Remote Desktop Connection - The identify of the the remote computer cannot be verified.

When you try to "remote desktop" to a RDS server without going through the RDCB (Connection Broker), you might get the following if your RDS server does not have a trusted certificate.  By the way, you might have to do a mstsc.exe /admin to initiate a connection..

 

This is because the certificate used by the RDP-Licenser is not a trusted certificate by a CA.  It could be a self-signed certificate.  To check the thumbprint of the cert which is being used for RDP session, follow this:

• Bring up Local Machine Certificate Store.  CertLM.msc (Windows Server 2012) or use MMC and Add the Certificate Snapin.
• Go to "Remote Desktop" store and you should see the certificate there. 
• Mark down the Thumbprint and check if it matches the thumbprint in the WMIC 
• In an elevated command prompt, do a "Wbemtest"
• Connect to Namespace "root\cimv2\terminalservices"
• Click on "Enum Classes", select "Recursive" and click OK
• Scroll down to Win32_TSGeneralSettings and double click it.
• Click on the "Instances" button on the right 
• Scroll down to "SSLCertificateSHA1Hash" and double click on it.
• You will be able to see the Thumbprint of the cert. See if that matches the one that you have marked down just now.

So, to use a trusted certificate by a CA.  You will have to import a cert into the Personal Store and change the thumbprint of WMI instance.

• If you are using an SSL cert from 3rd party CA, make sure you import into the personal store with a private key.  You will see a little pad lock on the icon of the cert.
• Once imported, find out what the thumbprint is for that cert.
• http://blogs.technet.com/b/askperf/archive/2014/05/28/listener-certificate-configurations-in-windows-server-2012-2012-r2.aspx
• Update the WMI with this
• wmic /namespace:\\root\CIMV2\TerminalServices PATH Win32_TSGeneralSetting Set SSLCertificateSHA1Hash="<<your_cert_thumbprint>>"
• If you get an error like this, most likely you cert does not have a private key.
• Check to make sure there is no other ASCII characters which are not suppose to be there.
• You will get an "Update Successful" message if everything goes well.

Hope this help...

Customizing Start Menu Layout and Right Click Context Menu on Start Button - Windows Serve 2012 R2

When you have an RDS farm and you want to control the look and feel of the user's desktop, here are some of the stuff I've found with countless hours of testing and verification.  I wish Microsoft has some guidelines around this area to make admin's life easier.

A lot of stuff can be done via the group policy users configurations.  Remember to enable Loop back policy processing if you are linking the policy to your RDS servers.

Taskbar Context Menu
If you want to disable user's ability to right click on the task bar (context menu) and access some of the settings and configuration.  You need to set the follow the group policy.

User Configuration | Policies | Administrative Templates | Windows Components | Start Menu and Taskbar | Remove access to the context menu for the taskbar  : Set to Enable


Start Menu Context Menu.
Also refer to as Win-X command. When you right click on the start button on the lower left corner, you see a a context menu access to commands and tools.  You won't want your normal users to see all these even though they might not have permission to run it.  Still..  removing it from users ability to see if is better in a sense.

The context menu is located from this location:
c:\users\%username%\appdata\local\microsoft\windows\winx

You will see 3 groups of menu.  You can delete and make modification to these groups to control what users can see.

I would suggest to do this prior to the user's logging on the first time.  On your RDSH servers (Hosts)

• Go to the default user profile in c:\users\default
• Navigate to Appdata\Local\Microsoft\windows\WinX
• Remove Group 3 as it is mostly Admin Tools which you do not want your users to see 
• Remove Task Manager, Run and Search from Group 2
• Leave Group 1 "Desktop" alone

When user logon for the first time, the default context menu will be copied to the user's profile under the 'local' folder as mentioned above.  The end result will be like this:

For existing users, you might want to create a batch file and delete the groups when they logon through startup script:

del /Q c:\users\%username%\appdata\local\microsoft\windows\winx\group3

Reference:  http://vhorizon.co.uk/removing-windows-server-2012-start-context-menu/

If you are using User Profile Disks (UPD) and selected to "Store only the following folders on the user profile disk", even if you selected all of the folders, I find that the "Local" (%appdata%\local) folder only gets created locally from the "default" profile when you logon to the RDSH servers. Hence, the user will get those winx groups as defined in the default profile.

Start Menu (Metro UI)

Great news if you are using Windows Server 2012 R2 RDS.  I have to praise the Microsoft RDS team for making our life so much easier if you want to customize what users see and limit the 

• Login to the RDSH server and customize exactly what you want to see in the Metro Modern UI start screen. 
• Use Powershell to export-startlayout -path \\dc1\layouts\startlayout.xml -as XML
• In the group policy settings User Configuration | Policies | Administrative Templates | Windows Components | Start Menu and Taskbar | Start screen layout, specify "\\dc1\layout\startlayout.xml"
• Users will get the same layout when they start the Modern UI.

However, if you are using user profile disk, ensure that the AppData\Local\Microsoft\Windows folder is added to the UPD.  Reference: http://microsoftplatform.blogspot.ca/2013/09/using-user-profile-disks-upd-in.html.  Otherwise, you will see a blank Modern UI screen even thought they seem like working.  The first time after the group policy is applied, it works.  Subsequent logon will display blank UI.

I tried to get the working after reading Freek's post and it didn't work.  I guess it doesn't apply to Windows Server 2012 R2.

http://microsoftplatform.blogspot.com.au/2012/11/predefining-and-customizing-modern-ui.html

"This feature has been disabled by your administrator" when activating Office 365 ProPlus

When you try to activate Office 365 ProPlus from using Microsoft Word or Excel the first time, you might ran into this error message "This feature has been disabled by your administrator.  Enter a product key instead."

According to this KB article, https://support.microsoft.com/en-us/kb/3039000, this is something to do with the UseOnlineContent and SignInOption registry.

The SignInOption registry is associated with this group policy HKCU | Policies | Administrative Templates | Microsoft Office 2013 | Miscellaneous | Block Signing into Office.

Ensure it is not set to "None allowed", otherwise user will not be able to login with the ID to activiate the license.  Most likely you will have to use the Org ID Only to activate the license.

Deploying Office Web App Servers

Please note that the following is quoted from Microsoft TechNet website.
https://technet.microsoft.com/en-us/library/jj219437.aspx

Office Web Apps Server is an Office server product that provides browser-based file viewing and editing services for Office files. Office Web Apps Server works with products and services that support WOPI, the Web app Open Platform Interface protocol. These products, known as hosts, include SharePoint 2013, Lync Server 2013, and Exchange Server 2013. An Office Web Apps Server farm can provide Office services to multiple on-premises hosts, and you can scale out the farm from one server to multiple servers as your organization’s needs grow. Although Office Web Apps Server requires dedicated servers that run no other server applications, you can install Office Web Apps Server on virtual machine instances instead.

It is easier to deploy and manage Office Web Apps within your organization now that it is a stand-alone product. If you deploy SharePoint 2013, for example, you no longer have to optimize the SharePoint infrastructure to support Office Web Apps, which in earlier versions was tightly integrated with SharePoint Server 2010. You can also apply updates to the Office Web Apps Server farm separately and at a different frequency than you update SharePoint, Exchange, or Lync Server. Having a stand-alone Office Web Apps Server farm also means that users can view or edit Office files that are stored outside SharePoint Server, such as those in shared folders or other websites. This functionality is provided by a feature known as Online Viewers.

The following illustration shows the differences between the previous deployment model for Office Web Apps and the new stand-alone deployment model for Office Web Apps.

The following Microsoft TechNet article describe the process required to deploy Office Web Apps Server Farm.

Deploy Office Web Apps Server

Configure Office Web Apps for SharePoint 2013

iSCSI in WIndows Server 2012, Failover Clustering and High Availability File Server

If you ever wonder what iSCSI is or iSCSI sounds relatively new to you, the Microsoft Storage Team has an excellent article which explains in detail what it is and also step by step instructions on how to get it going.  Here is the Technet article.

Here is what I've done for proof of concept.  In real life production environment, you might want to design this properly such as providing high availability clustered iSCSI target with hot spared storage pool and fault tolerance.  Thomas Maurer has very good articles on how to create a Windows Server 2012 iSCSI Target Server and how to build a iSCSI Target cluster server on Windows Server 2012.

Preparing Storage on iSCSI Target:

1. Prepare a storage server in the domain.  This iSCSI target will be providing iSCSI storage to the hosts.
2. Created a Storage Pool.  Select New Storage Pool from the Task menu, provide it with a name.  Let's call it "StoragePool1" for now.
3. Select the Physical Disks which will be part of the storage pool.  Let say I have here 4 X 126 GB disks. (one to be used for Hot Spare)
4. Under Virtual Disk, select New Virtual Disk.  The wizard will start.  Select the "StoragePool1" which you have created from previous step.
5. Provide a name to the Virtual Disk.  We will call it "VirtualDisk1" for now.
6. Select your Layout.  I guess you can call this the fault tolerance configuration.  If you have 2 disks, you can choose to go with RAID 1 Mirror or if you have 3+ disks, you can go with RAID 5 Parity depending on your needs.
7. Select your Provisioning Type.   Let's go with Fixed to maximize size
8. Click Create to create a virtual disk.
9. The New Volume Wizard will start.  This will help you to create a volume for the Virtual Disk.  Follow the prompt to create a new volume.  (i.e   Drive F:)
10. The final disk storage pool configuration will look something like this.

Installing iSCSI Target Role and iSCSI Virtual Disk

1. Go to Server Manager and Add Roles and Features.  Under File and Storage Services | File and iSCSI Services, select iSCSI Target Server.  You might want to select iSCSI Target Storage (VDS and VSS Hardware Provider) to enable applications on the server that are connected to the iSCSI target to perform volume shadow copies of data on the iSCSI virtual disks.  We will leave it for now in this example.
2. In the File and Storage | iSCSI tab, navigate to the TASKS drop down box and select New iSCSI Virtual Disk.  Select the disk volume which you would like to save your iSCSI virtual disks.  This will be the virtual disk drive volume F: which we have created from previous section.
3. Provide a iSCSI virtual disk name.  We will use "iSCSI-VD1" as an example.
4. Specify the disk size and whether it is a fixed, dynamically expand or differencing.  We will use Dynamically Expanding as an example.
5. Select New iSCSI and provide a iSCSI Target name.  (i.e  Srv3-iSCSITarget1)
6. Add servers which can access this iSCSI virtual disks.  Query the initiator computer by browsing the Active Directory.
7. Once you finish adding the servers, (2 or more for clustering usually), you can optionally enable CHAP protocol for initiator authentication.   We will skip this for now and move on to complete the creation of the iSCSI Virtual Disk.

iSCSI Initiator connections

We are going to use server name Srv1 and Srv2 in this example, assuming that they will be in a cluster.  

1. On Srv1, go to the Tools menu in the Server Manager and start the iSCSI Initiator.
2. In the Discovery tab, click Discover Portal.
3. In the IP address or DNS name box, key in the name of the iSCSI Target Server.  The Target server which we have created previously.
4. In the Target tab, click Refresh.
5. In the Target list, select the iqn address of the iSCSI target server and click Connect.
6. Acknowledge the default and finish the connection.  It should show Connected in the status. OK to exit.
7. Repeat 1 - 6 on the secondary server Srv2.
8. On Srv1, go to Disk Management,  you should see the unknown disk appear in the list.  Right click and bring the disks Online and also Initialize the disk with the default value.
9. On Srv2, go to Disk Management and bring the same disk online as well. (You might need to refresh the configuration when asked.)

Installing Failover Clustering Software and validate the cluster

1. On Srv1, go to Server Manager and add the Failover Clustering feature and accept the defaults.  
2. Do the same on Srv2 and add the Failover Clustering feature.
3. On Srv 1, start the Failover Cluster Manager, in the action pane, select Validate Configuration.
4. Add Srv1 and Srv2 into the wizard and Run all tests (recommended).
5. Confirm the results and ensure there are no errors before proceeding.  Some warnings ae expected.
6. Uncheck the Create the cluster now using the validated nodes and click Finish.

Creating Failover Cluster

Note:  Ensure that you have a small iSCSI virtual disk (e.g.  100 MB) created from the iSCSI target for use as a Quorum Disk Witness.  Also having a secondary network connections between the 2 servers is recommended.

1. On Srv1, in the center pane, click Create Cluster.
2. Add Srv1 and Srv2 in selection.
3. Provide a Cluster Name.  We will use FileCluster1 for now.
4. Uncheck Add all eligible storage to the cluster and Next.
5. View Report to confirm everything is fine.  (note:  you might get a warning for not specifying a quorum disk.  We will configure this later).  Click Finish.
6. Navigate to Disk branch, right click and Add Disk.
7. Select the disks you want to add to the cluster and OK.
8. Ensure that the disks you have selected are showing up in the window and change the name if needed.

Creating a High Availability File Server

1. On Srv1 Server Manager, Navigate to Add and Remote Roles, File and Storage Services | File and iSCSI services and add the File Server role to the server.
2. On the Cluster Manager console, right-click on Roles and select Configure Role
3. Select File Server and File Server for general use.
4. Type in a name that the client will use when access this cluster role.  (e.g.  FileSrv) and IP address in the Address box.
5. Select the disks which you want to assign to this cluster role.  (e.g.  Data and the Quorum disks)
6. Confirm the configuration and complete the setup.
7. In the Node section, confirm that the cluster is up and running in the Status column.

Adding shared folder to the clustered File Server

1. Navigate to Roles, right click on the cluster and Add File Share.
2. Select an appropriate file share profile.  SMB Share - Quick should suit most cases.
3. Specify the volume of the share location.  In this case, the Data disk volume.
4. Specify the Share Name, the local path and the remote path to share will appear.
5. Enable other settings which you see fit.  Accept the default and customize the permission if needed.
6. Confirm and create the share.

Configure the failover and failback settings

1. Navigate to Roles, right click on the FileSrv Name and go to into Properties.
2. Specify the Preferred Owners and the Failover Settings.  For example, allowing both to be the preferred owners and Allow failback between 4 - 5 hours etc.  Adjust these settings as needed.

Configuring Cluster Quorum Settings

1. Navigate to the Cluster, in the Action pane, navigate to More Actions and select Configure Cluster Quorum Settings.
2. Select Advanced quorum configuration.
3. On the Select Voting Configuration, review the settings and note that you can select nodes that will or will not have votes in the cluster.
4. Select Quorum Witness and Configure a disk witness.
5. Select the Quorum disk. (e.g. 100MB disk)
6. Accept the default and finish configuring the cluster quorum settings.

Find more information on Quorum Configuration here.

Simple GUI way to transfer FSMO Roles

For documentation purposes only: There are other ways to achieve this using powershell or ntdsutil command, let just say we use the GUI method and simple command prompt for now.

1. Check the current FSMO roles owner. From a command prompt, "netdom query fsmo"
2. For Domain Name Operation Master, bring up the Active Directory Domains and Trust, right click and connect to the DC which you want it to hold the role.  right click again and select Operations Master, click on "Change" and follow the prompt.
3. For RID, PDC and Infrastructure Master, bring up the Active Directory Users and Computers,  right click and connect to the DC which you want it to hold the role.  right click on the domain and select "Operation Masters".  It should bring up a menu with 3 tabs.  Go through the tabs and change the Operation Master by following the prompt.
4. For Schema Master, you first need to register the schema mmc snap-in.  In a command prompt, issue " regsvr32 schmmgmt.dll"  (if you have not already done so)
5. Bring up mmc.exe and add the Active Directory Schema snap-in.  Right click on Active Directory Schema and Change Active Directory Domain Controller to the DC you want it to own the Schema Master role.
6. Right click again and select Operation Master, follow the prompt to change the owner of the Schema role.  (Note:  You need to be a member of the Schema Admins group to do this)

OK. I might as well list the ntdsutil way:

1. Bring up a command prompt and ntdsutil.exe
2. In ntdsutil:  type "popups off" to disable popups confirmation box.  Assuming that you know exactly what you are doing.
3. Type "roles"
4. In fsmo maintenance:  type "connection"
5. In server connections: type "connect to server DC2"  (whatever your other DC is)
6. type "quit" or "q"
7. In fsmo maintenance:  type "transfer infrastructure", "transfer naming master", "transfer PDC", "transfer RID master" or "transfer schema master"
8. Follow the prompt to transfer the roles.

Honestly, I actually prefer the ntdsutil way, straight forward and you don't have to navigate here and there. 

Activating Windows by phone.. Talking to a machine.

I know this is not something new or challenging, I just want to document this here so that I can refer to this every time I build a server for a client where internet access is not an option, I don't have to "How do I activate Windows without internet access again?" and then start googling on my phone..

To activate Windows through phone:

1. Bring up an elevated command prompt.
2. type in "slmgr -ipk <XXXXX-XXXXX-XXXXX-XXXXX-XXXXX>  <= replace X  with the 25 characters product key associated with your license agreement.
3. Once you get a confirmation that your product key is accepted, type in the following
4. SLUI 4
5. Select the country where you currently located and call the 1-866 numbers...
6. You will be speaking to an automated answering male driod (lol) which will guide you through the activation process.

Done!

VAppRegHandler.dll failed to register. HRESULT -2147024703.

I was troubleshooting a SCCM 2007 client installation problem at a client's place.  SCCM client was not able to install and the only error message I can find in the ccmsetup.log is : "MSI: Module C:\_ESD\CCM\VAppRegHandler.dll failed to register.  HRESULT -2147024703.  Contact your support personnel."  Installation failed with error code 1603.

I was like.. great.  1603 = Fatal error.  I've tried everything including rebuilding the WMI on the client, removing the client and re-installing it without any success.  Did a lot of research on VAppRegHandler.dll and followed a whole bunch of suggestions and at the end.. no success.

I practically stop for one week trying to troubleshooting this issue and came back with a refresh mind.  I looked at it from another angle and see if there is any visible errors in the event logs.  They could or could not be related.

I saw a lot of Event ID 7036 in system log.  "The Windows Modules Installer service terminated unexpectedly.  It has done this X time(s).  The following corrective action will be taken in 1200000 milliseconds.  Restart the service"

From application log, there were error Event ID 1000, 1005 :-

"Faulting application name: TrustedInstaller.exe, version: 6.1.7601.17514, time stamp: 0x4ce7989b

Faulting module name: wcp.dll, version: 6.1.7601.17514, time stamp: 0x4ce7c9f2

Exception code: 0xc0000096

Fault offset: 0x000000000015ea52

Faulting process id: 0x8710

Faulting application start time: 0x01cf4104f21f38e6

Faulting application path: C:\Windows\servicing\TrustedInstaller.exe

Faulting module path: C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\wcp.dll

Report Id: 95b5a08c-acf9-11e3-8d95-18a90556c1fc

As far as I can remember, I did the following..  

• Ensure that the client is ready for software updates.  I download the "Software Update Readiness Tool" and ran it on the client.
• Check the C:\Windows\Logs\CBS\CheckSUR.log
• Found 2 errors complaining about the wcp.dll corrupted.  
• Hmm... Isn't that related to the errors in the eventlog?
• I replace the wcp.dll with the good copy from another system of the same kind..   
• The wcp.dll was located in C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7601.17514_none_678566b7ddea04a5\wcp.dll as mentioned in the event log.
• You need to change the owner and permission on the file/folder in order to replace the file in the folder.
• Replaced the wcp.dll, reboot the system

I kick off an installation of the SCCM client via client push.. and woah la!!!  SCCM client installed successfully on the system.

Hmm...   so much of a VAppRegHandler.dll error...

Internet-Based Client Managment - ConfigMgr 2012 (Part 1)

I am re-visiting internet-based client management in ConfigMgr 2012, ran into a few issues and I wish I could have documented these in the past so that I don't have to waste time resolving the same issues... DOH!  Anyway...

Here is my SCCM 2012 hierarchy:

- Single Primary Site (Internet and intranet in the same forest)
- 1 Internet facing site system.  (MP, DP and SUP)

I am not going to go into following Microsoft best practices for setting up SCCM 2012 internet base client management, you can view TechNet for this.  The stuff which I am going to include here are to have CofigMgr 2012 client working in the intranet and internet scenarios, switching between MPs (Internet and Intranet MPs), installing application, software updates from intranet and internet and able to browse Application Catalog Web Services (some limitation applies) etc.

References:
- Planning for Internet-Base client management
- PKI Certificate Requirement
- PKI Step by Step

May I suggest that before going into managing internet clients, make sure that your intranet is working properly first.  Ensure that you have the client installation properties set correctly and all the site components are working properly especially all the certificates requirement for MP, DP, IIS, clients etc.

The objective here is to have the ConfigMgr clients switch back and forth between the intranet and internet client depending on the where they are and the ability to download and install applications even if they are not on the corporate network (intranet)

Pay Attention:

• Ensure that you have a valid internet address and a working internet DNS record. 
• Ensure that the client push installation properties are set to include CCMHOSTNAME and SMSSITECODE. CCMHOSTNAME=<FQDN of the internet site system>
• Install all the pre-requisites of the MP and the DP role and install the MP and the DP role on the internet facing site system. (including certificates).
• http://technet.microsoft.com/en-us/library/gg682077.aspx#BKMK_SiteSystemRolePrereqs 
• Ensure that the MP and DP are installed and working correctly.

Internet Management Point and Distribution Point, Software Update Point etc.

• In the Site System properties, specify the internet FQDN.  Ensure that the DNS name matches what you have specify in the ConfigMgr Web Server certificate DNS name.
• In the Management Point properties, specify "HTTPS" and "Allow Internet -only connections"
• In the Distribution Point properties, specify "HTTPS" and "Allow Internet-only connections", Import the DP Certificate and specify the password.
• Note that every time you add/remove roles from a site system, the DP changed back to self signed certificate.  Could be a bug.

Application Catalog website point properties:

• Select HTTPS and "Allow internet only connections"
• Specify a different Organization name to distinguish between the internet and the intranet.  (for ease of visibility)

Log Files:

• Check the clientlocation.log and locationservice.log file to see if the client changes to internet only clients when you are off the intranet network (vice versa)
• When installing application from the internet, check the CAS.log to ensure that the contents can be downloaded.

Troubleshooting tips:

• Ensure that the client is able to resolve the internet facing MP's site server name.
• Ensure that port 443 is open and the IIS certificate is in place for SSL.
• Ensure that the internet facing MP is able to talk to the database server  

Unable to logon to domain workstation after inter-forest migration with "The security database on the server does not have a computer account for this workstation trust relationship"

I was involved in a inter-forest Active Directory migration recently using the ADMT 3.2 and PES 3.1 tools and came across a wierd issue which really puzzled me for a few days.

Everything was setup correctly, the trust, the migration account, the permission, the DNS, the firewall is off.  Looking at the migration agent log file, it said it was successful.  Everything seems to be working except when I tried to logon to the workstation in the new forest root domain after the workstation migration using ADMT 3.2.  I got the message "The Security database on the server does not have a computer account for this workstation trust relationship"  I was like... "What the ..."

After some investigation, I realized that the Service Principal Name (SPN) was not set correctly after the migration.  You can look at the workstation SPNs in "Advance View" of the Active Directory Users and Computers.  Looking at the "servicePrincipalName" attribute, the property was empty.   That's wierd.  To temporarily resolve this issue, you can insert the following entries in the SPN and you will be able to logon to domain on the workstation  (Reference:  http://virtualcurtis.wordpress.com/2011/03/02/fix-the-security-database-on-the-server-does-not-have-a-computer-account-for-this-workstation-trust-relationship/)

HOST/ComputerNetBIOSName
HOST/ComputerFQDN

However, that's not what we want..  we need to find out the root cause of this problem.  After some thorough investigation, I think I found the culprit.  Well, I at least when I corrected this problem, the problem went away.

In the source domain, one of the GPOs has the "Primary Domain Suffix" defined in Computer Configuration\Administrative Templates\Network\Dns Client.  It was pointing to the source domain.  Luckily this blog points me to the right direction.  During the migration, the agent was not able to update the workstations or their A records in the DNS and therefore the SPN property was empty and not allowing logon to the domain.  I removed the GPO entry and everything started to work perfectly.

SCCM 2012 & Application Virtualization 5.0

Application Virtualization (App-V) has came a long way in my opinion.  I look into App-V 5.0 the other day and  ran into so much problem trying to sequence an application for SCCM 2012 and App-V client.  Completely my fault...  I didn't do much reading on it and was trying to use the Q drive like I used to do in App-V 4.6 sp1.  Big mistake! With App-V 5.0, the Q: drive is gone...   So, what has changed since 4.6 sp1, this is a good read.

Even the installation of App-V client is so simple and the fact that you can use group policy to control the settings makes App-V 5.0 so user friendly now.

Complete App-V 5.0 document resources HERE

This guide provide a step by step instruction for sequencing applications with App-V 5.0 for SCCM 2012.
Windows-Noob:  How can I sequence applications using App-V version 5 for Configuration Manager 2012 Sp1.


The following articles can be used as a reference for sequencing application with App-V 5.0
How to sequence a new application with App-V 5.0
What I do:  App-V 5 and the "Primary Virtual application Directory"

The following shows you how to install App-V 5.0 client with SCCM 2012
http://social.technet.microsoft.com/Forums/en-US/configmanagergeneral/thread/b136865c-8aa0-4a96-9fb4-476fb9081a98/

Issues with SCCM 2012 Reporting Service Point on SQL 2012

I ran into some issues with getting the Reporting Service Point in SCCM 2012 to work with SQL 2012. According to this post, SCCM 2012 Reporting Service Point is indeed supported on SQL 2012 SP1.  This is exactly what I had...

Why in the world it is not working for me?  I am not getting a Reporting Services Server Instances on the drop down box...  It was empty.

After some research, I came to realize that the issue was due to the configuration of SSRS which was not properly done.  Most likely the virtual directory was not created etc.

Following this article or this article actually resolve the problem.  Phew!!!!

System Center Configuration Manager 2012 in Secure Mode (PKI)

There are a lot of articles available on the internet which provide a step by step guide in providing certificates to your SCCM 2012 infrastructure to run in secure mode (HTTPS)

Here are some of the articles which I find useful. Kudos to the authors.

James Bannan IT - Certificate Requirement for SCCM 2012  (Gotchas with SQL)
Step by Step Guide from TechNet
Another Step by Step Guide Here
Sandbu Blogg

There are very straight forward and they work!!!

MDT 2010/2012 CustomSettings.ini - Control Application Installs

Controlling Application Installs in customsettings.ini can be very useful.  I come across multiple posts and this is one of them.

http://social.technet.microsoft.com/Forums/en-US/mdt/thread/564b6afd-bc1f-4cf9-8706-1f8f13319ee1/

Essentially, the following will execute the [ByType] section which has 2 SubSections.  %IsLaptop% is determined by the ZTIGather script. So, if found to be laptop,  the variable %IsLaptop% would be "True" and it goes to the [Laptop-True] section.

In the [Laptop-True] section, it has another SubSection called %make%.  Again, this variable is deteremined by ZTIGather script.  You can use the %model% if you need to.

[Settings]
Priority=ByType,Default
Properties=MyCustomProperty

[ByType]
SubSection=Laptop-%IsLaptop%
SubSection=Desktop-%IsDesktop%

[Desktop-True]
MachineObjectOU=OU=Workstations,OU=Non-Thins,OU=Computers,OU=_Corp,DC= ***** ,DC=com

[Laptop-True]
MachineObjectOU=OU=Laptops,OU=Non-Thins,OU=Computers,OU=_Corp,DC= ***** ,DC=com
SubSection=%make%

[Hewlett-Packard]
MandatoryApplications001={cdf5444c-abce-4de2-8375-fc5b9c8ff523}
MandatoryApplications002={82747e6b-da40-4cd0-9d91-41b2b39f3a17}

[Default]
DeployRoot=*****

OSInstall=YES

SkipBDDWelcome=YES
SkipComputerName=No
SkipComputerBackup=YES
SkipAppsOnUpgrade=YES
SkipCapture=NO
SkipAdminPassword=YES
SkipProductKey=YES

SkipDomainMembership=YES
JoinDomain=*****
DomainAdmin=*****
DomainAdminDomain=*****
DomainAdminPassword=*****

SkipLocaleSelection=YES
KeyboardLocale=en-US
UserLocale=en-US
UILanguage=en-US

SkipUserData=Yes
SkipBitLocker=YES

XResolution=1366

SkipTimeZone=Yes
TimeZone=020
TimeZoneName=Central Standard Time

Windows Sever 2012 roles and features migration guide

Microsoft has published documents and tools on the TechNet to guide us through the migration of roles and features to Windows Server 2012.

http://technet.microsoft.com/en-us/library/jj134039.aspx