Tuesday, June 30, 2020

Change/Update SCCM-MEM Certificates

Change/Update SCCM-MEM Certificates

Purpose:

To help others take what I have done and use for their own environment with modifications or to improve upon what I have done for others to use in the future.  Use at own risk.

Problem:

We were moving to a new PKI environment with new CA and SubCAs.  We needed to update our certificates on our SCCM/MEM infrastructure servers.  This included client authentication, distribution point, management point, and software update point certificates.  Our environment had 80+ DPs, 2 MPs, and 1 Primary Site Server.

Solution:

WinRM was already enabled.  We pushed the new Root CA and SubCA to the infrastructure servers using GPO then created a few scripts to automate the needed tasks to update the certificates.  This included the certificate request, export, IIS binding, and importing the certificate into the console for DPs.  This took our change/update tasks from multiple hours to change over to ~45 min and almost all of which was just script runtime and just monitoring the console output.

Scripts:

Script 1 – Enable CredSSP on infrastructure servers

Script 2 – Certificate request, export, and bind IIS certificate

Script 3 – Import DP certificate into the console.

Modifications:

All areas that need to be modified are in “< >” symbols

Script 2

1.      Production - Line 6, 9, 15, 21, 33

2.      Testing - Line 97-103

3.      Error/Resume - Line 116

Script 3

1.      Production - Line 45, 50

Wednesday, February 5, 2020

Modern Driver Management - Task Sequence

Modern Driver Management – Task Sequence

Problem

I wanted to update my drivers only once and have it update all my task sequences that use drivers.  Usually each of my task sequences for operating system deployments or operating system upgrades had their own driver sets in the sequences.

Solution

I created was a new task sequence that would hold all the drivers for all our known hardware models.  This TS would be called from our deployment or upgrade task sequences.  This sequence will utilize a TS variable to identify if the hardware model is known or not and Download Package Content tasks. You will need a separate Driver Package or Package with the driver files for each hardware model.  You will also need an “empty” Driver Package or Package so the OS Deployment and OS Upgrade sequences can work correctly.  In your empty package you will need to place something in it as it will not want to replicate unless it has something in it.  Either a small text file if you made a package or a small driver if it is a Driver Package.  Keep reading to see how this works. 

Inspiration

The below link seemed like it made this a lot harder to implement.  I did not try it so I cannot speak to the difficulty, but it was a lot of info. https://deploymentresearch.com/configmgr-driver-management-in-just-four-steps-by-matthew-teegarden/

Process

Create the new driver task sequence

1.      Create two task sequence variable tasks called OSDKnownModels

a.      The first TS variable should have a value of NO

b.      The second TS variable should have a value of YES and Options tab should have WMI queries

2.      The Known PC Model Upgrades group should have a condition of TS Variable OSDKnownModels = YES

3.      Each Driver model needs to be setup as a Download Package Content task along with a wmi condition for the driver model under the Known PC Model Group.  It also needs to have the following options selected

a.      Place into the following location: Task sequence working directory

b.      Check – Save path as a variable: Driver Pack

4.      Unknown PC Models group needs to have a TS Variable condition of OSDKnownModels = NO

5.      Place your Unknown Model driver package or package in the Unknown PC Models group.  This package does not need to have any conditions.  It also needs to have the following options selected

a.      Place into the following location: Task sequence working directory

b.      Check – Save path as a variable: Driver Pack

Operating System Upgrade Task Sequence

1.      Your OS Upgrade Task needs to have two tasks to work successfully.

2.      Create a new Run Task Sequence task and browse to your Model Drivers Task Sequence

3.      Create a new Upgrade Operating System task

a.      Select your Upgrade Package and Edition

b.      Check – Provide the following driver content to Windows Setup during upgrade

                                                    i.     Select Staged content: type %DriverPack01%

1.      DriverPack is the variable from the driver TS but 01 is because the driver was the 1st package in the Download Package Content task.

Operating System Deployment Task Sequence

1.      After the Apply Operating System Task and while still in Windows PE add a new task

2.      Create a Run Task Sequence task and browse to the Drivers Task Sequence you created above

3.      Create a Run Command Line task to inject the drivers into the Windows Install

a.      Command line should be: DISM.exe /Image:%OSDISK%\ /Add-Driver /Driver:%DriverPack01%\ /Recurse

b.      %OSDISK% is the variable we use in our Format tasks as well as Apply Operating System tasks

c.      %DriverPack01% is the variable that is created from the Driver Task Sequence

Conclusion

Please ask if there are any questions.  I will try to answer as time permits.