 'Block Inheritance' set on your OU which would restrict a group policy from applying to the OU and objects contained therein?
Tools for troubleshooting:
client diagnostic tool
http://download.microsoft.com/download/9/7/6/976d1084-d2fd-45a1-8c27-a467c768d8ef/WSUS%20Client%20Diagnostic%20Tool.EXE
server diagnostic tool
http://download.microsoft.com/download/7/7/4/7745a34e-f563-443b-b4f8-3a289e995255/WSUS%20Server%20Debug%20Tool.EXE
Want to figure out which computers have duplicate SIDS?
Use psGetSID from Sysinternals: http://www.microsoft.com/technet/sysinternals/utilities/psgetsid.mspx
- You can run this against all computers in your domain to discover who has a duplicate SID.
You should really then run NewSID from Sysinterals on any of the duplicate computers to resolve any potential issues in the future (not to mention the security issues involved with having duplicate SIDS on the network): http://www.microsoft.com/technet/sysinternals/utilities/newsid.mspx
NOTE: You don't need to RUN NewSID on each computer prior to fixing the duplicate ID issue in WSUS, but it may rear its ugly head later on, so if you can find the time, I would recommend fixing this issue as soon as you can.
Error: this computer has not reported yet, wsus
Error: this computer has not reported yet, wsus
Qeustion:
Just set WSUS up in a test enviroment and im getting an error regarding my
client machine "Not Reported Status Yet" in the computers section. The
computer is added to a test group and this is a Fresh Windows XP SP" client,
2003 Server SP1.
My server is fine it's just the client where im having the problem.
Answer 1:
"Not Yet Reported" is a normal indication between the time a client first
registered (and probably is selfupdating), and completes a detection cycle,
including a reporting event. This delay is normally about 20-30 minutes,
though, so if it has been more than an hour since the client "Last
Contacted" the WSUS server, you may have a malfunction on the client side.
Start by running the Client Diagnostic Tool and posting the results. If the
output of the CDT looks normal (post the results anyway), then continue by
inspecting the %windir%\WindowsUpdate.log for error diagnostics.
Answer 2:
I don't know if it'll relate to your specific situation but I had an issue
last week where two pc's were imaged with the same Windows seat id from
Dell... WSUS will only recognize the most current machine put on the
network.
What actually happens it that WSUS recognizese the most recent machine that
/reports/ to the WSUS server if those machines have been built from
improperly prepared images.
If you're able to monitor the server closely, and frequently enough, you'll
actually see the machine name bounce between the two identical clients, as
each one executes a detection/reporting event.
Qeustion:
Just set WSUS up in a test enviroment and im getting an error regarding my
client machine "Not Reported Status Yet" in the computers section. The
computer is added to a test group and this is a Fresh Windows XP SP" client,
2003 Server SP1.
My server is fine it's just the client where im having the problem.
Answer 1:
"Not Yet Reported" is a normal indication between the time a client first
registered (and probably is selfupdating), and completes a detection cycle,
including a reporting event. This delay is normally about 20-30 minutes,
though, so if it has been more than an hour since the client "Last
Contacted" the WSUS server, you may have a malfunction on the client side.
Start by running the Client Diagnostic Tool and posting the results. If the
output of the CDT looks normal (post the results anyway), then continue by
inspecting the %windir%\WindowsUpdate.log for error diagnostics.
Answer 2:
I don't know if it'll relate to your specific situation but I had an issue
last week where two pc's were imaged with the same Windows seat id from
Dell... WSUS will only recognize the most current machine put on the
network.
What actually happens it that WSUS recognizese the most recent machine that
/reports/ to the WSUS server if those machines have been built from
improperly prepared images.
If you're able to monitor the server closely, and frequently enough, you'll
actually see the machine name bounce between the two identical clients, as
each one executes a detection/reporting event.
Commands for windows update service troubleshooting on the client machine
Commands for windows update service troubleshooting on the client machine:
UPdate the GPO manually:
update /force
display local policy on the client pc:
rsop.msc
Force detect WSUS server:
wuauclt /detectnow
UPdate the GPO manually:
update /force
display local policy on the client pc:
rsop.msc
Force detect WSUS server:
wuauclt /detectnow
2008-09-21
BDD vs SCCM OSDD
Original discussion:
http://www.eggheadcafe.com/software/aspnet/30951396/bdd-vs-sccm-os-deployment.aspx
Question:
Could some higlight the main details why SCCM OS deployment would be used
versus BDD 2007? Or could some one point me to the right source?
I would like to get the pros and cons for SCCM.
Thanks for any help.
Answer from Kim:
Main highlights:
1) SCCM 2007, and the dpeloyment 4 beta (successor to bdd 2007) can
handle server Deployments
2) SCCM 2007 can handle offline deployments (disconnected environments)
3) Sccm 2007 is much easier to use in a multi-location environment.
BDD 2007 is great with all the scripts, but that is what the deployment
4 beta will add to SCCM 2007. Take a look on
http://connect.microsoft.com for the deployment 4 beta, which is due out
in the next month or 2.
http://www.eggheadcafe.com/software/aspnet/30951396/bdd-vs-sccm-os-deployment.aspx
Question:
Could some higlight the main details why SCCM OS deployment would be used
versus BDD 2007? Or could some one point me to the right source?
I would like to get the pros and cons for SCCM.
Thanks for any help.
Answer from Kim:
Main highlights:
1) SCCM 2007, and the dpeloyment 4 beta (successor to bdd 2007) can
handle server Deployments
2) SCCM 2007 can handle offline deployments (disconnected environments)
3) Sccm 2007 is much easier to use in a multi-location environment.
BDD 2007 is great with all the scripts, but that is what the deployment
4 beta will add to SCCM 2007. Take a look on
http://connect.microsoft.com for the deployment 4 beta, which is due out
in the next month or 2.
Preparation Guide for Exam 70-401
Credit toward certification
When you pass Exam 70-401: TS: Microsoft System Center Configuration Manager 2007, Configuring, you complete the requirements for the following certification:
• Microsoft Certified Technology Specialist (MCTS): System Center Configuration Manager 2007, Configuration
Exam 70-401 also earns credit as an elective exam toward the following certifications:
• Microsoft Certified Systems Administrator (MCSA) on Windows Server 2003
• Microsoft Certified Systems Engineer (MCSE) on Windows Server 2003
Skills being measured
This exam measures your ability to accomplish the technical tasks listed in the following table. The percentages indicate the relative weight of each major topic area on the exam.
Skills measured by Exam 70-401
Deploying a System Center Configuration Manager 2007 (SCCM) Server (9 percent)
Set up and configure an Active Directory schema.
Migrate from an SMS 2003 hierarchy to SCCM 2007.
Configure an SCCM hierarchy.
Set up and configure security accounts.
Configuring an SCCM Infrastructure (19 percent)
Configure client agents.
Configure site boundaries.
Configure core site system roles.
Configure discovery methods.
Configure client installation.
Configure SCCM infrastructure for Internet-based client management.
Managing Resources (14 percent)
Build an SCCM collection by using queries.
Meter software usage.
Manage assets.
Manage inventory flow.
Manage client agents.
Distributing Applications (17 percent)
Manage packages.
Manage programs.
Manage advertisements.
Schedule distribution.
Track success/failure rates for distribution.
Manage distribution points.
Deploying Operating Systems (13 percent)
Capture a reference computer image.
Manage task sequences.
Configure site system roles related to Operating System Deployment.
Deploy operating system packages.
Customize user state migration.
Deliver applications.
Securing a Network Infrastructure (13 percent)
Configure Network Access Protection (NAP).
Maintain NAP.
Migrate from Inventory Tool for Microsoft Update (ITMU) to Windows Software Update Services (WSUS).
Deploy software updates.
Manage vulnerability compliance.
Managing and Maintaining an SCCM Infrastructure (15 percent)
Manage system health.
Configure automatic maintenance tasks.
Create custom reports.
Maintain clients.
Manage systems by using Desired Configuration Management.
Manage Wake On LAN
http://www.microsoft.com/learning/exams/70-401.mspx
When you pass Exam 70-401: TS: Microsoft System Center Configuration Manager 2007, Configuring, you complete the requirements for the following certification:
• Microsoft Certified Technology Specialist (MCTS): System Center Configuration Manager 2007, Configuration
Exam 70-401 also earns credit as an elective exam toward the following certifications:
• Microsoft Certified Systems Administrator (MCSA) on Windows Server 2003
• Microsoft Certified Systems Engineer (MCSE) on Windows Server 2003
Skills being measured
This exam measures your ability to accomplish the technical tasks listed in the following table. The percentages indicate the relative weight of each major topic area on the exam.
Skills measured by Exam 70-401
Deploying a System Center Configuration Manager 2007 (SCCM) Server (9 percent)
Set up and configure an Active Directory schema.
Migrate from an SMS 2003 hierarchy to SCCM 2007.
Configure an SCCM hierarchy.
Set up and configure security accounts.
Configuring an SCCM Infrastructure (19 percent)
Configure client agents.
Configure site boundaries.
Configure core site system roles.
Configure discovery methods.
Configure client installation.
Configure SCCM infrastructure for Internet-based client management.
Managing Resources (14 percent)
Build an SCCM collection by using queries.
Meter software usage.
Manage assets.
Manage inventory flow.
Manage client agents.
Distributing Applications (17 percent)
Manage packages.
Manage programs.
Manage advertisements.
Schedule distribution.
Track success/failure rates for distribution.
Manage distribution points.
Deploying Operating Systems (13 percent)
Capture a reference computer image.
Manage task sequences.
Configure site system roles related to Operating System Deployment.
Deploy operating system packages.
Customize user state migration.
Deliver applications.
Securing a Network Infrastructure (13 percent)
Configure Network Access Protection (NAP).
Maintain NAP.
Migrate from Inventory Tool for Microsoft Update (ITMU) to Windows Software Update Services (WSUS).
Deploy software updates.
Manage vulnerability compliance.
Managing and Maintaining an SCCM Infrastructure (15 percent)
Manage system health.
Configure automatic maintenance tasks.
Create custom reports.
Maintain clients.
Manage systems by using Desired Configuration Management.
Manage Wake On LAN
http://www.microsoft.com/learning/exams/70-401.mspx
Error:Task sequence cannot continue after reboot because TS Manager is not configured to auto-start or GINA is not installed
Error:
Task sequence cannot continue after reboot because TS Manager is not configured to auto-start or GINA is not installed
The Restart Computer action cannot be used to boot into a newly deployed operating system (or used to boot into the Full OS if a task sequence was started from WinPE) because the OS has not been configured to resume the task sequence. You will need to use the “Setup Windows and ConfigMgr” action which, when run after an “Apply Operating System Image” action, will configure the new operating system to resume the task sequence and reboot the machine.
The “Install an existing image package” option on the “Create a new task sequence” wizard should setup a task sequence that already has these steps.
Task sequence cannot continue after reboot because TS Manager is not configured to auto-start or GINA is not installed
The Restart Computer action cannot be used to boot into a newly deployed operating system (or used to boot into the Full OS if a task sequence was started from WinPE) because the OS has not been configured to resume the task sequence. You will need to use the “Setup Windows and ConfigMgr” action which, when run after an “Apply Operating System Image” action, will configure the new operating system to resume the task sequence and reboot the machine.
The “Install an existing image package” option on the “Create a new task sequence” wizard should setup a task sequence that already has these steps.
how to use command line and script to configure boot image from SCCM
rjarrett descripted how to use command line and script to configure boot image from SCCM
http://www.myitforum.com/forums/Add_boot_image_package_wizard_errors/m_178182/tm.htm
http://www.myitforum.com/forums/Add_boot_image_package_wizard_errors/m_178182/tm.htm
在不同日期格式下批处理输出自定义格式的日期和时间
在Windows系统中有不同的语言版本和时区设置。有时，由于业务的需求，我们需要生成“年月日”格式的日期格式目录，然后在该目录中生成时间格式的文件，用来记录系统当前时间的日志信息。
系统日期有yy-mm-dd，mm-dd-yy以及dd-mm-yy三种格式，这样导致了使用的不方便。下面介绍几种实现方法：
1. 有人通过预先修改windows注册表将日期改成yy-mm-dd格式然后通过发出命令：c:\> echo %date:~0,4%%date:~5,2%%date:~8,2%%time:~0,2%%time:~3,2%这种该注册表的方法显然不是很可取。
2. 还有人通过vbs来实现，制作成批处理文件内容如下：@echo off
echo wscript.echo year(date) ^& right(”0″ ^& month(date),2) ^& right(”0″ ^& day(date),2) ^& right(”0″ ^& hour(time),2) ^& right(”0″ ^& minute(time),2)>%tmp%\temp1.vbs
cscript /nologo %tmp%\temp1.vbs
del %tmp%\temp1.vbs
这种使用script的方式也不是很好。
3. 我认为最好的方式是，通过批处理中的for语句进行系统日期格式的判断，然后进行处理。批处理文件内容如下：
@ECHO OFF
ECHO. |DATE > temp1
FOR /F “eol=T tokens=5 delims=() ” %%i in (temp1) do set date_format=%%i
FOR /F “eol=E tokens=5,6,7,8 delims=/- ” %%a in (temp1) do (
IF /I %date_format% EQU mm-dd-yy ( set month=%%a
set day=%%b
set year=%%c
set week=%%d )
IF /I %date_format% EQU dd-mm-yy ( set day=%%a
set month=%%b
set year=%%c
set week=%%d )
IF /I %date_format% EQU yy-mm-dd ( set year=%%a
set month=%%b
set day=%%c
set week=%%d ) )
ECHO. |TIME > temp2
FOR /F “eol=E tokens=5-8 delims=:. ” %%A in (temp2) do ( set hour=%%A
set minute=%%B
set second=%%C
set hundredth=%%D )
REM TIME format 08:10:00 PM, it means 20:10:00
REM IF %meridiem% EQU PM SET /A %%hour%%=%%hour%%+12
SET current_date=%year%%month%%day%
SET current_time=%hour%%minute%%second%%hundredth%
IF EXIST temp1 DEL /Q temp1
IF EXIST temp2 DEL /Q temp2
ECHO Current date = %current_date%
ECHO Current time = %current_time%
MKDIR %current_date%
ECHO. > %current_date%\%current_time%.log
结论：最初我尝试使用交互式语句：SET /P variable=[promptString]来处理，让执行者预先输入日期格式。这样的话，目的是可以达到，但总觉得不爽。通过查询for /? 以及相关的信息完成任务，在上述三种日期格式中测试均合格。
From: http://blog.cnetnews.com.cn/?p=5580
系统日期有yy-mm-dd，mm-dd-yy以及dd-mm-yy三种格式，这样导致了使用的不方便。下面介绍几种实现方法：
1. 有人通过预先修改windows注册表将日期改成yy-mm-dd格式然后通过发出命令：c:\> echo %date:~0,4%%date:~5,2%%date:~8,2%%time:~0,2%%time:~3,2%这种该注册表的方法显然不是很可取。
2. 还有人通过vbs来实现，制作成批处理文件内容如下：@echo off
echo wscript.echo year(date) ^& right(”0″ ^& month(date),2) ^& right(”0″ ^& day(date),2) ^& right(”0″ ^& hour(time),2) ^& right(”0″ ^& minute(time),2)>%tmp%\temp1.vbs
cscript /nologo %tmp%\temp1.vbs
del %tmp%\temp1.vbs
这种使用script的方式也不是很好。
3. 我认为最好的方式是，通过批处理中的for语句进行系统日期格式的判断，然后进行处理。批处理文件内容如下：
@ECHO OFF
ECHO. |DATE > temp1
FOR /F “eol=T tokens=5 delims=() ” %%i in (temp1) do set date_format=%%i
FOR /F “eol=E tokens=5,6,7,8 delims=/- ” %%a in (temp1) do (
IF /I %date_format% EQU mm-dd-yy ( set month=%%a
set day=%%b
set year=%%c
set week=%%d )
IF /I %date_format% EQU dd-mm-yy ( set day=%%a
set month=%%b
set year=%%c
set week=%%d )
IF /I %date_format% EQU yy-mm-dd ( set year=%%a
set month=%%b
set day=%%c
set week=%%d ) )
ECHO. |TIME > temp2
FOR /F “eol=E tokens=5-8 delims=:. ” %%A in (temp2) do ( set hour=%%A
set minute=%%B
set second=%%C
set hundredth=%%D )
REM TIME format 08:10:00 PM, it means 20:10:00
REM IF %meridiem% EQU PM SET /A %%hour%%=%%hour%%+12
SET current_date=%year%%month%%day%
SET current_time=%hour%%minute%%second%%hundredth%
IF EXIST temp1 DEL /Q temp1
IF EXIST temp2 DEL /Q temp2
ECHO Current date = %current_date%
ECHO Current time = %current_time%
MKDIR %current_date%
ECHO. > %current_date%\%current_time%.log
结论：最初我尝试使用交互式语句：SET /P variable=[promptString]来处理，让执行者预先输入日期格式。这样的话，目的是可以达到，但总觉得不爽。通过查询for /? 以及相关的信息完成任务，在上述三种日期格式中测试均合格。
From: http://blog.cnetnews.com.cn/?p=5580
批处理文件详解－4
四、管道命令的使用
1.| 命令
Usage：第一条命令 | 第二条命令 [| 第三条命令...]
将第一条命令的结果作为第二条命令的参数来使用，记得在unix中这种方式很常见。
sample：
time /t>>D:\\IP.log
netstat -n -p tcp|find ":3389">>D:\\IP.log
start Explore
看出来了么？用于终端服务允许我们为用户自定义起始的程序，来实现让用户运行下面这个bat，以获得登录用户的IP。
2.>、>>输出重定向命令
将一条命令或某个程序输出结果的重定向到特定文件中, > 与 >>的区别在于，>会清除调原有文件中的内容后写入指定文件，而>>只会追加内容到指定文件中，而不会改动其中的内容。
sample1：
echo hello world>c:\\hello.txt (stupid example?)
sample2:
时下DLL木马盛行，我们知道system32是个捉迷藏的好地方，许多木马都削尖了脑袋往那里钻，DLL马也不例外，针对这一点我们可以在安装好系统和必要的应用程序后，对该目录下的EXE和DLL文件作一个记录：
运行CMD--转换目录到system32--dir *.exe>exeback.txt & dir *.dll>dllback.txt,
这样所有的EXE和DLL文件的名称都被分别记录到exeback.txt和dllback.txt中,
日后如发现异常但用传统的方法查不出问题时,则要考虑是不是系统中已经潜入DLL木马了.
这时我们用同样的命令将system32下的EXE和DLL文件记录到另外的exeback1.txt和dllback1.txt中,然后运行:
CMD--fc exeback.txt exeback1.txt>diff.txt & fc dllback.txt dllback1.txt>diff.txt.(用FC命令比较前后两次的DLL和EXE文件,并将结果输入到diff.txt中),这样我们就能发现一些多出来的DLL和EXE文件,然后通过查看创建时间、版本、是否经过压缩等就能够比较容易地判断出是不是已经被DLL木马光顾了。没有是最好，如果有的话也不要直接DEL掉，先用regsvr32 /u trojan.dll将后门DLL文件注销掉,再把它移到回收站里，若系统没有异常反映再将之彻底删除或者提交给杀毒软件公司。
3.< 、>& 、<&
< 从文件中而不是从键盘中读入命令输入。
>& 将一个句柄的输出写入到另一个句柄的输入中。
<& 从一个句柄读取输入并将其写入到另一个句柄输出中。
这些并不常用，也就不多做介绍。
No.5
五.如何用批处理文件来操作注册表
在入侵过程中经常回操作注册表的特定的键值来实现一定的目的，例如:为了达到隐藏后门、木马程序而删除Run下残余的键值。或者创建一个服务用以加载后门。当然我们也会修改注册表来加固系统或者改变系统的某个属性，这些都需要我们对注册表操作有一定的了解。下面我们就先学习一下如何使用.REG文件来操作注册表.(我们可以用批处理来生成一个REG文件)
关于注册表的操作，常见的是创建、修改、删除
1.创建
创建分为两种，一种是创建子项(Subkey)
我们创建一个文件，内容如下：
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\hacker]
然后执行该脚本，你就已经在HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft下创建了一个名字为“hacker”的子项。
另一种是创建一个项目名称
那这种文件格式就是典型的文件格式，和你从注册表中导出的文件格式一致，内容如下：
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]
"Invader"="Ex4rch"
"Door"=C:\\\\WINNT\\\\system32\\\\door.exe
"Autodos"=dword:02
这样就在[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]下
新建了:Invader、door、about这三个项目
Invader的类型是“String Value”
door的类型是“REG SZ Value”
Autodos的类型是“DWORD Value”
2.修改
修改相对来说比较简单，只要把你需要修改的项目导出，然后用记事本进行修改，然后导入（regedit /s）即可。
3.删除
我们首先来说说删除一个项目名称，我们创建一个如下的文件：
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]
"Ex4rch"=-
执行该脚本，[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]下的"Ex4rch"就被删除了；
1.| 命令
Usage：第一条命令 | 第二条命令 [| 第三条命令...]
将第一条命令的结果作为第二条命令的参数来使用，记得在unix中这种方式很常见。
sample：
time /t>>D:\\IP.log
netstat -n -p tcp|find ":3389">>D:\\IP.log
start Explore
看出来了么？用于终端服务允许我们为用户自定义起始的程序，来实现让用户运行下面这个bat，以获得登录用户的IP。
2.>、>>输出重定向命令
将一条命令或某个程序输出结果的重定向到特定文件中, > 与 >>的区别在于，>会清除调原有文件中的内容后写入指定文件，而>>只会追加内容到指定文件中，而不会改动其中的内容。
sample1：
echo hello world>c:\\hello.txt (stupid example?)
sample2:
时下DLL木马盛行，我们知道system32是个捉迷藏的好地方，许多木马都削尖了脑袋往那里钻，DLL马也不例外，针对这一点我们可以在安装好系统和必要的应用程序后，对该目录下的EXE和DLL文件作一个记录：
运行CMD--转换目录到system32--dir *.exe>exeback.txt & dir *.dll>dllback.txt,
这样所有的EXE和DLL文件的名称都被分别记录到exeback.txt和dllback.txt中,
日后如发现异常但用传统的方法查不出问题时,则要考虑是不是系统中已经潜入DLL木马了.
这时我们用同样的命令将system32下的EXE和DLL文件记录到另外的exeback1.txt和dllback1.txt中,然后运行:
CMD--fc exeback.txt exeback1.txt>diff.txt & fc dllback.txt dllback1.txt>diff.txt.(用FC命令比较前后两次的DLL和EXE文件,并将结果输入到diff.txt中),这样我们就能发现一些多出来的DLL和EXE文件,然后通过查看创建时间、版本、是否经过压缩等就能够比较容易地判断出是不是已经被DLL木马光顾了。没有是最好，如果有的话也不要直接DEL掉，先用regsvr32 /u trojan.dll将后门DLL文件注销掉,再把它移到回收站里，若系统没有异常反映再将之彻底删除或者提交给杀毒软件公司。
3.< 、>& 、<&
< 从文件中而不是从键盘中读入命令输入。
>& 将一个句柄的输出写入到另一个句柄的输入中。
<& 从一个句柄读取输入并将其写入到另一个句柄输出中。
这些并不常用，也就不多做介绍。
No.5
五.如何用批处理文件来操作注册表
在入侵过程中经常回操作注册表的特定的键值来实现一定的目的，例如:为了达到隐藏后门、木马程序而删除Run下残余的键值。或者创建一个服务用以加载后门。当然我们也会修改注册表来加固系统或者改变系统的某个属性，这些都需要我们对注册表操作有一定的了解。下面我们就先学习一下如何使用.REG文件来操作注册表.(我们可以用批处理来生成一个REG文件)
关于注册表的操作，常见的是创建、修改、删除
1.创建
创建分为两种，一种是创建子项(Subkey)
我们创建一个文件，内容如下：
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\hacker]
然后执行该脚本，你就已经在HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft下创建了一个名字为“hacker”的子项。
另一种是创建一个项目名称
那这种文件格式就是典型的文件格式，和你从注册表中导出的文件格式一致，内容如下：
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]
"Invader"="Ex4rch"
"Door"=C:\\\\WINNT\\\\system32\\\\door.exe
"Autodos"=dword:02
这样就在[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]下
新建了:Invader、door、about这三个项目
Invader的类型是“String Value”
door的类型是“REG SZ Value”
Autodos的类型是“DWORD Value”
2.修改
修改相对来说比较简单，只要把你需要修改的项目导出，然后用记事本进行修改，然后导入（regedit /s）即可。
3.删除
我们首先来说说删除一个项目名称，我们创建一个如下的文件：
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]
"Ex4rch"=-
执行该脚本，[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run]下的"Ex4rch"就被删除了；
批处理文件详解－3
三.如何使用组合命令(Compound Command)
1.&
Usage：第一条命令 & 第二条命令 [& 第三条命令...]
用这种方法可以同时执行多条命令，而不管命令是否执行成功
Sample：
C:\\>dir z: & dir c:\\Ex4rch
The system cannot find the path specified.
Volume in drive C has no label.
Volume Serial Number is 0078-59FB
Directory of c:\\Ex4rc
2002-05-14 23:51 14 sometips.gif
2.&&
Usage：第一条命令 && 第二条命令 [&& 第三条命令...]
用这种方法可以同时执行多条命令，当碰到执行出错的命令后将不执行后面的命令，如果一直没有出错则一直执行完所有命令；
Sample：
C:\\>dir z: && dir c:\\Ex4rch
The system cannot find the path specified.
C:\\>dir c:\\Ex4rch && dir z:
Volume in drive C has no label.
Volume Serial Number is 0078-59FB
Directory of c:\\Ex4rch
2002-05-14 23:55 14 sometips.gif
1 File(s) 14 bytes
2 Dir(s) 768,671,744 bytes free
The system cannot find the path specified.
在做备份的时候可能会用到这种命令会比较简单，如：
dir file://192.168.0.1/database/backup.mdb && copy file://192.168.0.1/database/backup.mdb E:\\backup
如果远程服务器上存在backup.mdb文件，就执行copy命令，若不存在该文件则不执行copy命令。这种用法可以替换IF exist了 ：）
3.||
Usage：第一条命令 || 第二条命令 [|| 第三条命令...]
用这种方法可以同时执行多条命令，当碰到执行正确的命令后将不执行后面的命令，如果没有出现正确的命令则一直执行完所有命令；
Sample：
C:\\Ex4rch>dir sometips.gif || del sometips.gif
Volume in drive C has no label.
Volume Serial Number is 0078-59FB
Directory of C:\\Ex4rch
2002-05-14 23:55 14 sometips.gif
1 File(s) 14 bytes
0 Dir(s) 768,696,320 bytes free
组合命令使用的例子：
sample：
@copy trojan.exe \\\\%1\\admin$\\system32 && if not errorlevel 1 echo IP %1 USER %2 PASS %3 >>victim.txt
1.&
Usage：第一条命令 & 第二条命令 [& 第三条命令...]
用这种方法可以同时执行多条命令，而不管命令是否执行成功
Sample：
C:\\>dir z: & dir c:\\Ex4rch
The system cannot find the path specified.
Volume in drive C has no label.
Volume Serial Number is 0078-59FB
Directory of c:\\Ex4rc
2002-05-14 23:51 14 sometips.gif
2.&&
Usage：第一条命令 && 第二条命令 [&& 第三条命令...]
用这种方法可以同时执行多条命令，当碰到执行出错的命令后将不执行后面的命令，如果一直没有出错则一直执行完所有命令；
Sample：
C:\\>dir z: && dir c:\\Ex4rch
The system cannot find the path specified.
C:\\>dir c:\\Ex4rch && dir z:
Volume in drive C has no label.
Volume Serial Number is 0078-59FB
Directory of c:\\Ex4rch
2002-05-14 23:55 14 sometips.gif
1 File(s) 14 bytes
2 Dir(s) 768,671,744 bytes free
The system cannot find the path specified.
在做备份的时候可能会用到这种命令会比较简单，如：
dir file://192.168.0.1/database/backup.mdb && copy file://192.168.0.1/database/backup.mdb E:\\backup
如果远程服务器上存在backup.mdb文件，就执行copy命令，若不存在该文件则不执行copy命令。这种用法可以替换IF exist了 ：）
3.||
Usage：第一条命令 || 第二条命令 [|| 第三条命令...]
用这种方法可以同时执行多条命令，当碰到执行正确的命令后将不执行后面的命令，如果没有出现正确的命令则一直执行完所有命令；
Sample：
C:\\Ex4rch>dir sometips.gif || del sometips.gif
Volume in drive C has no label.
Volume Serial Number is 0078-59FB
Directory of C:\\Ex4rch
2002-05-14 23:55 14 sometips.gif
1 File(s) 14 bytes
0 Dir(s) 768,696,320 bytes free
组合命令使用的例子：
sample：
@copy trojan.exe \\\\%1\\admin$\\system32 && if not errorlevel 1 echo IP %1 USER %2 PASS %3 >>victim.txt
Subscribe to:
Posts (Atom)
Posts
