1. Yes, Applications DO work in task sequences!
Jason Sandys and Nash Pherson – Microsoft MVP’s
@JasonSandys @KidMystic
#MMSMinnesota
#MMSConfigMgr
#MMSLove
MMS Minnesota 2014

2. Expectations and Overview
Would you so kindly:
We plan to hit:
Listen Actively
Ask Questions
Heckle When Necessary
Talk about Why
Common Problems
No-so-common Problems
Stretching the definition of ‘Problems’ really far to get the list up to 10… N
You might recognize us from the internet. We help customers and the public do this successfully every day.
Real world scenarios…
We really wanted to be able to counter any reason someone gives for why they can’t do CM Task Sequences and are adding unneeded complexity.
MMS Minnesota 2014

3. Why Use Applications in a Task Sequence?
Applications use a very powerful stateful model
Changes the thick/thin discussion from the pre-CM12 days
Only add complexity when there is a compelling business need.
Use the same object’s to service new and existing devices
Build consistency between existing/new machines
Less stuff means less to maintain (yeah, we’re lazy) N
Why should you use a task sequence.
Key Concept of systems management is – Only add complexity when you absolutely need to – it must outweigh the costs of owning/maintaining it.
#MMSKitagries
MMS Minnesota 2014

4. Why Are They Harder in Task Sequences?
“It works on a regular client, but not in OSD” – The ConfigMgr client behavior and operating system while in a task sequence is different from a fully initialized client…
“It works in Deployment TS, but not Build & Capture TS” – During a Build & Capture, a device is normally not joined to a domain, so Workgroup Computer / Untrusted Domain considerations apply...
“Because Unicorns” – Applications, like Software Updates, are built on top of the Compliance Item model, so there is much more complexity than a package/program… J
Three general areas of challenges… Can be summed up with these three statements.
Provisioning Mode
Workgroup
Complex
MMS Minnesota 2014

5. Application/Deployment Type/Installation Program
Infrastructure
Policy
Content Location & Download
What Could Go Wrong? J
We grouped the 10 things we came up with into these 4 categories.
Application/Deployment Type/Installation Program
MMS Minnesota 2014

6. 1. Are we updated? Known issues at RTM not fixed until SP1…
Policy version… Content version… etc.
Highly recommend keeping ConfigMgr up-to-date
Plan to test and deploy the Cumulative Updates every quarter
Consider slipstreaming the Cumulative Updates in your task sequence using the Setup Windows and ConfigMgr step…
We can argue about how… include-client-hotfix-or-cumulative-update-while-on-osd/ J
MMS Minnesota 2014

7. 2. Can we find the management point?
Setup Windows and ConfigMgr step should include SMSMP=<FQDN> property
The MP specified will be used to download the MP List, so you don’t need to rely on AD or DNS to find MPs… J
Active Directory schema may not be extended or the data may not be published, or you might be a Workgroup computer. DNS may not have the SRV records published to it.
MMS Minnesota 2014

8. 3. Can we download the policy?
Sometimes the client can fail to download the policy, either because the client is ready before the network, or the management point is too busy
Race condition… seen more on SSD based devices + slower network
Shows up as 0x87d00269
R2 added the SMSTSMPListRequestTimeout= variable so you can increase default timeout of 1 minute
Before R2, add a Run Command Line step after Setup Windows and ConfigMgr, and any other rebooting steps
ping localhost -n 120 N
MMS Minnesota 2014

9. 4. Can we validate the policy?
When on an untrusted domain, you must leave the SMSDIRECTORYLOOKUP client install property as the default
Specifying SMSDIRECTORYLOOKUP=NOWINS will disable the mechanism required for validating the MP certificate
App install fails with 0x
You’ll see errors in LocationServices.log:
Failed to send site information Location Request Message to <mp1.fqdn> N
MMS Minnesota 2014

10. 5. Do we have a boundary with a distribution point?
During Build & Capture, you are in a Workgroup… so you are not within an AD Site boundary
IP Range boundaries work on both sides of OSD and are easy.
Could do AD Site for existing clients + deploy task sequences, and a couple IP Ranges for build and capture task sequences
If you have many hundreds or thousands of ranges, consider IP Subnet boundaries to reduce SQL burden. J
MMS Minnesota 2014

11. 6. Can we use the Network Access Account?
When building Windows 7 or Windows Server 2012 R2, you may not be able to download content because of Kerberos errors, requires KB to allow fallback to NTLM.
You should NOT need to enable Anonymous access on DP’s J
MMS Minnesota 2014

12. 7. Can we handle downloading the content?
SMSTSDownloadRetryCount = 5 and SMSTSDownloadRetryDelay = 15 N
MMS Minnesota 2014

13. 8. Can we detect the application?
If the Application’s Deployment Type uses a PowerShell script, the execution policy will block it by default.
Client Settings are not applied during the Task Sequence, so it doesn’t matter what you have set there
Run Command Line step: powershell.exe -Command {Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope LocalMachine -Force} N
MMS Minnesota 2014

14. 9. Does their installer work in a task sequence?
Some application installers were written by small companies that never imagined their application would be deployed in a large enterprise… Like, for example, Microsoft:
.NET Framework 4.5.0/.1/.2 Installer on x86 systems
Typically, this comes from the installer requiring a User Interface session. ConfigMgr executes task sequence steps as the SYSTEM account, not a real user.
There may or may not be a workaround – contact/shame the vendor if necessary. N
MDT uses the local Administrator account to log in.
MMS Minnesota 2014

15. 10. Is the Windows Installer rolling on you?
Save time during task sequence
Disable Windows Installer rollback during the TS: us/library/aa368307(v=vs.85).aspx, J
MMS Minnesota 2014

16. 11. Unicorns?
Apps a complicated model that requires lots of things to be working… And so are task sequences.
Should you get gored by the unicorn: Logs, logs, and more logs.
Policy/Location
CI*s
Content
App*s N
MMS Minnesota 2014

17. Recap of Dirty Tricks Infrastructure Policy
1. Upgrade/Update
Policy
2. SMSMP=<FQDN>
3. SMSTSMPListRequestTimeout=120
4. Don’t touch SMSDirectoryLookup=
Content Location and Download
5. Boundaries
6. Win7 KB
7. SMSTSDownloadRetryCount= and SMSTSDownloadRetryDelay=
Application/Deployment Type/Installation Program
8. PowerShell Script Detection Method
9. Application/Deployment Type/Installation Program Issues
10. Speed Up Without Windows Installer Rollback
Most Common N
MMS Minnesota 2014