Understanding System Center Advisor

Desired State Configuration (DSC) is a feature new to Windows PowerShell 4.0 that allows you to manage the configuration of computers, accomplishing many of the objectives with Windows PowerShell that you could otherwise accomplish using compliance settings with Configuration Manager. You can use DSC to perform the following tasks:

• Ensuring that server roles and features are either enabled or disabled
• Managing registry settings
• Managing files and directories
• Managing service and the state of processes
• Managing user and group accounts
• Software deployment
• Managing environment variables
• Assessing configuration state
• Remediating configuration drift

When using DSC, you define a Windows PowerShell script block using the configuration keyword. This script block allows you to specify the desired configuration for each computer (termed nodes in DSC). Within the script block, you can define resource blocks as a way of configuring specific resources. When you invoke the configuration, a MOF file is created in a new directory that is a child of the current directory with the same name as the configuration block. The newly created MOF file stores configuration information about the target computers. You can enforce the configuration by running the Start-DscConfiguration cmdlet.

Using Desired State Configuration

System Center Advisor is a cloud-based service that collects data from computers and generates alerts based on that data. For example, System Center Advisor can generate alerts about missing security updates, or where the configuration of a computer deviates substantially from best practice. The knowledge used to raise these advisory alerts comes from Microsoft’s engineering support team, and reflects direct customer experiences running the products in production environments.

System Center Advisor includes the Advisor web service, hosted in Microsoft’s cloud, an on premise gateway, and one or more agents, which you deploy to computers in your environment. The agent functions in a way that is similar to the Operations Manager agent. By connecting to the web portal, you can view alerts and advise on how to remediate those issues. Figure 1 shows a typical System Center Advisor deployment, with agents installed on local computers communicating with a gateway, that forwards collected data that is stored and analyzed in the cloud.

FIGURE 1 System Center Advisor

Understanding compliance settings

Compliance settings, which in previous versions of System Center Configuration Manager was termed Desired Configuration Management, allows you to monitor and remediate the configuration of computers.

Configuration Manager’s compliance settings functionality uses configuration items and configuration baselines. A configuration item includes one or more settings that you want to assess to determine the compliance state of a computer. The configuration item includes compliance rules to evaluate the settings, as well as providing severity ratings for noncompliance. Some configuration items can be configured for remediation, which allows you to alter a non-compliant setting so that it is compliant. Configuration baselines are collections of software updates, configuration items, and other configuration baselines.

Configuration items

Configuration Manager supports the following types of configuration items for assessing the compliance of computers:

• Application configuration item Use this type of configuration item to determine application compliance, including whether the application is installed and whether it is configured in a specific manner.
• Operating system configuration item Allows you to determine operating system configuration compliance, such as whether particular roles or features are installed and particular registry keys are configured.
• Software updates configuration item Available when you manage software updates with Configuration Manager, and allows you to assess whether a computer has specific software updates installed.

For example, to create a configuration item related to whether Remote Desktop is enabled on a target computer running the Windows Server 2012 R2 operating system, perform the following steps:

1. In the Assets And Compliance workspace of the Configuration Manager console, select the Configuration Items node under the Compliance Settings node. On the ribbon, click Create Configuration Item.

2. On the General page of the Create Configuration Item Wizard, provide a name and ensure that the type of configuration item is set to Windows, as shown in Figure 1.

FIGURE 1 Create Configuration Item Wizard

3. On the Supported Platforms page, ensure that Windows Server 2012 R2 is selected, as shown in Figure 2 You should only select the operating systems that you want the configuration item assessed for on this page.

FIGURE 2 Select Windows versions

4. On the Settings page, click New. This will launch the Create Setting dialog box.

5. In the Create Setting dialog box, click Browse.

6. In the registry tree, navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server, and select the fDenyTSConnections registry value. In this scenario, the value is set to 0, which allows Remote Desktop connections. Enable the This Registry Value Must Satisfy The Following Rule If Present Equals 0, as shown in Figure 3.

FIGURE 3 Browse Registry

7. Enter a name for the rule. On the Compliance Rules page, click the fDenyTSConnections Equals 0 condition, and click Edit. Select the Remediate Noncompliant Rules When Supported and Report Noncompliance If This Setting Instance Is Not Found check boxes, and set the Noncompliance Severity For Reports to Critical, as shown in Figure 4.

FIGURE 4 Edit Rule

8. Complete the wizard to create the configuration item.

Configuration baselines

Configuration baselines can include configuration items, software updates, and other configuration baselines. To create a configuration baseline that includes the Remote Desktop configuration item configured earlier, perform the following steps:

1. In the Assets And Compliance workspace of the Configuration Manager console, select Configuration Baselines under Compliance Settings.

2. On the ribbon, click Create Configuration Baseline. This will launch the Create Configuration Baseline dialog box.

3. On the Create Configuration Baseline dialog box, specify a name for the baseline, and then click Add, and then click Configuration Items.

4. On the Add Configuration Items dialog box, click the Remote Desktop Enabled configuration item, and click Add, as shown in Figure 5.

FIGURE 5 Add Configuration Items

5. Verify that the configuration item is present, as shown in Figure 6, and then click OK.

FIGURE 6 Create Configuration Baseline

To deploy the configuration baseline to a collection, select the configuration baseline, and click Deploy on the ribbon. When deploying the baseline, select the collection to which you want to deploy the baseline, and also choose whether you want to enable remediation. Figure 7 shows the Server 2012 R2 Configuration Baseline deployed to the Windows Server 2012 R2 Servers collection with the remediation option enabled.

FIGURE 7 Deploy Configuration Baselines

Once the configuration baseline has been deployed, you’ll be able to view a list of compliant and non-compliant computers from the Configuration Baseline node, by selecting the baseline in Deployments node in the Monitoring workspace, or by viewing reports in the Compliance And Settings Management report category.

Remediation

Certain types of configuration items can be remediated, but only when the item is included in a baseline deployment that you have also configured for remediation. Remediation is only available for the following types of computer related configuration items:

• Registry value
• Scripts
• WQL query configuration items

You can configure remediation to be performed, either by creating a value if it is not present, altering a value if it exists but is not compliant (for example, changing a registry value), or by running a remediation script. The remediation script will need to alter the setting to the desired state.

Implementing System Center Process Pack for IT GRC

GRC is an acronym for governance, risk management, and compliance. The IT GRC Process Pack allows you to provide automated compliance management through the System Center suite. The System Center Process Pack for IT GRC allows you to manage IT operations and information management; it does not include other governance, risk management, and compliance functionality for other areas such as organizational accounting and business operations.

A control objective is a desired state result that has been met through risk assessment. For example, a control objective might be that user accounts of contract workers have an expiry date. This objective might have been selected after risk analysis found that some contractors had network access after their contract term finished. Control activities allow control objectives to be accomplished.

The System Center Process Pack for IT GRC uses the following System Center segments:

• Service Manager This hosts the System Center Process Pack for IT GRC and allows you to run the controls and activities that are necessary to meet control objectives. The System Center Process Pack for IT GRC requires that Service Manager be configured with the Active Directory, Operations Manager, and Configuration Manager connectors.
• Service Manager data warehouse This allows you to generate compliance and risk reports to audit and review compliance information. It is required for System Center Process Pack for IT GRC reporting.
• Configuration Manager site server Configuration Manager provides configuration drift reporting. Configuration drift occurs when a computer’s configuration changes from those specified in a desired configuration baseline. It requires the deployment of Configuration Manager agents on monitored computers.
• Operations Manager This manages alerts generated when computers drift from the desired configuration baseline. It requires the deployment of the Operations Manager agent on to monitored computers.

You install the System Center Process Pack for IT GRC on to the Service Manager server. After you have the Process Pack, run the MpSyncJob to synchronize Service Manager with the data warehouse. Then import the IT Compliance Management Libraries into Service Manager and the desired Configuration Management configuration items and baselines into Configuration Manager.

When implementing a compliance program, it is occasionally necessary to configure program exceptions. You create exceptions for services or servers that cannot be made compliant with control objectives. You can create the following exception types:

• Control activity scope exceptions This type of exception allows you to exclude specific control activities when checking compliance.
• IT GRC program exceptions This type of exception allows you to exclude a specific computer from an IT GRC program.
• IT GRC policy exceptions This type of exception allows you to exclude control activities that are not applicable to your organization.

Updating offline VMs

Prior to the release of System Center 2012 R2 Virtual Machine Manager, administrators used the Virtual Machine Servicing Tool (VMST) to apply software updates to offline VMM virtual machines. Since the release of System Center 2012 R2 Virtual Machine Manager, the recommended method of updating offline virtual machines is to use a service management automation runbook that is available on Microsoft’s website. The service management automation runbook performs the following tasks:

1. Locate all images stored in the VMM library.

2. Mount each virtual machine hard disk image on the VMM server.

3. Locate updates that are made available through WSUS.

4. Perform a check to determine if the update is applicable.

5. Perform a check to determine whether the update has been applied.

6. Apply updates to the mounted virtual hard disk image.

7. Commit the changes to the virtual hard disk and dismount.

Integrating WSUS with VMM

You can integrate WSUS with VMM as a way of centrally managing updates for your organization’s virtualization servers and VMM infrastructure servers. Integrating WSUS with VMM allows you to:

• Collect updates together in baselines
• Determine update compliance.
• Remediate update compliance.
• Automatically evacuate VMs off of host cluster nodes that require a reboot to install updates.

Configuring WSUS with VMM

While it’s possible to deploy the WSUS role on the computer that hosts VMM, Microsoft recommends that WSUS be deployed on a separate computer. You should run the WSUS Configuration Wizard to perform preliminary WSUS configuration, and perform a synchronization prior to integrating with VMM. You can run the WSUS Configuration Wizard and perform a synchronization using the default settings.

To integrate WSUS with VMM, perform the following steps:

1. In the Fabric workspace of the VMM console, click the Update Server Node under Infrastructure, as shown in Figure 1.

FIGURE 1 Update Server

2. On the Ribbon, click Add Resources, and then click Update Server. This will launch the Add Windows Server Update Services Server dialog box.

3. In the Add Windows Server Update Services Server dialog box, provide the following information, as shown in Figure 2, and then click Add.

• Computer Name The FQDN of the WSUS server.
• TCP Port The WSUS server’s TCP port. By default, this is port 8530 (or port 8531 if using SSL) when you deploy WSUS on computers running Windows Server 2012 or Windows Server 2012 R2.
• Credentials An account with local Administrator privileges on the WSUS server. You can also use a Run As account for this task.

FIGURE 2 Add Update Server

4. Once the installation completes, verify that the update server is listed when the Update Server node is selected. The Agent Status is set to Responding, and Synchronization Result is listed as Succeeded, as shown in Figure 3.

FIGURE 3 Update Server

5. To check which updates are available, in the Library workspace, select Update Catalog under Update Catalog And Baselines, and verify that updates are listed, as shown in Figure 4.

FIGURE 4 Update Catalog

After the initial synchronization is performed to gather the current list of available updates, VMM will not perform subsequent synchronizations automatically. This means that you need to either perform them manually, or configure a scheduled task using the Start-SCUpdateServerSynchronization Windows PowerShell cmdlet. To trigger a synchronization using the VMM console, perform the following steps:

1. In the Fabric workspace of the VMM console, select Update Server under the Servers\Infrastructure node.

2. Select the WSUS server that you want VMM to synchronize.

3. On the ribbon, click the Synchronize icon.

To trigger synchronization from the Virtual Machine Manager Command Shell, issue the following command, where WSUSServerName is the name of the WSUS server.

SCUpdateServerSynchronization WSUSServerName

Update baselines

An update baseline is a collection of software updates. You can use update baselines as a way of assessing computers and applications to determine whether or not they are up-to-date. A computer that has all of the updates that are in an update baseline collection installed is said to be compliant. A computer that does not have all of the updates that are in an update baseline collection installed is said to be non-compliant.

You assign baselines to computers performing the following VMM roles:

• Host group
• Individual hosts
• Library servers
• PXE servers
• Update server
• VMM Management server

Figure 5 shows the Assignment Scope page of the Update Baseline Wizard.

FIGURE 5 Assignment Scope

Assigning an update baseline does the following:

• When you assign a baseline to a host group, the baseline will apply to all stand-alone hosts and host clusters that are members of the group. The baseline also applies to any stand-alone costs and host clusters that are members of child host groups.
• When you move a host or host cluster between host groups, the host or host cluster will use the update baseline associated with its new host group.
• If you assign a baseline to a host or a host cluster directly, the host or host cluster will use that update baseline when moved between host groups.

To create a new update baseline, perform the following steps:

1. In the Library workspace of the VMM console, click Update Baselines under Update Catalog And Baselines.

2. On the ribbon, click Create, and then click Baseline. This will launch the Update Baseline Wizard.

3. On the General page of the Update Baseline Wizard, provide a name and description for the baseline.

4. On the Updates page of the Update Baseline Wizard, click Add. This will launch the Add Updates To Baseline dialog box. You use this dialog box to add updates to the baseline. Figure 6 shows a security update for Windows Server 2012 R2 selected for addition to the baseline. Select all of the updates that you want to have in the baseline, and click Add.

FIGURE 6 Add Updates To Baseline

5. On the Updates page of the Update Baseline Wizard, shown in Figure 7, review the list of updates in the baseline, and then click Next.

FIGURE 7 Updates

6. On the Assignment Scope page, select the servers, host clusters, and host groups to which you wish to assign the baseline. You don’t have to assign the baseline at this time. You can do it after you have created the baseline.

7. Complete the wizard to create the update baseline.

To assign computers to a baseline, edit the properties of the baseline and select the host groups, hosts, or infrastructure server to which you want the baseline to apply. Figure 8 shows the TailspinToys Baseline update baseline being assigned to the Example-Host-Group host group.

FIGURE 8 Assign

Update compliance

After assigning an update baseline, you can perform a scan to determine the compliance status of the computers subject to the baseline. A compliance scan checks whether each update in the baseline is applicable to the computer and, if the update is applicable, whether that update is installed. After a compliance scan, each update will have one of the following statuses:

• Compliant
• Non Compliant
• Error
• Pending Reboot
• Unknown

The unknown status often applies when hosts are moved between host groups, when updates are added or removed from baselines, or when computers are added to the scope of the baseline. Viewing compliance properties will provide additional information.

To scan a computer to determine whether or not it is compliant, perform the following steps:

1. In the Fabric workspace of the VMM console, select the server on which you want to perform the compliance check.

2. On the Home tab of the ribbon, click Scan.

3. On the Home tab of the ribbon, click Compliance Properties to view the compliance state of the computer. Figure 9 shows the compliance state of Hv-host-a.tailspintoys.internal against the TailspinToys Baseline.

FIGURE 9 Compliance Properties

You can use the Compliance Properties dialog box to exempt a particular computer from a specific update. Figure 10 shows two updates exempted from a particular baseline for host Hv-host-a.tailspintoys.internal.

FIGURE 10 Exemption

To create an exemption, select those updates you want to exempt from the baseline, and click Create. This launches the Create Exemption dialog box. When using this dialog box, provide notes that explain why the computer or computers in question have been exempted from the updates being applied, as shown in Figure 11.

FIGURE 11 Create Exemption

Update remediation

Remediating a computer applies updates that are relevant but have yet to be applied to a computer. To remediate a computer, select the update baseline under the computer Compliance view in the Fabric workspace, as shown in Figure 12, and then click Remediate on the ribbon.

FIGURE 12 Non Compliant

On the Update Remediation dialog box, shown in Figure 13, select whether to restart servers to complete update installation. If you are applying updates to Hyper-V cluster nodes, you can also select whether virtual machines will be evacuated from the node, or placed into a saved state.

FIGURE 13 Update Remediation

Managing updates with Configuration Manager

WSUS provides basic update management functionality, but does not provide advanced functionality such as maintenance windows, configuration baselines, support for Network Access Protection, and support for Wake On LAN. You can integrate WSUS with System Center 2012 R2 Configuration Manager to provide advanced software update management functionality for computers in your private cloud environment. When you integrate WSUS with Configuration Manager, you perform update management tasks using the Configuration Manager console.

Integrating WSUS with Configuration Manager

Integrating WSUS with Configuration Manager involves installing and configuring a software update point and synchronizing the software update point’s metadata with Configuration Manager. To deploy a software update point when WSUS has been deployed and configured on another computer, perform the following steps:

1. In the Administration workspace of the Configuration Manager console, select Servers And Site System Roles under the Site Configuration node.

2. On the Home tab of the ribbon, click Create Site System Server.

3. On the General page of the Create Site System Server Wizard, specify the name of the server that hosts WSUS, the site code, and the account used for deploying the site system. Figure 1 shows the server CBR-WSUS.tailspintoys.internal being configured for this role.

FIGURE 1 Create Site System Server Wizard

4. On the Proxy Server page, you can specify the details of any proxy server required to allow the computer that hosts the site server role the ability to connect to hosts on the Internet.

5. On the System Role Selection page, select Software Update Point, as shown in Figure 2.

FIGURE 2 Software update point

6. On the Software Update Point page, specify whether WSUS will use port 80 and 443, or port 8530 and 8531. Ports 80 and 443 are the default for WSUS 3.0 SP2. Ports 8530 and 8531 are the default for WSUS on Windows Server 2012 and Windows Server 2012 R2. You can also specify whether connections will be limited to Internet, intranet, or both intranet and Internet clients. Figure 3 shows this page of the wizard.

FIGURE 3 Software Update Point settings

7. On the Proxy And Account Settings page, specify the account that will be used to connect from the Configuration Manager site server to the WSUS server.

8. On the Synchronization Source page, specify whether the WSUS server will synchronize updates from Microsoft update, or from another WSUS server. You can also use this page to specify whether WSUS will continue to generate reports. If you are using Configuration Manager’s more sophisticated reporting functionality, you do not need to enable WSUS reporting. Figure 4 shows the Synchronization Source set to Microsoft Update.

FIGURE 4 Synchronization Source

9. On the Synchronization Schedule page, specify how often synchronization should occur. You can also perform synchronization manually.

10. On the Supersedence Behavior page, specify how to treat superseded updates. You can configure superseded updates to expire immediately, or after a specific number of months.

11. On the Classifications page, shown in Figure 5, specify which updates Configuration Manager will use the WSUS server to obtain.

FIGURE 5 Update classifications

12. On the Products page, specify which product you wish to provide updates for.

13. On the Languages page, specify the product language versions that you want to support, and then complete the wizard.

Once you have configured the Software Update point, you can trigger a manual synchronization by performing the following steps:

1. In the Software Library workspace of the Configuration Manager console, click All Software Updates under Software Updates.

2. On the ribbon, click Synchronize Software Updates. You can view the status of the synchronization by checking the SMS_WSUS_SYNC_MANAGER segment in the Component Status node of the Monitoring workspace.

Software update groups

Software update groups allow you to collect together updates. You can add software updates to software update groups manually, or automatically configure new software updates to be added to a software update group through an automatic deployment rule. You can deploy software update groups to Configuration Manager collections. Configuration Manager collections are groups of configuration manager clients or users, though you can only deploy software updates to client collections. You can deploy software update groups to collections either manually, or automatically through an automatic deployment rule. When you deploy a software update group to a collection, any new updates that you add to the group are automatically deployed to the collection.

To add software updates to a new software update group, perform the following steps:

1. In the Software Library workspace of the Configuration Manager console, click All Software Updates under Software Updates.

2. Select the updates that you want to add to the new software update group, and then click Create Software Update Group on the ribbon.

3. Provide a meaningful name for the update group, and then click Create. Figure 6 shows the Create Software Update Group dialog box.

FIGURE 6 Update group

Once you have created the update group, you need to download the updates themselves, so that you can deploy them to clients. To download the constituent files of an upgrade group, select the update group, and then click Download. This will launch the Download Software Updates Wizard. To complete this wizard, perform the following steps:

1. On the Deployment Package page of the Download Software Updates Wizard, shown in Figure 7, choose either to use an existing deployment package, or to create a new deployment package. If you choose an existing deployment package, any updates that have been previously downloaded will not be downloaded again. If you choose to deploy a new deployment package, you’ll need to provide the following information:

• Name A unique name for the deployment package.
• Package Source A unique shared folder location to host the software update source files. You need to create and specify this folder prior to clicking Next.

FIGURE 7 Deployment Package

2. On the Distribution Point page, choose the Configuration Manager distribution points that will host the software update files.

3. On the Distribution Settings page, shown in Figure 8, configure the following settings:

• Distribution Priority This determines the priority when the package is sent to distribution points at child sites. Priority is only used if there is a backlog of packages being sent to distribution points.
• Distribute the content for this package to preferred distribution points If you enable this option, content is automatically distributed to preferred distribution points.
• Prestaged distribution point settings Use this option to specify whether you want content to be automatically downloaded when a deployment package is assigned to a distribution point, whether to only download changed content to a distribution point, or whether you will manually copy content to a distribution point.

FIGURE 8 Distribution Settings

4. On the Download Location page, shown in Figure 9, choose how Configuration Manager will obtain software update source files. Choose between having Configuration Manager download software updates from the Internet, or from a location on the local network.

FIGURE 9 Download Location

5. Select which language the update files will be downloaded in. Most organizations will only need to download updates for the language version of the software that they use

Deploy software updates

Once software updates have been obtained, you need to deploy them to Configuration Manager clients. The clients that you will deploy the updates to need to be part of a Configuration Manager collection. You can configure maintenance windows on a per-collection basis. Maintenance windows allow you to specify the time of day that operations such as update installation occur.

To deploy a software update group package to a Configuration Manager collection, perform the following steps:

1. In the Software Library workspace of the Configuration Manager console, click Software Update Groups under Software Updates, and then select the software update group that you want to deploy.

2. On the ribbon, click Deploy. This will launch the Deploy Software Updates Wizard.

3. On the General page of the Deploy Software Updates Wizard, shown in Figure 10, provide the following information:

FIGURE 10 Deploy Software Updates

• Name The name of the deployment.
• Collection The collection to which you want to deploy the software update group package.
• Deployment Template These templates allow you to save commonly used properties. Rather than configuring similar settings each time you use the wizard, you can instead save those settings as a deployment template, and select that template when you run the wizard.
• Software Update/Software Update Group This setting will be pre-populated with the details of the software update group you are intending to deploy.

4. On the Deployment Settings page, provide the following information:

• Type of deployment Here you select between Required and Available. When you select Required, software updates install automatically on clients before the configured installation deadline.
• Use Wake-on-LAN to wake clients for required deployments If you have configured, and your clients support Wake-on-LAN, special packets will be sent to client computers that are in a low power state to wake them for update installation. This option is only available for the Required deployment type.
• Detail level This configures the level of detail for state messages reported back to Configuration Manager by clients.

5. On the Scheduling page, configure the following information:

• Schedule Evaluation This setting determines whether the deadline time is calculated using UTC, or the computer’s local time.
• Software Available Time Use this setting to specify whether the updates will become available at a particular time, or that the client will be aware of them when it next polls the Configuration Manager server.
• Installation Deadline Allows you to specify a deadline for update installation. You can also choose for updates to be installed as soon as possible.

6. On the User Experience page, specify the type of notification users will receive about software update download and installation. You also configure what happens when the deadline is reached, and what happens if the computer requires a restart to complete installation.

7. On the Alerts page, specify how Configuration Manager and Operations Manager will generate alerts related to this deployment. This option is only available if the deployment type is set to Required.

8. On the Download Settings page, shown in Figure 11, you configure whether the clients will download the software locally and then install them if connected to a slow network, whether to use BranchCache when obtaining content, and whether to use the Microsoft Update servers to obtain updates if a distribution point is not available.

FIGURE 11 Download settings

9. On the Deployment Package page, shown in Figure 12, select the deployment package that contains the updates you want to deploy.

FIGURE 12 Select deployment package

10. On the Download Location page, select whether updates will be downloaded from the Internet or over the local network. Download only occurs for updates that are not already present in the deployment package.

11. On the Language selection page, ensure that the product language used in your organization is selected.

12. On the Summary page, you get the chance to save this information as a template, so you don’t have to go through the process of configuring all of these deployment settings in the future.