The Missing SCCM Database View

For most interfaces I've worked on over the past ten years, which involve poking a stick at System Center Configuration Manager 2007 or 2012, this is one database view (or stored proc) that I'm usually building for myself.  It basically tosses about eight built-in Views and Tables into a blender, with a dash or two of stupid sauce and provides a fairly good picture of each computer in your site database.

It spews out the computer name, client info, site code, manufacturer, model, memory, Windows flavor, chassis type (I didn't cross-join that to produce names, but you can do that, I'm too lazy right now), BIOS info and serial number, CPU, AD stuff, install date, and of course, my personal favorite: the SCCM distribution point reference.  Note that I've provided a fall-back DP name for those which are not explicitly mapped via a site boundary, so they come back home to an MP usually (not always).  I used "DP0001" but you should stuff your own name in place of that.

[begincode]

SELECT DISTINCT
v_R_System.Name0,
v_R_System.ResourceID,
v_R_System.Client0 AS ClientInstalled,
v_R_System.Client_Version0 AS ClientVersion,
v_R_System.Creation_Date0 AS ClientDate,
v_RA_System_SMSAssignedSites.SMS_Assigned_Sites0 AS SiteCode,
v_GS_COMPUTER_SYSTEM.Manufacturer0 AS Manufacturer,
v_GS_COMPUTER_SYSTEM.Model0 AS ModelName,
v_GS_COMPUTER_SYSTEM.SystemType0 AS SystemType,
v_GS_OPERATING_SYSTEM.Caption0 AS OSName,
v_GS_OPERATING_SYSTEM.CSDVersion0 AS ServicePack,
v_GS_X86_PC_MEMORY.TotalPhysicalMemory0 AS Memory,
v_GS_SYSTEM_ENCLOSURE.ChassisTypes0 AS ChassisType,
v_GS_SYSTEM_ENCLOSURE.SerialNumber0 AS SerialNumber,
v_GS_PC_BIOS.Manufacturer0 AS BIOSvendor,
v_GS_PC_BIOS.SMBIOSBIOSVersion0 AS BIOSversion,
v_GS_PC_BIOS.ReleaseDate0 AS BIOSdate,
v_GS_PROCESSOR.Name0 AS CPU,
v_R_System.AD_Site_Name0 AS ADSiteName,
v_GS_COMPUTER_SYSTEM.UserName0 AS ADUserName,
v_GS_COMPUTER_SYSTEM.Domain0 AS ADDomain,
v_GS_OPERATING_SYSTEM.InstallDate0 AS OSInstallDate,
v_BoundaryInfo.BoundaryID,
COALESCE (ProtectedSiteSystem_ARR.ServerName, 'DP0001') AS DPServer
FROM dbo.ProtectedSiteSystem_ARR AS ProtectedSiteSystem_ARR
INNER JOIN
dbo.v_BoundaryInfo AS v_BoundaryInfo
ON ProtectedSiteSystem_ARR.BoundaryID = v_BoundaryInfo.BoundaryID
RIGHT OUTER JOIN
dbo.v_R_System AS v_R_System INNER JOIN
dbo.v_GS_PROCESSOR AS v_GS_PROCESSOR
ON v_R_System.ResourceID = v_GS_PROCESSOR.ResourceID
INNER JOIN
dbo.v_GS_COMPUTER_SYSTEM AS v_GS_COMPUTER_SYSTEM
ON v_R_System.ResourceID = v_GS_COMPUTER_SYSTEM.ResourceID
INNER JOIN
dbo.v_GS_SYSTEM_ENCLOSURE AS v_GS_SYSTEM_ENCLOSURE
ON v_R_System.ResourceID = v_GS_SYSTEM_ENCLOSURE.ResourceID
INNER JOIN
dbo.v_GS_X86_PC_MEMORY AS v_GS_X86_PC_MEMORY
ON v_R_System.ResourceID = v_GS_X86_PC_MEMORY.ResourceID
INNER JOIN
dbo.v_GS_OPERATING_SYSTEM AS v_GS_OPERATING_SYSTEM
ON v_R_System.ResourceID = v_GS_OPERATING_SYSTEM.ResourceID
INNER JOIN
dbo.v_GS_PC_BIOS AS v_GS_PC_BIOS ON v_R_System.ResourceID = v_GS_PC_BIOS.ResourceID
INNER JOIN
dbo.v_RA_System_SMSAssignedSites AS v_RA_System_SMSAssignedSites
ON v_R_System.ResourceID = v_RA_System_SMSAssignedSites.ResourceID
ON v_BoundaryInfo.Value = v_R_System.AD_Site_Name0

ORDER BY v_R_System.Name0

[endcode]

To test this out, open your SQL Management Studio.  Connect to your site database server and site database instance.  Then click "New Query" and paste the code in and press F5 to run it.  Add a splash of your favorite alcoholic beverage, some Barry White music, dim the lights, and enjoy the vibe.  Peace.

My New Book is Out! The AutoCAD 2015 Network Administrator's Bible

"The AutoCAD 2015 Network Administrator's Bible" covers everything from new features and requirements, to building Network Deployment Shares, to deploying with Scripts, Microsoft Deployment Toolkit 2013, and System Center Configuration Manager 2012. 

There are also tips for working with VMware Workstation as a test environment,  handling .NET dependencies on Windows 7 and Windows 8, and slip-streaming updates and service packs during deployments.

I hope you like it. Please post feedback on the Amazon site to share your thoughts after checking it out? I'd really like to hear from you.

Cheers!

Identify IE Version Installs using SCCM, SQL, Chewing Gum and Coffee

You could hunt down the Add or Remove Programs list, or tunnel your way through v_GS_INSTALLED_SOFTWARE_CATEGORIZED, or walk around with a clipboard and a baseball bat, or you could do it the easy way:  a SQL query against v_GS_SoftwareFile.  Be sure to change the database name tag to whatever your site code is.

[begin code]

USE your_site_database_name

GO

SELECT DISTINCT 
  a.netbios_name0 COMPUTER_NAME, 
  CASE 
    WHEN PATINDEX('%.%',b.fileversion) = 3 THEN 

      SUBSTRING(b.fileversion,1,2) 
    WHEN PATINDEX('%.%',b.fileversion) = 2 THEN 

      SUBSTRING(b.fileversion,1,1) 
    ELSE SUBSTRING(b.fileversion,1,1) 
  END AS IEX 
FROM 

  dbo.v_R_System a LEFT OUTER JOIN 

  dbo.v_GS_SoftwareFile b ON a.ResourceID=b.ResourceID 
WHERE 

  filename LIKE 'iexplore.exe' AND Active0=1
  AND 

  LTRIM(fileversion) <> ''

ORDER BY COMPUTER_NAME

[end code]

Namaste!

5 Stupid IT Questions - Part 2 - The Electric Boogaloo

It's that time again.  Enjoy...

Question 1 - "I have about 50 to 60 desktops and laptops, and about 10 servers in my AD environment at work.  I don't have a patch management product yet, I currently patch my Windows machines manually or using scripts.  Is there a good reason *not* to use WSUS?"

Answer:  First off, you need to start drinking. Your doctor would agree with me.  I think.  Well, anyhow, if your environment is built on versions of Windows which can be supported by WSUS, then the answer is NO: there isn't a "good" reason to *not* use a free product that at least gets you closer to the goal line.  How's that for a double-double-double negative statement?  I should've been a politician.

Are there better products?  Sure.  For free?  Maybe.  Is WSUS "good enough" for most shops like yours?  Probably.

Question 2 - "My significant-other spends a lot of time reading, studying, and playing in a lab to stay current with his/her career.  Is there anything I can do for him/her?"

Answer: Yes!  Feed them.  Scratch their back.  Rub their feet. Make them laugh.  And most important, feed them some more. They need to be sure to return the favor though.  My wife is amazing, but I have to remember to rub her feet too (she deserves it).

Question 3 - "I have scheduled tasks running on computers which run under the local SYSTEM account, but when they try to execute commands or access resources from remote UNC shares, they are denied access.  What am I doing wrong?"

Answer:  Two things... the first problem is that you're not sending me cash to help me pay my bills.  Just kidding.  Second, you didn't grant sufficient permissions to the share and/or the underlying NTFS folder path.  Remember, the local SYSTEM account runs as a proxy for the computer itself (when operating in a domain context).  So, when it knocks on the door of a remote shared resource, that resource sees the domain computer account in the peep hole.  (you thought I was going to say glory hole, didn't you?  sick puppy you are).

For example, if one computer is "DT1234" and is running a task that requests a connection to server "FS0005", then that server will see "DT1234$" (they append the dollar sign to indicate you paid a lot of money for that license.  ha ha . kidding again).  Actually, if the domain is "constoso.com", then the server sees user "CONTOSO\DT1234$" (NetBIOS name + computer sAMAccountName) knocking at the door.

By default, domain-joined computer accounts are not members of the AD domain "everyone" or "domain users" security groups.  They're not even members of any group (by default) besides "Domain Computers".  Therefore, you need to grant rights on resources to that domain security group, and your domain-joined computers should be able to knock at the door and get some free food.

TIP: a simple way to test local SYSTEM access to remote shares, is to use the "psexec.exe" utility (Microsoft/Sysinternals) with the "/s" option to launch CMD.exe.  Then within the command console, running in the local SYSTEM context, try to connect or query remote resources to see what happens.

Question 4 - "I'm building a custom app/script that helps manage things within System Center Configuration Manager 2012 R2.  It needs to read and write information as well, but it looks like I can do that by ADO and SQL commands, or by WMI and WBEM commands. Which should I use?"

Answer:  (long, long inhale.... get ready, here it comes...)  Okay.  Both.  No, wait.  Neither.  No, wait, that's wrong.  Both.  Sort of.  Hold on.  This may seem a little complicated. And even if it wasn't complicated, I'm a professional, and complicating things is what I get paid to do.  That's not true either.  Just a minute. Okay. So drink up, strap in, or strap on, or buckle up, whatever...

You know how they say "never say never"?  Well, NEVER, yes, that's right, I just said "NEVER", ever write to a System Center Configuration Manager database directly.  All "write" (aka update/insert/delete) operations should be done through WMI/WBEM statements. I'll get to the "why" in a minute.

First things first:  While you absolutely can request information from the database using WMI/WBEM queries, I recommend that you do your read operations directly from the SQL Server database, rather than via WMI/WBEM.  The reason is that they're going to perform faster than WMI/WBEM requests (assuming you know how to form proper T-SQL statements).  More importantly: WMI/WBEM query statements are way more limited than T-SQL as far as what kinds of operations you can perform.  For example COALESCE, TRY_CONVERT and CASE statements, to name a few. And I won't even get into things like DATEDIFF, CAST or SUBSTRING.

Next, the reason you shouldn't push anything into the database directly is that SCCM relies on a delicate, complicated and, let's be honest, confusing-as-hell sequential process for handling change requests.  That is, updates, additions, deletions, and so on.  Each request is queued, prioritized, processed and logged.  The "processed" part involves even more sequential handling with triggers and more logging, and if you go around back, break open the window and climb in the back room, the alarm will go off and the SWAT team will repel down from helicopters and kill you.  Okay, not really.  But it will very likely break your SCCM site entirely.

When you submit requests properly using WMI/WBEM requests, they are like well-trained school kids lining up to go to the cafeteria.  They get their lunches, sit down, eat and smile the whole time.  When you shove them in directly via ADO/ADO.NET, shit will just break. Trust me. If you don't trust me, go ahead and setup a lab environment and kick those tires.  When the air blows out, don't come crying to me.

Finally, or thirdly? -  if you plan on making the same types of requests for information (read operations, that is) and they involve SQL "JOIN" statements, I recommend you create some VIEWs and apply indexing.  SQL will outperform application processing like Stephen Colbert having a debate with your dead cat.  If you've been strapping together messy "SELECT blah FROM whatever LEFT OUTER JOIN something  ON this = that..." and so on, in your script code, STOP!  Do that within the database (or create another database on the same server to pull data for abstraction and aggregation work, etc.).  So, to summarize all that blabber...

READ == Direct from the Database (SQL + ADO or ADO.NET)
WRITE ==  Through the WMI/WBEM interface

If you're thinking which is "faster": COM scripting or .NET scripting (e.g. VBScript vs. PowerShell), it depends on what you're doing, but for most things it's break-even.  The biggest factor will be where the bulk of logic handling and processing is being done:  in the database/WMI request itself, or on the information obtained therefrom.  I can already sense the .NET nerds flipping out right now. Spitting coffee through their nostrils.  Exclaiming "WTF?!!", knocking over their stacks of stale donuts and breaking pencils.   Oh well.

Question 5 - "My company is looking for a good service request ticketing system product. What products would you recommend?"

Answer: None of them.  Or all of them. The problem is that every organization that's existed for more than a few years, has evolved their own internal processes for handling requests.  Staffing varies.  Methods vary.  Resources vary.  The retail products you will try on will almost certainly be like a "one-size fits-all" suit.  Lot's of Velcro straps and adjuster things to help you pull in the tight spots to fit better.  But it's going to feel like that too.

Most off-the-shelf products will expect you to make some concessions with regards to "how" you do things.  That's not always bad, though.  Read up on ITIL, and even if you hate ITIL, it's good to have something to base your processes upon.  That or a suitcase full of drugs and a fast getaway car.  I have no idea what that's about though.

If your environment has implemented ITIL with gold medal effort, you may do really well with almost any off-the-shelf product.  However, I haven't seen an ITIL gold-medal shop in my lifetime.  I've heard stories of them, but I've never seen one.  Kind of like unicorns and leprechauns.

I see two options:  Build your own with whatever tools you have, or buy one and suck it up.  Just be warned:  The bigger your organization (staff and customer numbers), the more work it's going to be, for either direction you choose.  Be cautious of vendors offering "customization" services too.  That's their bread-and-butter.  Am I a bit pessimistic?  Yes.  It's a lot like shopping for document management solutions, or vacation homes.  I wish I could afford a vacation home.  Heck, I wish I could afford to take a vacation.


Th-th-that's all for now, folks.  Have a good week!

Random SCCM Database Thoughts

I ran these on a SCCM 2007 environment, but most of them should work in 2012 R2 as well.

Crack open your SSMS console, swallow your entire Espresso, crack your knuckles, inhale deep and slow, and let it out deep and slow.  Then scream something stupid and look serious.  Now, let's get started...

List the computers in a particular AD Site, and identify their makes, models, and BIOS serial numbers...

• Join v_R_System with v_GS_Computer_System and v_GS_System_Enclosure on ResourceID (using LEFT joins to avoid dropping those which don't report inventory yet).  Then group by the AD_Site_Name0 field.

• Step 1, filter on the following view-joins to see the general scope of data...

SELECT DISTINCT
   dbo.v_R_System.ResourceID, dbo.v_R_System.AD_Site_Name0, 
   dbo.v_R_System.Name0, dbo.v_GS_COMPUTER_SYSTEM.Manufacturer0, 
   dbo.v_GS_COMPUTER_SYSTEM.Model0, 
   dbo.v_GS_COMPUTER_SYSTEM.SystemType0, 
   dbo.v_GS_SYSTEM_ENCLOSURE.SerialNumber0
FROM dbo.v_R_System LEFT OUTER JOIN
   dbo.v_GS_COMPUTER_SYSTEM ON dbo.v_R_System.ResourceID =
      dbo.v_GS_COMPUTER_SYSTEM.ResourceID LEFT OUTER JOIN
   dbo.v_GS_SYSTEM_ENCLOSURE ON dbo.v_R_System.ResourceID =
      dbo.v_GS_SYSTEM_ENCLOSURE.ResourceID

• Step 2, hone it down...

SELECT DISTINCT

   dbo.v_R_System.ResourceID, dbo.v_R_System.AD_Site_Name0, 

   dbo.v_R_System.Name0, dbo.v_GS_COMPUTER_SYSTEM.Manufacturer0, 

   dbo.v_GS_COMPUTER_SYSTEM.Model0, 

   dbo.v_GS_COMPUTER_SYSTEM.SystemType0, 

   dbo.v_GS_SYSTEM_ENCLOSURE.SerialNumber0

FROM dbo.v_R_System LEFT OUTER JOIN

   dbo.v_GS_COMPUTER_SYSTEM ON dbo.v_R_System.ResourceID =

      dbo.v_GS_COMPUTER_SYSTEM.ResourceID LEFT OUTER JOIN
   dbo.v_GS_SYSTEM_ENCLOSURE ON dbo.v_R_System.ResourceID =

      dbo.v_GS_SYSTEM_ENCLOSURE.ResourceID

WHERE dbo.v_R_System.AD_Site_Name0 = 'DOUBLE_HEADED_DONG_FACTORY'

Find all clients which are assigned to a particular IPv4 gateway...

• Step 1, just for fun, filter and browse the results of round 1, using v_Network_Data_Serialized

SELECT DISTINCT 
   DNSHostName0, ResourceID, IPSubnet0, MACAddress0, 
   IPAddress0, DHCPEnabled0, DHCPServer0, DNSDomain0, DefaultIPGateway0
FROM dbo.v_Network_DATA_Serialized
WHERE (IPSubnet0 IS NOT NULL)
   AND (DHCPEnabled0 = 1)
   AND (IPAddress0 NOT LIKE 'f%')

• Step 2, go in for the kill.  Find all that are using gateway 192.168.2.11...

SELECT DISTINCT 

   DNSHostName0, ResourceID, IPSubnet0, MACAddress0, 

   IPAddress0, DHCPEnabled0, DHCPServer0, DNSDomain0, 

   DefaultIPGateway0
FROM dbo.v_Network_DATA_Serialized
WHERE (IPSubnet0 IS NOT NULL) 

   AND (DHCPEnabled0 = 1) 

   AND (DefaultIPDGateway0='192.168.2.11')

ORDER BY DNSHostName0

List the unique AD Site Names for all computers in a given Collection...

• Join v_R_System with a sub-query on the desired Collection "ABC12345".

SELECT DISTINCT AD_Site_Name0 dbo.v_R_System
WHERE dbo.v_R_System.ResourceID IN
   (SELECT ResourceID FROM dbo.v_CM_RES_COLL_ABC12345)

List all of the Distribution Point Servers in site "ABC"...

• Filter on View named v_SystemResourceList...

SELECT SiteCode,ServerName
FROM dbo.v_SystemResourceList
WHERE SiteCode='ABC' AND RoleName='SMS Distribution Point'
ORDER BY ServerName

List distinct Site Server Role type/names in the database, along with counts of servers for each role (keep in mind that servers can provide multiple roles, so don't sum the totals and think that's an accurate count of total site servers)

• Filter on View named v_SystemResourceList...

SELECT DISTINCT RoleName, COUNT(*) AS ServerCount
FROM dbo.v_SystemResourceList
GROUP BY RoleName
ORDER BY RoleName

List User Account status values and counts for each.

• Start with a basic SQL query to identify the unique values for column User_Account_Control0 from view named v_R_User

SELECT DISTINCT User_Account_Control0, COUNT(*) AS UserCount
FROM dbo.v_R_User
GROUP BY User_Account_Control0

• Then add a dash of SQL "CASE" statement with some Oregano and Basil (for other values to match up, check out Rajnish's blog post here)...

SELECT DISTINCT 

User_Account_Control0, 

COUNT(*) AS UserCount, 

CASE User_Account_Control0 

WHEN 512 THEN 'Enabled' 

WHEN 514 THEN 'Disabled' 

WHEN 544 THEN 'Enabled Must Change Password' 

WHEN 66048 THEN 'Enabled Password Never Expires' 

ELSE 'You can code the others...' 

END AS UAC_Name 

FROM dbo.v_R_User 

GROUP BY User_Account_Control0

List computers a particular AD user has logged onto within the past 30 days...

• Find logins for user "doofus" on domain "contoso".  Join v_R_System with v_GS_SYSTEM_CONSOLE_USER on ResourceID and filter on the SystemConsoleUser0 column.  Then add a DateDiff() filter to restrict on logons within the last 30 days...

SELECT 
   dbo.v_R_System.Name0 AS ComputerName, 
   dbo.v_GS_SYSTEM_CONSOLE_USER.ResourceID,
   dbo.v_GS_SYSTEM_CONSOLE_USER.LastConsoleUse0 AS LastLogon,
   dbo.v_GS_SYSTEM_CONSOLE_USER.NumberOfConsoleLogons0 AS NumberLogons,
   dbo.v_GS_SYSTEM_CONSOLE_USER.SystemConsoleUser0 AS UserID,
   dbo.v_GS_SYSTEM_CONSOLE_USER.TotalUserConsoleMinutes0 AS LogonTotalTime
FROM dbo.v_GS_SYSTEM_CONSOLE_USER INNER JOIN
   dbo.v_R_System ON dbo.v_GS_SYSTEM_CONSOLE_USER.ResourceID =
      dbo.v_R_System.ResourceID
WHERE 
   (dbo.v_GS_SYSTEM_CONSOLE_USER.SystemConsoleUser0 = 'contoso\doofus')
   AND
   (DATEDIFF(dd, dbo.v_GS_SYSTEM_CONSOLE_USER.LastConsoleUse0, GETDATE()) < 30)

Need to identify Advertisements pointed at Direct-membership Collections?

• Join v_Advertisement to v_Package, and v_Collection, and sub-query against v_CollectionRuleDirect using CollectionID as the filtering column...

SELECT 
   dbo.v_Advertisement.AdvertisementID, 
   dbo.v_Advertisement.AdvertisementName, 
   dbo.v_Advertisement.PackageID, 
   dbo.v_Package.Name, 
   dbo.v_Advertisement.CollectionID,
   dbo.v_Collection.Name AS CollectionName
FROM dbo.v_Advertisement INNER JOIN
   dbo.v_Collection ON dbo.v_Advertisement.CollectionID =
      dbo.v_Collection.CollectionID INNER JOIN 
   dbo.v_Package ON dbo.v_Advertisement.PackageID =
      dbo.v_Package.PackageID
WHERE (dbo.v_Collection.CollectionID IN
   (SELECT DISTINCT CollectionID FROM dbo.v_CollectionRuleDirect)) 
ORDER BY 
   dbo.v_Advertisement.AdvertisementName

Need to computers with every version of Internet Explorer?

• Well, you might expect to query v_GS_Installed_Software_Categorized or the ARP tables, but remember that IE10 and 11 came out as KB updates for some platforms.  So best to query v_GS_Software_Product.  Note the some entries (ProductName0 LIKE 'Internet Explorer%') OR (ProductName0 LIKE 'Windows%Internet Explorer%') will produce the version within the product name, while others will only show "Internet Explorer" and the version in the ProductVersion0 column.  Drink plenty of coffee and enjoy that.  Don't forget to filter out the double counted items (yes. they are hiding there).  Don't be surprised if you need to crack open your dusty T-SQL book and brush up on the CASE statement.  I'll let you have fun with this one, and I'll post my take on it later.

If I get more coffee in me and feel motivated, I may post more.  Let me know if these are helpful?

Asset Inventory 101 - Myths and Realities

This post is the result of trying to explain IT inventory to multiple people, multiple times, and them still not "getting it".  Rather than wear myself out, which I will probably still do anyway, I plan on pointing them here to read my thoughts on it, and I can then go back to babbling incoherently to myself.  I promised to post a "tech-oriented" article soon, but this is borderline, so nanny-nanny-boo-boo, I'm counting it as tech-oriented.

If you ask me about Inventory, I will ask if you read this article.  If you say "no", I will tell you to read this article and walk away, probably while laughing.  If you say "yes", I will say "go back and read it again", and laugh even louder.

What is Inventory?

Definition...

(noun):  A complete list of the things in a place".

(verb):  the act or process of making a complete list of the things that are in a place : the act or process of making an inventory". - Merriam-Webster's Dictionary

Go back and read that again.  Got it memorized? Okay, let's look at the noun side...

Inventory Science 101

What is "inventory" really?  Basically, it's supposed to be about tracking and reporting what you own, or what you have, and where it's located.  But there's usually a lot more to it than that.  Who's using it.  What it's used for.  Who bought it.  Who pays for it.  How it is configured.  What it's related to, or associated with.

There's also the Manufacturer. Model. Part Number.  Serial Number.  Contract number(s). Department/Division/Sector/Group/Team/Project names and numbers. And let's not forget the abstracts like category, type, family, class, species, and all that.

The goal of inventory, and inventory tracking efforts is, or should be, to confirm existence, disposition and ownership of assets.  The real goal being a financial implication of course.  What do you own?  Where is it?  Who is using it?  What is it used for?  Who's paying for it?  When does it "expire"?

The most common method for gathering and tracking inventory is what is commonly referred to as "input-output differential".  Capture what comes in (purchase order, or birth certificate), what goes out (inventory record audit, or death certificate) and finding the gaps.  The gaps are where the fun really begins.

What happened to it?  Lost? Stolen?  Transgender operation?  Was it really the property of the organization, or was it loaned to them for temporary use?  Was it a demo from a vendor?  The list goes on and on.

Just as a Census tries to verify you're still among the living, breathing creatures, who are paying taxes and adding to landfills... so are the aims of products like Microsoft System Center Configuration Manager, Solarwinds, Tivoli, Kaseya, LabTech, and (cough-cough) several products I've developed in the past as well.

So, in addition to what came in the door, and what is known to have departed, there is now a third status of "what's it doing now?"  Things that can be poked at to verify where and what an asset is, include Active Directory, network monitoring systems, PING, and so on.  An "Asset Manager" job title can often involve a lot of legwork.

What Constitutes "Things" and "Places"?

If we use YOU as a metaphor, then a human being is an inventory asset or item.  The place would be (or could be), your home address.  It could also be your employer's address, or your car (VIN or license plate).

Now, think of all the "things" that pertain to labeling YOU as an entity.  Your birth certificate.  Driver's license.  Voter registration.  Tax bills.  Credit cards.  Bank accounts.  On and on.

Do any of those things GUARANTEE your existence?  No.  Do they confirm you are still among the "living" (I'll leave that for you to decide on the definition)?  No.  They are simply artifacts that help SUPPORT the assertion that you exist.

Metaphorically Speaking:  Computers

Now that we've strolled off into metaphor-land, let's bring it back to the meat-and-potatoes: Computer assets.  Desktops, laptops, tablets, smartphones, appliances, routers, hubs, switches, printers, power supplies, storage units, MODEM's, peripherals of all kinds, you name it.

What is the birth date of a computer?  The date it was purchased?  The vendor warranty start date?  The OS installation date?  The technician-installation date?  If you base it on the OS install date, and you reinstall the operating system, what happens to the birth date then?  Does it fall back to something else?

If you purchase it, and it takes a while to get from the warehouse, to the workbench, to the truck, to the technician to being delivered and setup, which event date are you picking as the "start" or "birth" date of that asset?  Have you consulted your Finance folks about this?  Your attorneys?  You should.

When you record the purchase and deployment of this asset, what then?  Do you track it during the rest of its life?  Do you track the retirement and disposal of it too?  Some places do.  Some don't.  Some are required by law to track some, or all of this.  Which are you required to track?

Just because you "Can", does that mean you "Should"?

If you are an IT person working for someone else (i.e. not self-employed), and you haven't sat down (or consulted with) someone in a legal and/or financial role in your organization, I strongly recommend you do so before embarking on any effort to track and report inventory of any kind.  I cannot stress that enough.

Even if you are self-employed, talk to an accountant or legal advisor about whether you need to track thigns, and what to track.

Some questions to ask:

• What are the tax implications?  
• What are the support contract and cost implications?  
• What are the regulatory compliance implications?  
• What are the IT support implications?  

Did you notice I put IT last in the list?

From my experiences, most businesses track more than they need to, and ignore things they shouldn't ignore as well.

Ah, Yes:  Software

Just when the folks feel good about their grasp of tangible hardware inventory, we open the gates and let the starving lions and alligators into the arena:  software licensing.

Definition:  Software = "the programs that run on a computer and perform certain functions" - Merriam-Webster's Dictionary

What does that mean?  What is a program?  Is that Microsoft Word?  Is that the Snipping Tool or Narrator feature?  Is that .NET Framework 4.5?  Is that Java Runtime?  Is that a DLL or COM file?  Is it a locally stored App-V or ThinApp reference?  Is that a shortcut to a MED-V or remote VDI resource (desktop or application)?  Is that a URL to a web application?  What is it?

What does that mean?

If you query a computer for what software it has installed, where do you begin?  Does it all exist in the Control "Add or Remove Programs" list?  Usually.  But not always.  How about crawling through that icky Registry?  More stuff, sure, but is it easy to parse and understand?  Hmm.  How about crawling the good old file system and parsing through EVERY SINGLE FILE that is known to have an executable capability?

The answer is yes.

Configuration Manager, and products similar to it, often dissect a computer from many angles.

This includes files, folders, the Registry, and my personal favorite: WMI.  Slithering through the various CIM repository stacks can yield all sorts of juicy bits of data about hardware and software.

But... Is this really what you're after?

So you have a product installed.  Now what?  Does that constitute a 'license'?  What is a license?  What kind of license is it?  Per-machine?  Per-user?  Per-CPU?  Per-network?  Per-domain or site?  Per-company?  Open Source?  What?  And what about FlexLM type licensing, where the node doesn't matter as much as the total, concurrent usage limit?

If you have the option to use floating/network licensing for groups of similar products, I always recommend that option if you can afford it.

Software Licensing Audits

If you've ever witnessed a license audit from an external investigation, it's not fun.  They tend to come in one of two flavors:  Vendor and BSA.  If the vendor audits you, that's good.  They want to keep your business, so they will try to negotiate terms to help avoid losing your business, if possible.  If the BSA, or another third-party entity, comes knocking, swallow whatever pills you have left and take a deep breath.  It may very well be an unpleasant experience, as they are paid by levied penalties and have no need to retain your business.

So, while you can get sloppy about hardware inventory, I would not recommend you take the same light-hearted approach to software inventory.  I've seen "settlements" applied that nearly ended a business due to the costs, but thankfully, in none of those situations was I aware or implicated of the neglect prior to the doors getting kicked down.  Don't be one of those businesses.

Okay, so that covers a bit of hardware and software.

Simple as multivariate Calculus and molecular bonding, and clear as mud.

Are you starting to drink yet?  You will.

Summary

If anyone says there is, or should be, "one inventory source" to answer all of these questions, they are brain damaged or stupid.  The desire is noble.  The reality is clear: a singular source of "authoritative" inventory data is impossible.  It has to be derived and reconciled from multiple angles.

Think about that every time you're walking through CostCo, Sam's Club or BJ's and you see a clerk scanning shelves to do "spot check inventory".  If there was one system to track and verify all of it, that wouldn't be required.

Every time I sit in a meeting where some vendor comes in to pitch some magical product to report all of their inventory without any outside help, I look at my shoes, smile and think about my next alcoholic beverage, saying to myself "here we go again..."

SCCM Lab Setup Laziness with PowerShell and Duct Tape

I've been dusting off my pointy little head with another round of "lets play set up with Configuration Manager!" and, well, I hate using GUI tools or command line stuff if a script will save me time.  The time invested in smacking the keyboard and making grunting noises and laughing hysterically is recouped later with spare change and coffee spilling, so it pays off.

Disclaimer:  I really don't have any duct tape right now, so you'll have to go without on this one.

Anyhow, I've been following along with a template procedure my buddy and trusted ass-kicking extraordinaire colleague and uber-technowunderkind: Chris DeCarlo compiled.  One part of this procedure has me creating a bunch of AD user accounts to tie to various things.  Some are for SQL services, others for AD tasks, and obviously some are for SCCM itself.  (btw- Chris, you did an outstanding job on this document. Kudos!)

Here's the accounts (sorry man, but I modified a few names out of brain-damaged habit).  The short names on the left are the sAMAccountName values, and to the right are their descriptions / explanations.

• SCCMRS - SQL Reporting Services publishing account
• SCCMNA - SCCM network access account
• SCCMInstall - SCCM site server install account
• SCCMDomJoin - SCCM domain joining account
• SCCMClient - SCCM client push account
• SCCMSQLSvc - SCCM SQL Server service account
• SCCMSQLAgent - SCCM SQL Agent service account
• SCCMOSD - SCCM OSD deploy and capture account

You may or may not need (or want) to create all of these, but I have the keyboard so this plane is going into the mountain and I'm the captain... so hold on.

In addition to this, I'm lazy.  Yes, I know that's a shock.  I'll wait as you pick your jaw off the floor.  (tap tap tap tap - eyes on phone,...) ok.  Rather than doing this the "right way", I do it (for lab purposes only) the "easy unrecommended way", which is to stuff all of these accounts into the "Domain Admins" group and then laugh as loud as possible.

You need two files (okay, you don't really NEED two files, but for this example it works):

• A Comma-Separated Values file (.csv)
• A PowerShell script (v3 or v4)

Assumptions

1. Domain is "fubar.local"
2. OU is created at root of the domain as "ServiceAccounts"
3. You are logged onto the server/desktop in the LAB as a Domain Admin user
4. You have faith in what I'm telling you (rotfl! okay, just kidding)

I built and tested this cardboard thing using Windows Server 2012 R2 with PowerShell v4 and some coffee, chewing gum and a few chicken drumsticks my wife just cooked (damn good too).

[CrappyCode]

$inputFile = Import-CSV  "useraccounts.csv"

$strPwd = "Tarfu123"

$ouPath = "OU=ServiceAccounts,DC=fubar,DC=local"

foreach($strLine in $inputFile) {

$cn = $strLine.cn

$samid = $strLine.sAMAccountName

$ln = $strLine.sn

$fn = $strLine.givenname

$dn = $strLine.displayname

$desc = $strLine.description

$upn = $strLine.UserPrincipalName

New-ADUser -SamAccountName $samid -Name "$cn" -UserPrincipalName $upn -AccountPassword (ConvertTo-SecureString -AsPlainText "$strPwd" -Force) -Enabled $true -PasswordNeverExpires $true -Path "$ouPath" -Description "$desc"

}

$inputFile | % {Add-ADGroupMember -Identity "Domain Admins" -Member $_.sAMAccountName } 

[/CrappyCode]

If you're not familiar with PowerShell, or scripting in general, you don't need to copy the [CrappyCode]. and [/CrappyCode] end tags.  Those are just for entertainment.  You will want to edit the domain names to protect the innocent, and whatever else you feel like modifying to suit your environmental needs.  The items in red are likely the items you will want to change for your needs.  

Also, the last line redirects the CSV piped content through a PowerShell pipeline into Add-ADGroupMember to stuff the new accounts into the Domain Admins group.  So easy, and cheap too.  Be careful of the line-wrapping headaches that come with copying from web browser windows. :)

The next piece is the CSV file (below).  Note that the first line contains the logical column headings, while the remaining lines are the actual data.  As long as the values are in the same relative order from left-to-right, it should work fine.  If you have values that contain apostrophes or commas be careful to "escape" them properly so they don't choke out the code like a backyard wrestling match gone wrong.

[CSV]

cn,givenname,sn,sAMAccountName,displayname,UserPrincipalName,description

SCCMRS,,,sccmrs,SCCM Reporting Services,sccmrs@fubar.local,SCCM SQL Reporting Services Account

SCCMNA,,,sccmna,SCCM Network Access,sccmna@fubar.local,SCCM Network Access Account

SCCM Install,,,sccminstall,SCCM Install,sccminstall@fubar.local,SCCM Server Installation Account

SCCMDomJoin,,,sccmdomjoin,SCCM Dom Join,sccmdomjoin@fubar.local,SCCM Domain Join Account

SCCMClient,,,sccmclient,SCCM Client Push,sccmclient@fubar.local,SCCM Client Push Account

SCCMSqlSvc,,,sccmsqlsvc,SCCM SQL Service,sccmsqlsvc@fubar.local,SCCM SQL Server Account

SCCMSqlAgent,,,sccmsqlagent,SCCM SQL Agent,sccmsqlagent@fubar.local,SCCM SQL Agent Account

SCCMOSD,,,sccmosd,SCCM OSD,sccmosd@fubar.local,SCCM OSD Deploy and Capture Account

[/CSV] 

Then, in your LAB environment (do not do this in production unless you like spending a lot of time in a courtroom with ugly people in suits), log on as a Domain Admin user, open the PowerShell console (right-click and select "Run as administrator"), and CD (change directory) to the path where you saved both of these files.

Then type in "powershell.exe -ExecutionPolicy Unrestricted -File useraccounts.csv

If you see a bunch of red text, you screwed up (probably as a result of believing what I tell you), but don't freak, go into the code and verify everything is neat and clean and the quotes are matched, etc.  Standard scripting/programming drudgery stuff.

When you're done, and assuming it works as intended (it did for me), you should see those accounts in the designated OU and each is a member of the "Domain Admins" group.

Cheers!

These are a Few of My Favorite Views (SQL with Fries and a Pepsi)

If you use System Center Configuration Manager 2007 or 2012, and you like to drink beer and play with firearms and flammable substances, and things like SQL Server Management Studio, well, I have no clue what you're thinking about.  Just kidding.  There are three places I can promise you I can spend a lot of time, calmly perusing the landscape:

• A Lowe's or Home Depot store (preferrably on a slow, week night)
• The beer section of a store like Total Wine
• SQL Server Management Studio and a System Center Configuration Manager site database

The first two are not at all surprising.  Almost any guy that lives near a big hardware store or beer store is in the same boat (apologies to any recovering alcoholics out there).  But the third is my personal weakness.  In days long past, it would have been supplanted by a good Lego kit, a stack of Marvel comic books, or a pile of Revell model kits or Estes rocket kits.  These days, crossing the 50 year milestone, it's become more geeky.  Sure, I love me some good woodworking projects (I just finished a badass bench swing in my backyard, all done by hand, no power tools. p-shaaaa!)

My favorite database views?

• v_Advertisement
• v_Collection
• v_Package
• v_GS_Computer_System
• v_R_System
• v_GS_Installed_Software_Categorized
• v_GS_System_Enclosure
• Any of the v_CM_COLL_XXXXXXXX collection views

Of course, I really dig poking around the site-related views, boundaries, discoveries, metering, etc.  As well as the operating system views, x86 memory stuff, collected files, software products and so on.

The saddest part of this?  I rattled those off from my pointy head, without being anywhere near access to the tables or views.  That's how deep they've become ingrained in my squishy skull.

If you're as twisted as I am, open SQL Management Studio, right-click on the Views section and create a new View.  Drag in some of the ones named above and link on ResourceID (or MachineID for some), and start exploring what kinds of cool things you can build on your own.  Data is like Lego's to me now.

Let's Talk About Software Repackaging. Mmmm kay?

For some unknown reason, there seems to be a noticeable uptick with regards to business interest in this thing called "software packaging".  It's often bundled with "/software deployment" or "software repackaging".  The problem seems (to me, anyway) that the more I talk with folks, the more it seems they have it wrong.  Really wrong.

Why?

Part of the problem is that, akin to software development, the aspects of the job role involve a VERY broad set of skills and experience.  Many of which are unrealistic to expect in a typical "IT" role.  The folks that do this work rarely planned to do it.  They fell into it.  Some like it.  Some do not.  But it is one rare place in the contemporary IT engineering world that crosses almost every discipline from tier 1 level to network engineering, Infosec, application development, systems administration, Active Directory, imaging, and years of basic troubleshooting injected with steroids and caffeine.

The other part, and it's a crucial one: There are NO certifications to quantify this role whatsoever.  Having an MCTS or MCP helps.  So does MCITP/MCSA/MCSE or MCSD or even MCSE/Desktop.  So does A+, Network+ and Security+.  So does a VMware VCP.  But if you're thinking of listing all of those under the "Required" or "Preferred" skills section: good luck.

I bet you may be thinking: "But, Dave, most modern apps are easy to deploy."  That's true.  Usually.  But the problems are not with most modern apps.  It's with dragging along the suitcase of legacy crap that most large-scale enterprise organizations still contend with.  They have oddball requirements that require an assortment of oddball products.  Those oddball products range from obscure garage-ware, to in-house "home-grown" crap, to stuff retired or replaced years ago by a vendor that no longer exists.  Add to that many products which were developed for Windows NT or Windows XP, but have no modern counterpart to use for running on Windows 8.

That leaves you with app-virtualization (App-V, ThinApp, XenApp, etc.) or some VDI infrastructure muscle (Remote App, Citrix and XenApp, etc.).  If you have those tools to use, great.  If not, you may be cracking open this dusty old book of repackaging.  Eye of newt. Tongue of toad.  Mmmm.

Clarification Time:  To Package or Repackage?

Software Packaging is the process and practice of building a new installation bundle for a software application.  The most common result is the age-old "setup.exe", but is more commonly being produced as a .MSI package file.  It may also include accompanying binaries, either compressed internally, or provided in sub-folders, etc.  A vendor-provided installation is one of the most common examples of a "software package".

Software Repackaging is the process and practice of taking a software package and modifying it to provide a reconfigured/customized installation package.  Examples include creating a MST (transform), a setup wrapper, a script, task sequence, Group Policy Object, or even embedding it within an OS image.

Why do I bother trying to explain these stupidly-confusing terms?  Because 99.99999999% of recruiters, IT managers, and housewives don't have a clue about what the differences are.

In short:  A Software Package is like a car bought from a local dealership lot.  A Software Repackage is like taking that car to the chop shop to install custom NOS, traction control, dash controls, roll cages and cloaking devices (okay, I made that up).  Hopefully, that makes it more understandable for you.

Skills?  What Skills?

What ingredients does a decent software packager/repackager require to cook up a good career soup?

• Experience with Windows Installer (command syntax, logging, exit codes, troubleshooting, etc.)
• Experience with InstallShield EXE packages (silent commands, answer files, etc.)
• Experience with a repackaging product like AdminStudio, InstallShield or Wise Installer (if that's still around).  Familiarity with other, similar products doesn't hurt, but those AdminStudio and InstallShield are the most desired.
• Windows Event Logs.  The ins and outs. Exporting.  Searching. Filtering, etc.
• Windows Environment Variables (%username%, %computername%, blah blah)
• Windows Path Assignments (%windir%, %appdata%, all that mess)
• NTFS File System aspects: ACLs, SACLs, DACLs, etc.
• ACLs with regards to the Registry
• The Registry (know it.  love it.  live it.)
• Windows Services (configuration, status monitoring, troubleshooting)
• Familiarity with Security Contexts (what accounts are running what things, etc.)
• Lot's and Lot's and Lot's of scripting experience: BAT, VBscript, Javascript, KiXtart or PowerShell.  Others will help, but mostly BAT, VBscript and PowerShell.
• Familiarity with Group Policy Objects and how they are processed on a computer.
• STRONG familiarity with Windows command-line tools: REG, REGSVR32, CACLS/XCACLS, REGINI, SET, SHUTDOWN, LOGOFF, SC, NETSH, PING, NSLOOKUP, and START.  All the newer stuff helps too, like WMIC, WEVTUTIL, DSQUERY/DSGET
• PSTools.  In fact, if you don't know who Mark Russinovich is, you're not getting hired. Sorry.
• Orca
• ROBOCOPY and all of it's drippy goodness.
• Familiarity with Virtual Machines (VMware Workstation, Hyper-V, Xen, blah blah) for testing and rollback, etc.

Absolutely Most-Basic Skills:

• Making a Windows Installer Transform
• Making a SETUP.EXE response file (.iss file)
• Basic script skills:  If/then/else, loops, etc.
• Command Tools:
• Querying and modifying folders, files and Registry keys and values
• Manipulating security permissions on files, folders and Registry values
• Stopping and starting Services
• Restarting a computer (local or remote)
• Using Process Monitor (and why)
• Using TASKLIST or PSLIST effectively (and why)
• MSIEXEC command syntax (seriously!  double-seriously actually)

Double Extra Bonus

• Familiarity with deployment automation products like Microsoft System Center Configuration Manager. Particularly: the creating, maintaining and troubleshooting of:
• Collections (and queries)
• Packages and Programs
• Applications (SCCM 2012)
• Advertisements
• Maintenance Windows
• Group Policy Preferences. Item-Level Targeting (aka WMI Filtering). Blocking and Inheritance, sequence ordering, RSOP, blah blah.
• Deep understanding of the differences between snapshot capturing and snapshot/monitoring captures.
• MDT (Microsoft Deployment Toolkit) and ADK tools
• Logon, Logoff, Startup and Shutdown scripts
• Active Setup
• Application Compatibility Toolkit (ACT) and building shims (know what shims are also)
• DISM
• Using and Mounting ISO and WIM files

Will you have to use all of these all of the time?  No.  Will you need to use these a lot?  Maybe.  But the more familiar you are with this list the better you will be at planning, preparing, developing, testing and deploying application packages.

Triple Extra Double Bonus

• Great customer relation skills.
• Being able to have a sincere conversation with users who have almost zero understanding of the effort you put into making things work for them which appear to be effortless.
• Great note-taking skills
• Patience, especially when sitting through long meetings
• Following-up on things (customer responses, meetings, reports, etc.)
• Prioritizing (projects, tasks and personal tasks)
• Scheduling (personal and group/team events)
• Sticking to your guns
• Developing a deep and loving relationship with coffee or tea
• Developing a deep and loving relationship with beer, wine and/or liquor
• Being consistent, dependable, and on-time
• Focusing on documentation and organization of notes and materials
• Having the ability to calm down panicked users/managers during a crisis and methodically gathering the facts to diagnose the problem properly.

Toughest Challenges?

• User Acceptance Testing (UAT)
• Vendor Tech Support discussions (or email threads).  Especially the kind where you ask for help and they promise to "get back to you" and never do.
• Customers who insist they CANNOT function without that MS-Access 2003 "application" or the entire company will fold and close. (bonus points for FoxPro 9 apps)
• Hours and hours of reading the most excruciatingly boring manuals.
• Hours and hours of searching web sites for troubleshooting tips for that one niche app "Fubar 1997" that won't seem to work on Windows 8.1
• Decaf coffee, and Ice Cream-flavored store brand coffee.
• Bowls of sugary junk food sitting around for weeks on end.
• Hours of conversation with coworkers who are either (A) uber-religious or (B) uber-atheist, and neither can wait to remind you just how awesomely correct their views are.
• Recaps of last nights sports event or draft picks, especially those incredibly important fantasy league trade discussions.
• Listening to arguments over which sport is the toughest or which TV show is best, or which car is fastest or which asshole has the toughest job and most difficult customers.
• Tearing off in a panic to the closest restroom, ripping off your clothes quickly, sitting down, letting loose, closing your eyes, exhaling slowly, and then opening your eyes to discover there's no toilet tissue.
• Traffic (except for you lucky assholes that work from home)
• Cold, stale coffee... but only if it already has that white fuzzy mold on it.  Otherwise it's just fine.

The Yellow Brick Road

I've tried several times to get an effort off the ground to offer training in this regard, but there doesn't seem to be much public interest.  Developing a cohesive and coherent training outline is a challenge, but my colleague Chris DeCarlo and I have worked pretty hard to build a decent syllabus.  We've even developed a faux exam to cross-exam hapless victims (aka prospective applicants).  Maybe things will change.  But for now it seems there's a nail waiting for the right hammer to come along.

BPA. Again? Yes. and THIS time with Fries and a Drink

The Challenge

Your tech staff wants to be able to swap-out existing desktop computers with the least amount of administrative overhead.  Basically, they want to be able to walk up with a new computer, unplug the old one, plug in the new one, turn it on and walk away.  The stuff on the existing computer should magically end up on the new computer (sans all the usual personal crap that shouldn't be stored on a local computer in the first place).

What are these "stuff"?  Applications, default/initial configuration settings, printer mappings, Outlook profile settings, etc.

The Tools at Hand

Active Directory (Windows Server 2012), Group Policy, System Center Configuration Manager (2007, but that's for another discussion), SCCM OSD+MDT+ADK+Coffee, SQL Server 2012, ASP (yes, the sticky, smelly old classic kind), Packaged Software (already loaded into SCCM), a tablet running Windows 8.1 and a bluetooth barcode scanner.  Also, a van, a hand-truck, appropriate weather-oriented clothing, hydration substances and a fully-loaded firearm (okay, not for all situations).

Options

Options are good.  This is just one option.  One that I am fortunate to be working with actually.

If the computer is mapped into the appropriate collections within Configuration Manager, and managed and monitored via logical memberships and dispositional relationships (Active Directory Security Groups, Active Directory Organizational Unit location), you're in what NFL fans would call "the Red Zone".

The Binding Adhesives:

• Assuming that the existing computer finds its way into a functional or organizational related Collection within SCCM, you have a means for aiming things at it by function and/or organization (sector, department, division, business unit, etc.)
• Assuming that the existing computer has things configured via Group Policy, it is likely grouped under a logical OU environment.
• Assuming it is targeted via either query-based Collections (handy), or direct-membership Collections (a little more work but still handy) you have another means for aiming things at it in a logical manner.
• Assuming, and this is a reach for some environments, but very common in others: you have barcode labels on assets that are relational to their AD account names, oooh.  You are in very good position to throw a touchdown now.

The Process Walk-Through

• Technician arrives at customer location with new computer, already imaged with a generic, standard "load" (Windows, Office, base applications, etc.) and joined to AD in a generic OU. It also has a functional SCCM client agent.
• The technician gets the existing barcode and the new barcode values.  Enters them into a web form (from the computer itself or from a third device, such as a tablet or phone).  Hit "submit".  Swap-out the hardware, reconnect, power up the new stuff and run off with the old stuff.

In the background:

• The data is queued (in a relational database, such as SQL Server) for the "old" and "new" computer names.  Since both already exist in AD and in Configuration Manager...
• A scheduled, or triggered, task invokes a script that queries the database for pending items (those which have not been swapped out yet)
• Step 1 is fetching the "old" computer information:
• AD OU
• AD Security Groups
• AD account description property (if desired)
• AD account location property (if desired)
• SCCM direct-membership Collections
• Step 2 is taking action:
• Move "new" computer into correct OU
• Add "new" computer to same AD groups
• Add "new" computer to same SCCM direct-membership Collections
• Update AD account properties (description, location, etc. if desired)
• Disable "old" computer AD account
• Remove "old' computer from AD security groups
• Move "old" computer AD account to special OU (for GPO management aspects)
• Update asset inventory tracking database (operational status, if relevant, etc.)
• Force a restart of the "new" computer (to force GPO updates, SCCM client policy polling and discovery updates)
• Step 3 - mopping up
• No process model is without exceptions:  manual installations, special device installation, white-glove stuff, etc.

Suiting Up

All of this is not only possible, it's not that difficult with the right planning and testing.  I'm currently using ASP on IIS from an internal Windows Server 2012 box.  The queue is managed in SQL Server 2012.  The script process uses VBscript, but will soon be ported to PowerShell.  The interfaces are COM, WMI, SWBEM, ADO and LDAP/ADSI.  All are very common building blocks in Windows environments.

When was the last time you played with a Lego kit or one of those car/ship/aircraft model kits?

Repeat after me: "It often comes with headaches, but I usually love what I do for a living."

:)

If I Were In Charge of Microsoft Right Now...

Yes.  This is extremely "pie-in-the-sky" stuff, but I need a mental break from working two jobs every day.  I'm sure you can poke a million holes in these suggestions, but whatever... enjoy!

1. Stop all work on the Windows OS and call a big-ass meeting to do a massive "reset" on that 400-headed beast.  Consolidate and streamline EVERY command utility, API, etc.  A common syntax for everything.  Eliminate overlaps and redundancy.  Retool for true 64-bit (or 128?) rather than the dragging on the current 32/64 band-aid stupidity.  Tell partners/vendors "f-u" if you don't comply with the new platform specs.  No more backwards compatibility work.
2. Redesign the interface so it adapts to the devices, rather than forcing you to use a tablet interface for a keyboard and mouse work environment.
3. Give away App-V for free (like MDT and WSUS are handled)
4. Get rid of MDOP as a product and make the rest of it (sans App-V) part of the Windows platform.
5. Get some fresh faces in the System Center group to retool Configuration Manager to be easier and simpler to (A) install and configure and (B) manage.
6. Revisit the "Essentials" idea.
7. Deploy physical "Microsoft Store" facilities, like Apple did.  Online shopping is cool but tinkering with shit in your physical hands shouldn't be ignored.  Oh, and include those nifty-ass Starbucks automated barista machines they have at their own campuses.  Those things kick ass.
8. Make ads that are funny.  If it doesn't make me laugh and cough my beer through my nose, then it needs to go back to the production room and get some more work.

10 Questions: With Johan Arwidmark

Note:  This is (hopefully) the kick-off segment to an ongoing series I want to do on interviewing some of the most influential geeks I've had the honor and luck of meeting or conversing with.  I hope you find these both entertaining and informative.  Thank you!

Introduction

If you work in a place where there are a lot of Windows-based computers, chances are you have an Systems Support Team, or maybe an IT Department, that supports them.  If that team is focused on efficiency, chances are they try to automate as many of the computer and software installations as possible.  If they are *really* focused, chances are they are using Microsoft Deployment Toolkit (MDT), or System Center Configuration Manager "OSD" (operating system deployment) to handle the heavy-lifting. And, if they even know what those tools are, they know the name: Johan Arwidmark.

Johan Arwidmark is the Chief Technical Architect at Knowledge Factory, a consulting firm based in Sweden.  You can find his articles on Microsoft's Channel9, MyITForum, Deployment Research, TrueSec, and probably a dozen other sites. You can also find his daily happenings on Twitter, Facebook, Google Plus, and several other social networking sites.  With his crazy schedule, it makes it hard for anyone else to claim "too busy" as a reason to not post a status once in a while.

While Johan was born and raised in Sweden, his name is known around the world as a trusted, valuable source of useful information for IT professionals.  A renown speaker, author and winner of nine (yes 9) Microsoft MVP awards, it is indeed difficult to search for information on things like MDT, OSD, USMT, WinPE, Config Mgr, or even "Windows Deployment", without seeing his name pop up in the results.  Often seen with his colleague, Mikael Nystrom, these two are great reasons enough to attend Microsoft's TechEd and MMS conferences every year, where they consistently pack the room.

I asked Johan if would be willing to do a ten-question "interview", and he agreed.  This alone is amazing for two main reasons: (1) I'm obviously *not* a famous magazine interviewer, and (2) Johan's schedule is insanely busy.  In any case, I am honored and happy to present this short interview for you to enjoy...


The Questions

Dave: When did you first try to customize or modify a computer? Can you recall what you tried to accomplish?

Johan:  I don't know if it really counts as customization, by I recall adjusting the 1530 tape drive head alignment  Next stop was probably soldering midi-contacts for my Amiga 500.

Dave: What does MDT mean to you from a personal aspect? How has it changed your life?

Johan: MDT drastically changed how I worked with windows deployment, before BDD/MDT I used to develop my own deployment solutions, and after BDD/MDT I have focused in customization rather than building from scratch.

Dave: Where do see MDT in five years?

Johan: Pretty much the same (I fear)…  In a dream scenario, MDT functions would replace OSD in WDS, and be part of core Windows.

Dave: In the course of your world travels, what trends do you see that might surprise most of us who only see our immediate surroundings? In other words: do you feel that IT professionals in the Middle East, or Spain, favor certain products or features than those living and working in Australia, Sweden, Canada, Japan or the US?

Johan: IT Pro’s work pretty much the same all over the world… I don’t see that much difference.

Dave: If you were given absolute control over Microsoft for one year, what changes would you like to insist upon?

Johan: Haha, first I would make MDT and Windows Setup into one single deployment solution, add some serious resources to the team, and remove all other setup solutions except OSD in ConfigMgr.

Dave: You mentioned that Phoenix is one of your favorite places to visit.  What things do you like most about that city and the surrounding area?

Johan: Phoenix? I don’t recall saying that...  My favorite spot right now is New York, for being a place where it appears the entire world has gathered.

(Dave's note: I must have missed my coffee on the question above.  I think I got crossed-up with someone else.  My apologies)

Dave: What's your favorite, or most critical, "freeware", or open-source software utility?

Johan: MDT, no doubt

Dave: Have you read any good books, or seen any particularly good movies this year? If so, which ones?

Johan: Plenty, I’m both a book and movie nerd. My latest favorites are the Game of Throne books and the “Now you see me” movie.

Dave: Which airport is the most pleasant to get through, and which one do you dread thinking about?

Johan: Copenhagen airport is like a second home to me, and always give me a warm and fuzzy feeling. Charles De Gaulle is the probably worst airport, ever….

Dave: If you hadn't gone into the IT world at all, what do you think you would be doing for a living today?


Johan: Yee, that’s a hard one, I have been an IT guy since I was ten year old... I would probably have been a musician (I used to play electric guitar) or a writer of fantasy books.

Conclusion

If you enjoyed this brief interview, or you didn't, I still encourage you to visit the links below to explore more of the things Johan has influenced for the better.  Thank you!

Channel9
Deployment Research
MyITForum
TrueSec
Amazon Books
Vimeo Videos

Big News! E-Book Price Reductions!

If you have ever stayed awake long enough to read through any of my books: THANK YOU!

If you've read one or two of them, and wondered if any of the others are any good, well.... now is your chance to explore.

Big News...
Major Pricing Discounts on my E-Books!

Major Discounts will be applied starting this week.  Amazon has to process the price changes, so they may not be posted for another 24-48 hours (from today: July 24, 2013).

If you still see the "Old Price" posted on the Amazon product page, refresh the web page or come back to it until you see the updated prices.

The new prices are shown below.  Read the Q & A below for more information...

Amazon Kindle Publication	Old Price (USD)	New Price (USD)	Discount
Grinding Gears: The Art of Software Repackaging and Deployment Packaging, Testing, Deploying, Uninstalling and Upgrading Software Applications on the Windows platform.  Also covers Configuration Manager, Scripting, Group Policy, and more!	$6.99	$5.99	15%
Why Your Next IT Project Will Fail (and What You Can Do to Avoid It) Why do Projects fail? More specifically: Why do IT Projects fail? Is there a common thread or pattern that exists among failed IT Projects? Is it predominantly a failure of technology; of people; or a failure of both? Are there warning signs that make it easy to spot the causes before they become problems, with sufficient time to correct them? Are there steps that can be taken to correct the problem once it's begun? Are there strategies that can help prevent these potential issues from occurring again?	$4.99	$2.99	40%
The Visual LISP Developer's Bible: 2011 Edition Developing, Testing and Compiling VLISP code for AutoCAD 2011.  VLIDE options as well as tips and tricks.	$7.99	$5.99	25%
The Visual LISP Developer's Bible: 1st Edition The Original. The e-book that started it all for me.	$4.99	$2.99	40%
The AutoCAD Network Administrator's Bible: 2013 Edition Setting up FlexLM and network licensing. Building, Testing and Deploying Autodesk 2013 products (aka "Deployments"), logs, option files, troubleshooting and more.	$9.99	$7.99	20%
The AutoCAD Network Administrator's Bible: 2012 Edition Setting up FlexLM and network licensing. Building, Testing and Deploying Autodesk 2012 products (aka "Deployments"), logs, option files, troubleshooting and more.	$6.99	$4.99	30%
The AutoCAD Network Administrator's Bible: 2011 Edition Setting up FlexLM and network licensing. Building, Testing and Deploying Autodesk 2011 products (aka "Deployments"), logs, option files, troubleshooting and more.	$3.99	$2.99	25%

In addition: Some of my e-Books which were not enrolled in the Amazon KDP Select program, are now enrolled! 

• The Packager's Pocket Reference, 2nd Edition ($5.99)
• Grinding Gears: The Art of Software Repackaging and Deployment ($5.99)
• You're Only as Good as Your Last Mistake ($2.99)

Q & A (Questions and Answers)

How Long will this Discount Offer Last?  These prices will remain in effect until August 10, 2013, or roughly 16 days from when the new prices go into effect.  After that, they will be returned to their previous prices.

Do you need a Kindle to read these?  NO.  You can download a FREE Kindle Reader App for almost any mobile device.  You can also read them in almost any web browser using the Amazon Kindle Cloud Reader.

You can read these, using a FREE reader app, on your iPhone, iTablet, iPod, Blackberry, Android device, Windows device, and more.

What Locations will see these Discounts?  The new prices will go into effect in all markets in which Amazon applies international currency conversions.  If you live or reside in a location which is not handled by their automated currency conversion process,  you will see whatever discount is applied as a derived translation of the U.S. Dollar value, as best as I can figure out. 

The markets which are covered by their automatic conversion process, as of now,  include: The United States, United Kingdom, France, Germany, Spain, Italy, India, Japan, Brazil, and Canada.  For more information, visit the Amazon web site and be sure to drink plenty of caffeine.

What does this "KDP Select" stuff mean?  It means Amazon Prime members can LEND and BORROW those e-books for FREE.  Yes.  For Free!  Ok, well, becoming an Amazon Prime member isn't really "free", but it does give you some pretty darn amazing discounts and cool features you can't get otherwise.

How Many of my e-Books are enrolled in this "KDP Select" program for Amazon Prime members to benefit from?  All of them.  If you find any that are not available for lending and borrowing on Amazon Prime as of July 26, 2013, please post a comment here and let me know!

How do I know which books are written by this same "David M. Stein"?  I've been told there are other "David Stein" authors out there, some with rather interesting tastes in book topics.  Rest assured that I have only written the books you see listed on my Kindle Author's page

Why am I doing this?  It's simple:  I have four kids still living at home, and my car is pretty darn old.  So you can rest assured that while you save money, and stuff your brain with new information, you're also helping a good cause.