ConfigMgr Discovering and Organizing Resources Mariusz Zarzycki, Phd, MCT, MCTS, MCITP, MCSE, MCSA

Agenda Resource Discovery Boundaries and Boundaries Groups User and Device collections Role-Based Administration

Configuring Resource Discovery

What is Resource Discovery? Resource discovery is the process of detecting and acquiring information about network resources: 1.Discovery gathers information about network resources (computers, users, security groups, and network infrastructure) 2.Discovery generates a DDR file 3.Discovery Data Manager loads the information from the DDR file into the database Reference Planning for Discovery in Configuration Manager Active Directory Site Server Site Database.DDR Network If a DDR record is not updated within a specific amount of time, a site maintenance task called Delete Aged Discovery Data will remove the record from the database. This task is, by default, configured to delete data older than 90 days. You can modify this site maintenance task in the Administration workspace. Expand the Site Configuration node, click the Sites node, right-click the site name, and then click Site Maintenance.

Discovery Methods Active Directory Forest Discovery Active Directory System Discovery Active Directory User Discovery Active Directory Group Discovery Network Discovery Heartbeat Discovery

Active Directory Discovery Methods For Active Directory Forest Discovery, the options include: Enabling Active Directory Forest Discovery and boundary creation Specifying Active Directory forest options For all other Active Directory discovery methods, specify : At least one Active Directory container Any additional search options The polling schedule

Short descriptions of discovery methods?

What Is Heartbeat Discovery? Site Server Site Database.DDR By default, Heartbeat Discovery runs every seven days You can configure the schedule, but understand the implications when reducing the Heartbeat Discovery interval A discovery method that refreshes the Configuration Manager client computer discovery data in the site database

Monitoring Discovery by Using Component Status and Log Files

Configuring Resource Discovery DEMO 1

Jak został wykryty TOR- CL1 SMS_AD_SYSTEM_DISCOVERY_A GENT

Boundaries and Boundaries Groups

Overview of Client Assignment Client assignment is a process that determines the Configuration Manager site that manages a client computer Assign clients to a Configuration Manager site by: Manually specifying the site code to use Configuring the client to automatically assign to a site based upon boundaries and boundary groups Central Administration Site (CAS) Primary Site (S02) Primary Site (S01)

What Is a Boundary? A network location that contains one or more devices that you want to manage IP Range Active Directory Site IP Subnet IPv6 Prefix

What Is a Boundary? Site Assignment You can configure a boundary group to provide site assignment for clients located within member boundaries. A single boundary should not be a member of multiple boundary groups configured for site assignment. Note Be careful not to add a boundary to multiple site-assignment boundary groups if these boundary groups are associated with different sites. If you do, clients cannot determine which site they should be assigned to. Configuration Manager does not support overlapping boundaries for site assignment. Site Assignment You can configure a boundary group to provide site assignment for clients located within member boundaries. A single boundary should not be a member of multiple boundary groups configured for site assignment. Note Be careful not to add a boundary to multiple site-assignment boundary groups if these boundary groups are associated with different sites. If you do, clients cannot determine which site they should be assigned to. Configuration Manager does not support overlapping boundaries for site assignment.

Boundaries and Boundaries Groups DEMO 2

User and Device collections

Overview of User and Device Collections You can use collections to: Organize resources into manageable units Organize collections of target resources for performing operations such as application deployments or installing software updates Target groups of computers for specific configuration settings Integrate role-based administration Collections represent groups of resources that consist of computers, users, and security groups

Types of Rules Used to Create and Manage Collections Collection rule types include: Direct Rule Exclude Collections Include Collections Query Rule Incremental collection member evaluation every 5 minutes Full collection member evaluation every 7 days Specify a Limiting collection as a basis for resources

User and Device collections DEMO 3

Other considerations include: Deployed software will not run if maximum run time extends past the end of the maintenance window If maximum run time is set to “Unknown,” deployed software may run past the end of maintenance window Best Practices: Assign maintenance windows only to collections specifically created for that purpose Include a description of the maintenance window in the name of the collection If PC1 is a member of Collection A, Collection B, and Collection C, and: Then, PC1’s maintenance windows will be 4 A.M. to 7 A.M., and 5 P.M. to 11 P.M. Collection A’s maintenance window is from 5 P.M. to 8 P.M. Collection C’s maintenance window is from 7 P.M. to 11 P.M. Collection B’s maintenance window is from 4 A.M. to 7 A.M. A Maintenance window does not prevent the following tasks: Deployments, software updates, and task sequences specifically configured to ignore maintenance windows or user-initiated deployments Wake On LAN transmission and out of band management Policy downloads Inventory and metering data collection and reporting Applying Maintenance Windows to Collections Use maintenance windows to configure a specific period of time during which required deployments, software update distributions, and task sequences can run

Monitoring Collections

Role-Based Administration

Overview of Role-Based Administration Use the role-based administration feature to define security settings and to delegate administrative tasks to users or groups User Administrative user Assign a Role Application Administrator Assign a Scope Custom scope containing objects to manage Assign a Collection Custom collection containing users or computers to manage Defining role-based administration: Must specify one or more security roles Must specify a security scope or collection for the user Can specify both scopes and collections Can be further customized by mapping security roles to specific security scopes and collections

Default Security Roles Configuration Manager includes 14 built-in security roles Each built-in role contains a set of individual permissions to perform actions on different types of objects

What Are Security Scopes? Considerations: All securable objects are initially assigned to the Default security scope All securable objects must be assigned to at least one security scope All administrative users must be assigned to at least one security scope Use security scopes to define which securable objects an administrative user can view and manage

The Process for Adding an Administrative User to Configuration Manager

Reports on Role-Based Administration Reports provide information related to the configuration and use of role- based administration The reports on role-based administration include:

DEMO 4

Dziekuję za uwagę Konkurs z ConfigMgr’a 2012