Tag Archive for: #SCCM

Posts

In the SCCM Lab…

…With a pen and a pad, trying to get this deployment off
My first lab was Johan’s hydration kit. It’s incredibly powerful, customizable, and educational. Unfortunately it takes a little more time and know-how than a novice like myself was initially prepared for.However, at MMS Steve Jesok pointed out that Microsoft provides an all-in-one solution: the Windows and Office Deployment Lab Kit. Within minutes, we can have a fully functional domain controller and SCCM server.

The Requirements

  1. Set up a host device – For this lab, I’m using a Windows 10 Pro workstation with an old i7 CPU, 16GB of RAM, and a secondary 500GB hard drive.
  2. Enable Hyper-V – If Hyper-V is not yet installed, open Turn Windows features on or off, check Hyper-V, and click OK. Reboot.enable_hyper-v.PNG
  3. Configure networking – Launch Hyper-V as administrator, and open the Virtual Switch Manager. Under Virtual Switches, select New virtual network switch. Select External and click Create Virtual Switch. Name it Lab and and leave everything else default. Click OK, and if you are prompted with a warning, click OK again.configure_virtual_switch.PNG

The Setup

  1. Download the kit from the link above. It has the virtual machines and step-by-step documentation on how to configure services. This is the only thing we need to download.labdownload.PNG
  2. Extract the lab zip file, preferably to a drive that is large and fast.
  3. Install – Right click Setup.exe and run as administrator. If prompted by SmartScreen, click More Info and then click Run anyway.run_setup_exe.PNG
  4. Setup Wizard – Click Next all the way through to the end. It will import all the VMs into Hyper-V.
  5. Configure VM Settings – You should see HYD-DC1 and HYD-GW1 already running. Shut them down. We won’t be using HYD-GW1 again.
  6. Domain Controller – Right click HYD-DC1 and select Settings. Set Maximum Memory to 2048MB and leave Enable Dynamic Memory checked. Set CPU to one virtual processor.
  7. SCCM Server – Right click HYD-CM1 and select Settings. Leave memory settings at default. Set CPU to two virtual processors.hyd-cm1_settings.PNG

NAT Networking

Note: We will NOT be using the external virtual switch called Lab from Step 3 of the Requirements section. It was only necessary so that Setup.exe from the Setup section would run.
  1. NAT Networking – We’ll use Ami Casto’s NAT network script instead of the Internet Gateway (HYD-GW1) to make the lab simpler. You can learn more about NAT networking here.
  2. Prepare the Virtual Switch – The Deployment Lab Kit creates it’s own private network switch, so we need to make it an Internal one to work with Ami’s script. In Hyper-V click Virtual Switch Manager. Click on HYD-CorpNet. Select Internal network and click OK.internal_network.PNG
  3. Customize the script – On the host system, launch Windows Powershell ISE as Administrator. Copy and paste the following code into the top script pane. This is an edited version of Ami’s code customized for our Microsoft lab. Hit F5 to run it.
    New-NetIPAddress –IPAddress 10.0.0.254 -PrefixLength 24 -InterfaceAlias "vEthernet (HYD-CorpNet)" 
New-NetNat –Name HYD-CorpNetNATNetwork –InternalIPInterfaceAddressPrefix 10.0.0.0/24
  4. We now have our host Windows 10 OS performing NAT on the internal virtual switch HYD-CorpNet. Our VMs are already pointing to it as the default gateway.

The Test

  1. Power on HYD-DC1 and wait for the log on screen. This is so our servers and workstations can talk to Active Directory.
  2. Power on HYD-CM1 and log in. The passwords for the local administrator accounts and for CORPLabAdmin is P@ssw0rd
  3. Confirm the SCCM server has internet access by launching command prompt and pinging 8.8.8.8.
  4. Give HYD-CM1 another moment for services to start up. Launch the System Center Configuration Manager Console and confirm that it loads successfully.sccm_console.png

The Finishing Touch

Now that we’ve got a functioning domain, SCCM server, and internet access, it’s time to update.
  1. In the SCCM console, navigate to the Administration node and select Updates and Servicing. Click on Check for updates.check_for_updates.png
  2. If the latest version hasn’t already started downloading, select it (in this case 1902), right click and choose Download.
  3. Once it is downloading, on the bottom pane click on the Show Status link.
  4. On the Updates and Servicing Status page for our chosen update, right click update package and choose Show Status again.
  5. From here, we can follow the download AND installation statuses of the latest SCCM upgrade.updates_and_servicing.PNG
  6. Once the download is complete, go back to the Administration node and click on Updates and Servicing again. The update we downloaded should now say Ready to install.
  7. Right click the update and select Install Update Pack. Check Ignore any prerequisite check warnings… and click Next until we reach the License Terms. Check the box, and keep clicking Next until the wizard completes successfully. Click Close.ignore_prereq_warnings.PNGinstall_update_pack.PNG
  8. Repeat steps 3 and 4 and watch the update installation progress. Refresh until the Update Wizard is complete and click Close.install_status.PNG
  9. Close the SCCM console and relaunch it. We will be prompted to upgrade the console to the new version. Click OK, and if prompted for elevation click OK again.update_console.PNG

Congratulations! We now have a functional SCCM environment we can configure and customize.

/0 Comments/by

SCCM Reboot DECODED:: How to make a PC Cancel, Start, Extend or Change mandatory reboot to non-mandatory on the fly.

, , , , , , , , ,

How to make a PC Cancel, Start, Extend or Change mandatory reboot to non-mandatory on the fly.

In the past to stop a PC from rebooting when you didn’t want it to people would stop the ccmexec service and do a shutdown /a

But here is the problem with that..

  1.  Shutdown /a will normally tell you that no shutdown is pending.
  2.  Any number of things can restart ccmexec.

First, how to check if a reboot is pending VS a reboot is GOING to happen

On a win10 PC or has powershell 5 installed, use this

#Detect pending reboot:
Invoke-CimMethod -Namespace root/ccm/ClientSDK -ClassName CCM_ClientUtilities -MethodName DetermineIfRebootPending

On a win7 or old powershell 2 you need to use these.

#
([wmiclass]'ROOTccmClientSDK:CCM_ClientUtilities').DetermineIfRebootPending().RebootPending
([wmiclass]'ROOTccmClientSDK:CCM_ClientUtilities').DetermineIfRebootPending().IsHardRebootPending
([wmiclass]'ROOTccmClientSDK:CCM_ClientUtilities').DetermineIfRebootPending().RebootDeadline
([wmiclass]'ROOTccmClientSDK:CCM_ClientUtilities').DetermineIfRebootPending().NotifyUI

It will spit out something like this..

#PC with no pending reboot.

DisableHideTime     : 12/31/1969 2:00:00 PM
InGracePeriod       : False
IsHardRebootPending : False
NotifyUI            : False
RebootDeadline      : 12/31/1969 2:00:00 PM
RebootPending       : False
ReturnValue         : 0
PSComputerName      :

#PC with pending NON-mandatory reboot.

DisableHideTime : 12/31/1969 12:00:00 PM
InGracePeriod : False
IsHardRebootPending : False
NotifyUI : True
RebootDeadline : 12/31/1969 12:00:00 PM
RebootPending : True
ReturnValue : 0
PSComputerName :

#PC with pending mandatory reboot, notice the time stamp.

DisableHideTime : 5/1/2019 3:28:56 PM
InGracePeriod : True
IsHardRebootPending : False
NotifyUI : True
RebootDeadline : 5/1/2019 11:28:56 PM
RebootPending : True
ReturnValue : 0
PSComputerName :

 

Now for the magic…..

Everything that SCCM uses for knowing when and if it should reboot comes from here.

HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData

On a PC with no reboot pending, this key is empty.

So starting with that, this is how we can CANCEL a pending reboot.

#CANCEL a pending reboot
Remove-Item -path 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData';
Remove-Item -path 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Updates Management\Handler\UpdatesRebootStatus\*';
Remove-ItemProperty -name * -path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired';

#on PS2.0, "Remove-ItemProperty" doesn't work, so use this.
#Remove-Item -path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired';

shutdown -a 
Restart-Service ccmexec -force

But what if you just want to cancel the mandatory reboot and change it to a non-mandatory reboot so the user will still get the popup telling them they “need to” reboot?

#change mandatory reboot to  non-mandatory reboot
Set-Itemproperty -path 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -name 'RebootBy' -value 0;
Restart-Service ccmexec -force

What if we just want to extend the time of a mandatory reboot?

Example: In your client settings you have your reboot countdown set to 10 hours…. A user calls and says it’s going to reboot in 10 min and needs it extended… This will reset that users countdown timer back to 10 hours.

#Reset SCCM reboot countdown timer.
$time = [DateTimeOffset]::Now.ToUnixTimeSeconds()
Set-Itemproperty -path 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -name 'RebootBy' -value $time;
Restart-Service ccmexec -force

What if you want to kick off the built in SCCM reboot WITH the client settings countdown timer?
NOTE: Setting $Time to 0 will popup the non-mandatory reboot window.

$time = [DateTimeOffset]::Now.ToUnixTimeSeconds()
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -Name 'RebootBy' -Value $time -PropertyType QWord -Force -ea SilentlyContinue;
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -Name 'RebootValueInUTC' -Value 1 -PropertyType DWord -Force -ea SilentlyContinue;
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -Name 'NotifyUI' -Value 1 -PropertyType DWord -Force -ea SilentlyContinue;
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -Name 'HardReboot' -Value 0 -PropertyType DWord -Force -ea SilentlyContinue;
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -Name 'OverrideRebootWindowTime' -Value 0 -PropertyType QWord -Force -ea SilentlyContinue;
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -Name 'OverrideRebootWindow' -Value 0 -PropertyType DWord -Force -ea SilentlyContinue;
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -Name 'PreferredRebootWindowTypes' -Value @("4") -PropertyType MultiString -Force -ea SilentlyContinue;
New-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\SMS\Mobile Client\Reboot Management\RebootData' -Name 'GraceSeconds' -Value 0 -PropertyType DWord -Force -ea SilentlyContinue;

 

NOTE:: In all my tests after you run The powerShell command it takes about 30 seconds for the client to respond since after you restart the service it has to do all it’s internal checks to figure out what’s new.

#WeaponizedAutismFTW

/0 Comments/by