Set up cloud management gateway for Configuration Manager

Today we will talk about ho to setup the cloud management gateway in our SCCM environment which is available with SCCM CB 1610

Step:-1 Create SSL certificate

You can create a custom SSL certificate for cloud management gateway in the same way you would do it for a cloud-based distribution point. Follow the instructions for Deploying the Service Certificate for Cloud-Based Distribution Points but do the following things differently:

When setting up the new certificate template, give Read and Enroll permissions to the security group that you set up for Configuration Manager servers.

When requesting the custom web server certificate, provide an FQDN for the certificate's common name that ends in cloudapp.net for using cloud management gateway on Azure public cloud or usgovcloudapp.net for the Azure government cloud.

Step 2: Export the client certificate's root

The easiest way to get export the root of the client certificates used on the network, is to open a client certificate on one of the domain-joined machines that has one and copy it.

In the Run window, type mmc and press Return.

On the File menu in the management console, click Add/Remove Snap-in....

In the Add or Remove Snap-ins dialog box, click Certificates, click Add >, click Computer account, click Next, click Local computer, and then click Finish. Click OK to close the dialog box.

Go to Certificates > Personal > Certificates.

Double-click the certificate for client authentication on the computer, click the Certification Path tab, and double-click the root authority (at the top of the path).

Click the Details tab, and click Copy to File....

Complete the Certificate Export Wizard using the default certificate format. Make note of the name and location of the root certificate you create. You will need it to configure cloud management gateway in a later step.

Step 3: Upload the management certificate to Azure

An Azure management certificate is required for Configuration Manager to access the Azure API and configure cloud management gateway.

Upload an Azure Management API Management Certificate

Make sure to copy the subscription ID associated with the management certificate. You will need it for configuring cloud management gateway in the Configuration Manager console in the next step.

Step 4: Set up cloud management gateway

In the Configuration Manager console, go to Administration > Cloud Services > Cloud Management Gateway.

Click Create Cloud Management Gateway.

In Create Cloud Management Gateway Wizard, enter your Azure subscription ID (copied from the Azure management portal), click Browse, and select the certificate file you used to upload as an Azure management certificate. Click Next. Wait a few moments for the console to connect to Azure.

Fill out the additional details in the wizard:

Specify the name for the service which will run in Azure. Service name must be alphanumeric characters only and 3-24 characters in length.

Choose the Azure region you want the service to run in.

Specify the number of virtual machines you want to use for the service. The default is 1, but you can run up to 16 virtual machines for the service.

If you use an internet proxy for the cloud management gateway connection point, you need to increase the number of ports on the proxy by the number of virtual machines you use, starting at port 10124.

Specify the private key (.pfx file) that you exported from the custom SSL certificate.

Specify the root certificate exported from the client certificate.

Specify the same service name FQDN that you used when you created the new certificate template. You must specify the one of the following suffixes for the FQDN service name based on the Azure cloud you are using:

Azure cloud FQDN prefix

Public (commercial) cloud .cloudapp.net

Government cloud .usgovcloudapp.net

Clear the box next to Verify Client Certificate Revocation (unless you're publicly publishing your CRL information).

Click Next when you're done.

If you want to monitor cloud management gateway traffic with a 14-day threshold, click check box to turn on the threshold alert. Then, specify the threshold (in GB) and the percentage at which to raise the different alert levels. Click Next when your done.

Review the settings, and click Next. Configuration Manager starts setting up the service. When the wizard completes, you can click Close, however it will take between 5 to 15 minutes to provision the service completely in Azure. Check the Status column for the newly setup cloud management gateway to determine when the service is ready.

Step 5: Configure primary site for client certification authentication

In the Configuration Manager console, go to Administration > Site Configuration > Sites.

Select the primary site for the clients you want to manage through cloud management gateway, and click Properties.

On the Client Computer Communications tab of the primary site property sheet, check the box next to Use PKI client certificate (client authentication) when available.

Make sure to clear the box next to Clients check the certificate revocation list (CRL) for site systems. This option would only be required if you were publicly publishing your CRL.

Click OK.

Step 6: Add the cloud management gateway connector point

The cloud management gateway connector point is a new site system role for communicating with cloud management gateway. To add the cloud management gateway connector point, follow the instructions in Add site system roles for System Center Configuration Manager.

Step 7: Configure roles for cloud management gateway traffic

The final step in setting up cloud management gateway is to configure the site system roles to accept cloud management gateway traffic. For Tech Preview 1606, only the management point, distribution point, and software update point roles are supported for cloud management gateway. You must configure each role separately.

In the Configuration Manager console, go to Administration > Site Configuration > Servers and Site System Roles.

Click the site system server for the role you want to configure for cloud management gateway traffic.

Click the role, and then click Properties.

In the role Properties sheet, under Client Connections, choose HTTPS, check the box next to Allow Configuration Manager cloud management gateway traffic, and then click OK. Repeat these steps for the remaining roles.

Step 8: Configure clients for cloud management gateway

After the cloud management gateway and site system roles are completely configured and running, clients will get the location of the cloud management gateway service automatically on the next location request. Clients must be on the corporate network to receive the location of the cloud management gateway service. The polling cycle for location requests is every 24 hours. If you don't want to wait for the normally scheduled location request, you can force the request by restarting the SMS Agent Host service (ccmexec.exe) on the computer.

With the location of the cloud management gateway service configured on the client, it can automatically determine whether it’s on the intranet or the Internet. If the client can contact the domain controller or the on-premises management point, it will use it for communicating with Configuration Manager, Otherwise, it will consider it’s on the Internet and use the location of the cloud management gateway service to communicate.

You can force the client to always use cloud management gateway regardless of whether it’s on the intranet or Internet. To do that, you set the following registry key on the client computer:\

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CCM\Security, ClientAlwaysOnInternet = 1

To verify that clients can contact Configuration Manager, you can run the following PowerShell command on the client computer:

gwmi -namespace root\ccm\locationservices -class SMS_ActiveMPCandidate

This command displays the management points the client can contact including the cloud management gateway service.

Changes to Software Updates on Down Level Operating Systems for ConfigMgr Admins

I wanted to share the information with you about much awaited patch Tuesday, which is live now, now Microsoft is releasing only Quality update (Monthly Quality rollup and Monthly Quality)

Now days gone for having multiple KB’s and updates for each operating system and components, we will have only one quality update, which is really great.

And important thing Quality update will not be available on windows update, so users can’t install them directly on their machines.

From Patch Tuesday in October 2016, there will be 3 update types released for each Windows version and architecture. The updates are described in the table below:

Update Type	Description	Release Time	Classification	Windows Update	WSUS	Windows Update Catalog
Monthly Rollup	Includes security fixes, reliability fixes, bug fixes, etc. Supersedes and includes all updates provided previously.	2nd Tuesday	Security	Yes	Yes	Yes
Security only	Security fixes released this month	2nd Tuesday	Security	No	Yes	Yes
Monthly Rollup Preview	Includes all previous security updates, and new reliability fixes, bug fixes, etc. Does not include new security fixes on top of the Monthly Rollup.	3rd Tuesday	Updates	No	Yes	Yes

The updates will have names of the format:

Update Type	Name Format	Example
Monthly Rollup	[Month, Year] Security Monthly Quality Rollup for [OS] [architecture] (KB #)	October, 2016 Security Monthly Quality Rollup for Windows Server 2012 R2 (KB3185331)
Security Only	[Month, Year] Security Only Quality Update for [OS] [architecture] (KB #)	October, 2016 Security Only Quality Update for Windows Server 2012 R2 (KB3192392)
Monthly Rollup Preview	[Month, Year] Preview of Monthly Quality Rollup for [OS] [architecture] (KB #)

So here you can see for Window’s 8.1 x64 bit we have only one update that is Quality and one for monthly rollup, same for other OS also.

Tested that, all updates installed very fast and compliance are increased from previous month. Because there is no multiple updates. Nothing is going to change in ConfigMgr, just need to update patching document  :P

And one more the next current branch of #SCCM (CB1610) will support the Express updates format, for delta updates of windows.

For more detail about the Patch Tuesday… see the following link.

https://blogs.technet.microsoft.com/configmgrdogs/2016/10/11/changes-to-software-updates-on-down-level-operating-systems-for-configmgr-admins/

https://blogs.technet.microsoft.com/enterprisemobility/2016/10/07/configuration-manager-and-simplified-windows-servicing-on-down-level-operating-systems/

Update 1609 for System Center Configuration Manager Technical Preview

Today Microsoft has released update 1609 for System Center Configuration Manager Technical Preview. Technical Preview releases give an opportunity to try out new Configuration Manager features in a test environment before they are made generally available. This month’s new preview features include:

• Windows 10 Upgrade Analytics – Assess and analyze device readiness and compatibility with Windows 10 to allow smoother upgrades.  This is done through integration with Windows Upgrade Analytics.
• Office 365 Client Management Dashboard – Use the Office 365 client management dashboard to track Office 365 updates and deployments.
• Deploy Office 365 apps to clients – We have added a new Office 365 Servicing node in the Software Library where you can deploy Office 365 apps to clients.
• Improvements for BIOS to UEFI conversion – An OS deployment task sequence can now be customized with a new variable, TSUEFIDrive, so that the Restart Computer step will prepare the drive for transition to UEFI. See the documentation for additional details on the necessary customizations.
• Improvement to Endpoint Protection antimalware policy settings – You can now specify the level at which the Endpoint Protection Cloud Protection Service will block suspicious files.
• Boundary Group Improvements – Improvements have been made to boundary groups to allow more granular control of fallback behavior, and greater clarity of what distribution points are used.

This release also includes the following new features for customers using System Center Configuration Manager connected with Microsoft Intune to manage mobile devices:

• TouchID, ApplePay and Zoom DEP Settings – DEP provides the ability for admins to create enrollment profiles to skip initial setup screens for new iOS devices. TouchID, ApplePay and Zoom have now been added as options to configure in the iOS enrollment profiles.
• Windows Store for Business – Windows Store for Business allows customers to obtain applications (purchased or free) and deploy them to users in their organization.
• Android, iOS, and Windows Additional Settings – New settings have been added for Android, iOS, and Windows.
• Native Connection Types for Windows 10 VPN Profiles– You can now create Windows 10 VPN profiles with Microsoft Automatic, IKEv2, and PPTP connection types in the Configuration Manager console without using OMA-URI.
• Intune Compliance Charts – Admins can get a quick view of overall device compliance, and top reasons for non-compliance using new charts under the Monitoring.

Update 1609 for Technical Preview is available in the Configuration Manager console. To install Configuration Manager Technical Preview for the first time, the installation bits (currently based on Technical Preview 1603) areavailable on TechNet Evaluation Center.

Source: Enterprise Mobility and Security Blog
Detailed overview of new features: Microsoft TechNet

Restore SCCM Report

Recently I had lot of questions how to restore the SCCM reports which are accidently deleted by SCCM users.

first option comes in my mind that is simply restore the DB will work, but again I have thought and the following trick works.

Navigate to registry - HKEY_Local_Machine\Software\Microsoft\SMS\SRSRP\ change the SRSInitializeState  key to 0 and monitor the srsrp.log file. It will re-import the standard reports along with the custom security settings.

and now issue is gone and all the default reports are appeared again in SCCM.

Configuration Manager and Windows ADK for Windows 10, version 1607

If you are using Configuration Manager and you are planning to deploy Windows 10, version 1607, This page explains the support matrix for Configuration Manager versions and Windows 10 versions. 

The Windows Assessment and Deployment Kit (ADK) for Windows 10, version 1607, is available on the Microsoft Hardware Dev Center (adksetup.exe file version 10.1.14393.0).

The newer ADK is only needed if deploying Windows 10, version 1607

MS have limited support for Windows 10, version 1607, in Configuration Manager version 1602. Users who are still on this version of Configuration Manager and will be deploying the newer version of Windows 10 can upgrade the ADK to the latest version if desired, or remain with the prior version, Windows ADK for Windows 10, version 1511. Beyond that, MS do not support deployment of Windows 10, version 1607, with older versions of Configuration Manager. So the need for this new version of the Windows ADK does not apply.

	Windows 10 ADK Version
ConfigMgr Version		1507	1511	1607
	1511	Supported	Supported
	1602	Supported	Supported 1	Supported 2
	1606		Supported 1	Supported

1 The Windows ADK for Windows 10, version 1511, provides basic forward compatibility and can be used for image capture, image apply, driver injection, and offline update servicing of Windows 10, version 1607, if absolutely necessary. We strongly recommend upgrading to the latest ADK version, but basic forward compatibility is supported during the transition period.

2  The newer ADK is only needed if deploying Windows 10, version 1607.

Microsoft Intune provides support for iOS 10

Earlier Apple announced the availability of iOS 10 (with public release scheduled for 9/13/2016). Since the initial beta bits were first released, Microsoft have been busy working to ensure that all existing MDM and MAM scenarios are compatible with the latest version of iOS and Mirosoft has announced that Microsoft Intune will support iOS 10. All existing Intune features currently available for managing iOS devices will continue to work seamlessly as users upgrade their devices and apps to iOS 10. In addition, iOS 10 will also work with customers managing in hybrid with both Intune and Configuration Manager.

Goodbye Patch Tuesday

Patch Tuesday is soon to be a thing of the past. Beginning in October, Microsoft will deploy fixes for Windows 7, Windows 8.1, Windows Server 2008 and Windows Server 2012 with a single cumulative monthly patch. This is designed help reduce fragmentation across your company’s PCs. The new system is right in the line with how updates are currently deployed for Windows 10.

From October 2016 onwards, Windows will release a single Monthly Rollup that addresses both security issues and reliability issues in a single update. The Monthly Rollup will be published to Windows Update (WU), WSUS, SCCM, and the Microsoft Update Catalog. Each month’s rollup will supersede the previous month’s rollup, so there will always be only one update required for your Windows PCs to get current. i.e. a Monthly Rollup in October 2016 will include all updates for October, while November 2016 will include October and November updates, and so on. Devices that have this rollup installed from Windows Update or WSUS will utilize express packages, keeping the monthly download size small.

Windows will proactively add patches to the Monthly Rollup that have been released in the past. Microsoft's goal is eventually to include all of the patches we have shipped in the past since the last baseline, so that the Monthly Rollup becomes fully cumulative and you need only to install the latest single rollup to be up to date. We encourage you to move to the Monthly Rollup model to improve reliability and quality of updating all versions of Windows.Microsoft is planning to add these previously shipped patches over the next year and will document each addition so IT admins know which KBs have been included each month.

It’s a big departure from the current system, under which Microsoft sporadically releases individual patches for the older platforms. That has some advantages, allowing IT administrators to selectively deploy updates as needed, but it also comes with some serious drawbacks. Under the current system, individual PCs frequently wind up with different updates installed, which causes syncing problems, boosts scan times, and ups testing complexity. Even just pinpointing the right patches before applying them can be a pain.

Here’s how the new system will work. In October, up-to-date PCs running the older platforms will receive just a single package of security and stability fixes from Windows Update, Windows Server Update Services (WSUS), System Center Configurations Manager (SCCM) and the Microsoft Update Catalog. If you delay the update in October, you’ll be prompted to install it again in November, along with another single set of patches for that month, and so on. Each month’s update will include patches for all previously-uninstalled months, from October onwards.

older updates will begin to be included in the monthly patch rollouts, dating all the way back to Service Pack 1 for Windows 7. That means that — at some point — you’ll be able to get fully up to date with just a single installation, no matter the current state of your PC.

Microsoft is allowing one exception for its new all-in-one update system, affording the ability to download and deploy security patches separately from stability fixes. That will reduce the size of the initial update needed to secure your company’s PCs as quickly as possible. Those updates will be available from WSUS, SCCM and the Microsoft Update Catalog, not Windows Update.

Servicing Stack and Adobe Flash updates won’t be included in the rollups. Microsoft will move to the same monthly rollup model for the .NET Framework in October too.

for more about patch Tuesday see on Patch Tuesday