Microsoft Intune provides support for iOS 10

Earlier Apple announced the availability of iOS 10 (with public release scheduled for 9/13/2016). Since the initial beta bits were first released, Microsoft have been busy working to ensure that all existing MDM and MAM scenarios are compatible with the latest version of iOS and Mirosoft has announced that Microsoft Intune will support iOS 10. All existing Intune features currently available for managing iOS devices will continue to work seamlessly as users upgrade their devices and apps to iOS 10. In addition, iOS 10 will also work with customers managing in hybrid with both Intune and Configuration Manager.

Goodbye Patch Tuesday

Patch Tuesday is soon to be a thing of the past. Beginning in October, Microsoft will deploy fixes for Windows 7, Windows 8.1, Windows Server 2008 and Windows Server 2012 with a single cumulative monthly patch. This is designed help reduce fragmentation across your company’s PCs. The new system is right in the line with how updates are currently deployed for Windows 10.

From October 2016 onwards, Windows will release a single Monthly Rollup that addresses both security issues and reliability issues in a single update. The Monthly Rollup will be published to Windows Update (WU), WSUS, SCCM, and the Microsoft Update Catalog. Each month’s rollup will supersede the previous month’s rollup, so there will always be only one update required for your Windows PCs to get current. i.e. a Monthly Rollup in October 2016 will include all updates for October, while November 2016 will include October and November updates, and so on. Devices that have this rollup installed from Windows Update or WSUS will utilize express packages, keeping the monthly download size small.

Windows will proactively add patches to the Monthly Rollup that have been released in the past. Microsoft's goal is eventually to include all of the patches we have shipped in the past since the last baseline, so that the Monthly Rollup becomes fully cumulative and you need only to install the latest single rollup to be up to date. We encourage you to move to the Monthly Rollup model to improve reliability and quality of updating all versions of Windows.Microsoft is planning to add these previously shipped patches over the next year and will document each addition so IT admins know which KBs have been included each month.

It’s a big departure from the current system, under which Microsoft sporadically releases individual patches for the older platforms. That has some advantages, allowing IT administrators to selectively deploy updates as needed, but it also comes with some serious drawbacks. Under the current system, individual PCs frequently wind up with different updates installed, which causes syncing problems, boosts scan times, and ups testing complexity. Even just pinpointing the right patches before applying them can be a pain.

Here’s how the new system will work. In October, up-to-date PCs running the older platforms will receive just a single package of security and stability fixes from Windows Update, Windows Server Update Services (WSUS), System Center Configurations Manager (SCCM) and the Microsoft Update Catalog. If you delay the update in October, you’ll be prompted to install it again in November, along with another single set of patches for that month, and so on. Each month’s update will include patches for all previously-uninstalled months, from October onwards.

older updates will begin to be included in the monthly patch rollouts, dating all the way back to Service Pack 1 for Windows 7. That means that — at some point — you’ll be able to get fully up to date with just a single installation, no matter the current state of your PC.

Microsoft is allowing one exception for its new all-in-one update system, affording the ability to download and deploy security patches separately from stability fixes. That will reduce the size of the initial update needed to secure your company’s PCs as quickly as possible. Those updates will be available from WSUS, SCCM and the Microsoft Update Catalog, not Windows Update.

Servicing Stack and Adobe Flash updates won’t be included in the rollups. Microsoft will move to the same monthly rollup model for the .NET Framework in October too.

for more about patch Tuesday see on Patch Tuesday

SCCM 1606 New features

If you’ve been installing SCCM Technical Preview in your lab, SCCM 1606 contain most features included in the latest technical previews.

Consult technical Articles for a full features list. 1606 also applies the latest KB/fixes to fix known bugs…. Including KB3155482 but not KB3174008 (which was release a week prior to 1606). If you had already installed KB3174008, 1606 will revert the fixes included in KB3174008. Microsoft recommendation is to skip this KB (unless you are really blocked by this), update to 1606 and wait for a new KB that will be available for 1606 soon. (Which will include KB3174008).

Here’s our list of favorite features

• Option for clients to switch to a new software update point
  • You can enable the option for Configuration Manager clients to switch to a new software update point when there are issues with the active software update point.
• Per-app VPN for Windows 10 devices
  • For Windows 10 devices managed using Configuration Manager with Intune, you can add a list of apps that automatically open a VPN connection that you have configured through the Configuration Manager admin console. You have the option of restricting VPN traffic to those apps, or you can continue to allow all traffic through the VPN connection.
• Customize the RamDisk TFTP block size and window size on PXE-enabled distribution points
  • You can customize the RamDisk TFTP block size and window size for PXE-enabled distribution points. If you have customized your network, it could cause the boot image download to fail with a time-out error because the block or window size is too large. The RamDisk TFTP block size and window size customization allow you to optimize TFTP traffic when using PXE to meet your specific network requirements
• Improvements to the Install software updates task sequence
  • A new task sequence variable, SMSTSSoftwareUpdateScanTimeout, is available to give you the ability to control the timeout on the software updates scan during the Install software updates task sequence step. The default value is 30 minutes.
  • There have been improvements to logging. The smsts.log log file will contain new log entries that reference other log files that will help you to troubleshoot issues during the software updates installation process.

Cireson ConfigMgr User Device Affinity app

The User Device Affinity app enables administrators, help desk staff, and other users to easily search, view, edit, and manage user to device relationships outside of the Configuration Manager Console.

With the User Device Affinity app, you can easily:

1. View existing user to device relationships
2. Associate new users to existing devices
3. Remove users from existing devices
4. Add new devices to existing users
5. Remove devices from existing users
6. Search and filter users and devices for management of UDA relationships
7. Launch Remote Manage in the context of a computer

Associating users to their primary devices (user device affinity) is a great feature of Configuration Manager. It allows you to easily deploy applications to a user’s primary device (often referred to as ‘user centric software delivery’). It also provides helpful information to your Help Desk so when a user calls in for support, they can have information on what computer they might be using. The problem with user device affinity is getting it configured, and configured correctly, in your environment. There are over a half dozen ways to associate users to computers – some automated, however most manual – which can lead to mistakes. The Cireson User Device Affinity app easily allows an administrator to view and manage the relationships between users and devices. This process is completed outside the Configuration Manager Console, which reduces complexity and confusion.

Thanks to Cireson, who made this fantastic tool.

for more detail and download the tool visit on cireson 

credit goes to Cireson. 

Current Branch Update ConfigMgr 1602

Microsoft announced the release today of System Center Configuration Manager (SCCM) 1602, which is the latest update to its device management product. The "1602" part of the update's name refers to its year and month release time (as in "2016 February"), but Microsoft announced its arrival today in March. It's just an update and not a new current branch for business release.

The current branch of System Center Configuration Manager was released on December 8, 2015. Today's announcement was the first update for the current branch with new features, not a brand new release.

SCCM as a Service
Microsoft now updates SCCM like the service model of Windows 10, with updates pushed down at certain intervals, called "current branch" and "current branch for business" for summer and fall releases. There's also a "long-term servicing branch" option for Windows 10. Possibly, Windows 10 will get an altered update cycle with this year's releases

Prior to this update, the current branch release of SCCM was known as "1511" (for "2015 November"). Microsoft announced the SCCM 1511 current branch in December.

A new current branch update is supposed to appear every month, per past Microsoft descriptions of its update process. A new current branch for business update is expected to appear every four months, so 1602, released after three months, wasn't the next current branch for business release.

These updates appear in the Updates and Servicing node of SCCM's console.

Microsoft has a similar update model for Office 365, but it uses slightly different terminology. "Branches" are called "channels" for Office 365 updates. Office 365 has "current channel" updates every month and "deferred channel" updates every four months.

If we fail to update to the next current branch for business after eight months' time, then we risk running "unsupported software." That means that the software will no longer get updates and security patches, a risky situation.

SCCM 1602 Perks
Organizations are getting plenty of perks with SCCM 1602. It enables in-place upgrades of Windows Server 2008 R2 to Windows Server 2012 R2.Other benefits include the ability to see the clients that are online and view the "health" of Windows 10 devices.

Another big benefit of SCCM 1602 concerns the management of Office 365 clients. They can be managed using SCCM's "Software Update Management workflow." This capability is possible for "Office 365 ProPlus, Visio Pro for Office 365 and Project Pro for Office 365,"

Intune-SCCM Management
Microsoft also announced new capabilities with SCCM 1602 when integrated with Microsoft Intune, which is Microsoft's mobile device management service. Organizations can use Intune as a standalone tool or it can be integrated with SCCM. The standalone tool tends to get its new capabilities faster than the integrated SCCM solution.

One new capability in the integrated Intune-SCCM solution is the ability to impose conditional access on devices. we can now specify with SCCM 1602 that devices have to have current software updates, antimalware protection and BitLocker encryption to connect with a network.

SCCM 1602 with Intune also permits Microsoft Edge browser deployments to devices. Edge browser settings can be changed with the SCCM 1602-Intune combo.

Some management capabilities for Apple iOS devices are unlocked with SCCM 1602 and Intune. we can set policies to "dynamically change settings such as server name or port for iOS applications."  They can enable iOS Activation Lock on devices or they can bypass it.

This update includes the following improvements:

• Client Online Status: You can now view the online status of devices in Assets and Compliance. New icons indicate the status of a device as online or offline.
• Support for SQL Server AlwaysOn Availability Groups: Configuration Manager now supports using SQL Server AlwaysOn Availability Groups to host the site database.
• Windows 10 Device Health Attestation Reporting: You can now view the status of Windows 10 Device Health Attestation in the Configuration Manager console to ensure that the client computers have a trustworthy BIOS, TPM, and boot software.
• Office 365 Update Management: You can now natively manage Office 365 desktop client updates using the Configuration Manager Software Update Management (SUM) workflow. You can manage Office 365 desktop client updates just like you manage any other Microsoft Update.
• New Antimalware Policy Settings: New antimalware settings that can now be configured include protection against potentially unwanted applications, user control of automatic sample submission, and scanning of network drives during a full scan.
• Windows 10 Servicing: New improvements were added based on your feedback such as filters in servicing plans for upgrades that meet specified criteria, integration with deployment verification and a dialog in Software Center when starting an upgrade.

This update also includes new features for customers using System Center Configuration Manager integrated with Microsoft Intune. Some of the features that you can expect to see are:

• Conditional Access for PCs Managed by Configuration Manager: You can now use conditional access capabilities to help secure access to Office 365 and other services on PCs managed with Configuration Manager agent. Conditions that can be used to control access include: Workplace Join, BitLocker, Antimalware, and Software Updates.
• Windows 10 Conditional Access Enhancements: For Windows 10 devices that are managed through the Intune MDM channel, you can now set and deploy an updated Compliance Policy that includes additional compliance checks and integration with Health Attestation Service.
• Microsoft Edge Configuration Settings: You can now set and deploy Microsoft Edge settings on Windows 10 devices.
• Windows 10 Team Support: You can now set and deploy Windows 10 Team configuration settings.
• Apple Volume Purchase Program (VPP) Support: You can now manage and deploy applications purchased through the Apple Volume Purchase Program for Business portal.
• iOS App Configuration: You can now create and deploy iOS app configuration policies to dynamically change settings such as server name or port for iOS applications that support these configurations.
• iOS Activation Lock Management: New capabilities include enabling iOS Activation Lock management, querying for the status, retrieving bypass codes, and performing an Activation Lock bypass on corporate-owned iOS devices.
• Kiosk Mode for Samsung KNOX Devices: Kiosk mode allows you to lock a managed mobile device to only allow certain apps and features.
• User Acceptance of Terms and Conditions: You can now see which users have or have not accepted the deployed terms and conditions.

.

Failed to sync update fc5e8c16-7b3b-409f-8e42-5ffb3c1cf09d WSUS Synchronization failed with SCCM.

Today I faced a problem with WSUS Synchronization the update on SCCM.

This problem was annoying me. I can sync my WSUS db from Microsoft ok. But for some reason I am getting this error in SCCM.

Failed to sync update fc5e8c16-7b3b-409f-8e42-5ffb3c1cf09d. Error: The Microsoft Software License Terms have not been completely downloaded and cannot be accepted

It prevents my scheduled sync from passing and then it attempts to re-sync every 60 mins.

That above issue is known for MS and it’s often.

To resolve that issue you should have to run the following command on the WSUS server.

At the command line %drive%\Program Files\Update Services\Tools>, type:

Wsusut reset

Once you run the above command after that start the synchronization once again and you will see the synchronization.

Configuration Manager Content Library

The content library is a new concept that was introduced in System Center 2012 Configuration Manager.  In a nut-shell, the content library stores all the Configuration Manager content efficiently on the disk.  If the same file is part of two different packages, it stores only one copy in the content library.  However, references are kept indicating that the file is part of both the packages.

The focus of this blog is to provide more insights on what happens behind the scenes and help Configuration Manager users and administrators to understand the concept better.

Note: The content library is also known as the “single-instance store”, referring to the single instance of any particular file.

Rationale for the Content Library

The rationale for content library is to optimize disk storage and to avoid distributing a file that already exists on the distribution points.

If two different packages each contain a particular file that is identical (even if the file names are different), only one copy of this file will be stored by the content library.  This minimizes the disk space consumption.

When distributing a package, we first analyze all the files in that package. If a file to be distributed is already present on the distribution point as part of another package or part of a previous version of the same package, that file is not copied to the distribution point.  Instead, we add a mapping reference between that file and the new package that we are distributing. This helps reduce the network traffic by not copying files that already exist.  Additionally, it allows for more rapid provisioning of packages on the distribution point.

Location of the Content Library

A copy of the content library (containing all packages) is housed on the site server (as the source for distribution points).  Moreover, each distribution point will have a copy (as the source for clients), containing the packages distributed to the distribution point.  The content library is designed to optimize both network and disk usage in the distribution process.  This helps to keep our customers’ costs lower and efficiency higher.

The content library is typically stored on the root of a drive in a folder called “SCCMContentLib”.  This folder is shared and has restricted permissions to prevent accidental damage.  Within this are the Package Library (“PkgLib” folder), the Data Library (“DataLib” folder), and the File Library (“FileLib” folder).  The Package Library contains information about what packages are present on the distribution point.  The Data Library contains information about the original structure of the packages.  The File Library contains the original files in the package; this is typically where the bulk of the storage is used.

For instance, in the screenshot below, the content library is located on the root of the C: drive, in C:\SCCMContentLib.  It is shared as “SCCMContentLib$”.  Regardless of which drive the content library is located on, the primary share location will always be “SCCMContentLib$”.

Screenshot

 

Diagram

 

Package Library

The starting point for exploring the content library is the Package Library folder, “PkgLib”.  Within this folder will be several files, one for each package distributed to the distribution point.  The name will be the package ID, e.g. ABC00001.INI.  In this file is a list of contents IDs (under the “[Packages]” section) that are part of the package, as well as other information, such as the version.  Using these content IDs, we can continue exploring the contents of the content library.  Let us assume that ABC00001 is a legacy-style package, at version 1.  Thus, the content ID in this file will be ABC00001.1.

Data Library

Once we have found the content IDs we are interested in, we can continue exploring the content library.  In the Data Library folder, “DataLib”, there will be one file and one folder for each of the contents in each package.  This file and folder will be named, for example, ABC00001.1.INI and ABC00001.1, respectively.  The file contains information for validation.  Inside the folder, the folder structure from the original package is recreated. 

However, the files in the Data Library are replaced by INI files that have the name of the original file in the package, e.g. MyFile.exe.INI.  These files contain information about the original file, such as the size, time modified, and the hash.  The first four characters of the hash will help us find where the original file is in the File Library.  Suppose the hash in MyFile.exe.INI is “DEF98765”.  Thus, the first four characters are “DEF9”.

File Library

The last step in exploration is locating the file in the File Library, “FileLib”.  If the content library is spanned across multiple drives, the files could be in the File Library on any of these drives.

Using the first four characters from the hash found in the Data Library, we can locate the file.  Inside the File Library folder(s) will be many folders, each with a four-character name.  Find the folder that matches the first four characters from the hash.  Remember that the folder may be in the File Library on a different drive.

Once this folder is found, it will contain one or more sets of three files.  These three will share the same name, but one will have the extension INI, one will have the extension SIG, and one will not have any extension.  The file with no extension whose name is equal to the hash found above is the original file.

Using the example above, we would look for folder “DEF9”, containing “DEF98765.INI”, “DEF98765.SIG”, and “DEF98765”.  Here, “DEF98765” is MyFile.exe.  Additionally, in the INI file, there will be a list of “users”; these are content IDs that share the file.  The file will never be removed unless all of these contents are also removed.

Difference Between Distribute, Update, and Redistribute Actions

The first major action pertaining to content distribution is the Distribute action.  This refers to the initial distribution of a package to a distribution point.  This is triggered with Distribute Content in the Configuration Manager console.  This will transfer all files in a package to the target distribution points, excluding those which are already present as part of another package—these will become shared.

The second major action is the Update action.  This is typically used when a package has been changed and all distribution points to which it is distributed need the updated content.  This is triggered with Update Distribution Points in the console.  This will transfer the changed files to all distribution points.  Unchanged files will not be transferred.  If a file is removed from the package in the updated version, it will be deleted from the package on the distribution point (as long as no other packages are sharing it).

The third major action is the Redistribute action, triggered with Redistribute in the Configuration Manager console.  This will transfer the entire content to a specific distribution point.  Files will still be transferred and overwritten even if they are already present on the distribution point.  The chief purpose of the Redistribute action is to correct any inconsistencies that may exist in the content library.

Content Library Explorer

There is a new tool available in the System Center 2012 R2 Configuration Manager toolkit called “Content Library Explorer”.  This tool facilitates user-friendly exploration of the contents of the content library.  This tool cannot be used to modify the contents, but can provide insight into what is present, as well as allowing validation and redistribution.  Please refer to the toolkit documentation for more information. This documentation is installed with the toolkit.  There is typically a shortcut for it in the start menu called "System Center 2012 R2 Configuration Manager Toolkit Help".

Drive Spanning

The content library can be spanned across multiple drives.  These drives can be manually chosen by the administrator at the time the distribution point is created.  Alternatively, they can be chosen automatically by Configuration Manager (this is the default setting).

If they are chosen by the administrator, a primary and secondary drive can be chosen.  On the primary drive, all metadata will be stored.  Only the File Library will be spanned across to the secondary drive.  On secondary drives, the folder’s share name includes the drive letter.  For instance, if D: and E: are secondary drives for the content library, the share names would be “SCCMContentLibD$” and “SCCMContentLibE$”, respectively.

If “Automatic” is chosen, Configuration Manager selects the drive with the most available free space as its primary drive.  All of the metadata will be stored on this drive.  Only the File Library will be spanned across to secondary drives.  The administrator selects a reserve space amount; Configuration Manager attempts to use a secondary disk once the best available disk has only this reserve space amount left free.  Each time a new drive is selected for use, the drive with the most available free space is selected.

Currently it is not possible to specify that a distribution point should use all drives except for a specific set from the console.  It can be prevented by creating an empty file on the root of the drive, called exactly “NO_SMS_ON_DRIVE.SMS”.  This file must be present before the drive is selected for use by Configuration Manager.  If Configuration Manager detects this file on the root of the drive, it will not use the drive for the content library.  Additionally, there is a command-line tool in the toolkit for permanently moving the content library to a different drive, called “ContentLibraryTransfer.exe”.

Azure Distribution Points

Azure distribution points do not use single instancing.  This is because packages are encrypted before they are sent, and each package has a unique encrypted key.  So, even if two files were identical, the encrypted versions would not be.

Troubleshooting

Here are a few tips for troubleshooting issues with the content library:

• Check the logs on both the site server (distmgr.log and PkgXferMgr.log) as well as on the distribution point (smsdpprov.log) for any pointers to the failures.
• Use the Content Library Explorer tool to gain any additional insights.
• Check if there are any file locks by other processes (e.g. antivirus) or other software.  It is a good practice to exempt the content library on all drives from automatic antivirus scans, as well as the temporary staging directory, “SMS_DP$”, on each drive.
• If you still have issues you can try Validating the package from the Configuration Manager console and see if there are any hash mismatches.
• As a last option, you can redistribute the content which should resolve the issue.

Orphaned Contents

On occasion, it is possible for, files, contents, or packages to be orphaned on a distribution point—they are not distributed to the distribution point, but due to an error during deletion, they were not deleted.  Often this is due to external programs (such as antivirus) having file locks on the content when deletion is attempted by Configuration Manager.

This is a known issue.  The operability of Configuration Manager is not affected; the distribution point will still function as intended.  However, this orphaned content can waste disk space.  We are investigating ways to clean up the existing orphaned content in future releases of the toolkit, as well as fixing the product to ensure that no future content is orphaned.

http://blogs.technet.com/b/configmgrteam/archive/2013/10/29/understanding-the-configuration-manager-content-library.aspx