Microsoft ForeFront Endpoint Protection 2010

Prerequisites
http://technet.microsoft.com/en-ca/library/ff823830.aspx

You might get an error about Setup cannot verify the service principal name (SPN) for this account
- Elevate a command prompt and execute the following command.
setspn -A MSSQLSvc/<SQL Server Name>:1433 <domain>\<user>    <--SQL Service Account

Download Microsoft Forefront Endpoint Protection (FEP) 2010 Update Rolloup 1 Tools:
http://www.microsoft.com/download/en/details.aspx?id=26613

How to use the Definition Update Automation Tool for Forefront Endpoint Protection 2010 Update Rollup 1.
http://blogs.technet.com/b/clientsecurity/archive/2011/11/03/how-to-use-the-definition-update-automation-tool-for-forefront-endpoint-protection-2010-update-rollup-1.aspx

I personally like the "Status Filtering Rules Method" as it monitors the statemsg and as soon as the Wsus Sync Manager finished synchornising with Microsoft, it will kick off the batch file to update your deployment package and assignment.. 

Setting up System Center Configuration Manager 2007 ... Revisit...

I have setup a few SCCM sites now and didn't really get a chance to document the steps required to complete a successful setup and also things that require attention.  Most of them have already been documented in TechNet and other sites but for the record, I am going to post some links here.

Preparing Windows Server 2008 R2
- It is important to make sure that you have a good build of the OS and that you have all the updates installed.
- IIS is required on SCCM site system.  Make sure you add the Web server IIS role.
- For Windows Server 2008 R2, additional configuration required.  http://technet.microsoft.com/en-us/library/cc431377.aspx

SCCM 2007 Prerequisites
- Prerequisites information on TechNet http://technet.microsoft.com/en-us/library/bb694113.aspx
- Extending the schema.  (Recommended) and create the System Container and apply the right permission.  http://technet.microsoft.com/en-us/library/bb633121.aspx
- Create a sccm server active directory group and grant sufficient access to the system management container.
- Install the features and modify the WebDAV settings as per article.
- At times, you will encounter weird issues with WebDAV as detail in this article.  Correct the problem as specify. http://www.ithastobecool.com/2009/06/24/sccm-2007-r2-on-server-2008-weird-webdav-errors-on-mp-installation/
- Install WSUS  (3.0 SP2)


SCCM2007 Central Site Installation
- Run the setup and prerequisites checker.
- Prerequisites checks rule descriptions can be found here.  http://technet.microsoft.com/en-us/library/bb680951.aspx
- Check if the site information is being published to the Active Directory Domain Services if the schema is extended.  http://technet.microsoft.com/en-us/library/bb693614.aspx
- Create a sccm_servers active directory group and grant sufficient access to the system management container.


How to verify successful site installation.
http://technet.microsoft.com/en-us/library/bb693526.aspx


Installing SCCM 2007 R3.
- Install hotfix KB977384 as it is required before R3 can be installed.

Deploying to multiple sites.
http://technet.microsoft.com/en-us/library/bb693675.aspx

How to install a secondary site.
http://technet.microsoft.com/en-us/library/bb632837.aspx

- For Windows Server 2008 and 2008 R2. http://technet.microsoft.com/en-us/library/cc431377.aspx
- Including WebDAV, enabling and configuring WebDAV
- Set RequestFiltering Rules
- Ensure that the secondary site server has sufficient access to the the System Management container in the schema.

Prerequsites for Software Distribution.http://technet.microsoft.com/en-us/library/bb680335.aspx


Branch Distribution Point
http://technet.microsoft.com/en-us/library/bb680335.aspx



About site to site connection group for multiple hierarchy setup.
http://technet.microsoft.com/en-us/library/bb632850.aspx

Troubleshooting Client Push issues.
http://support.microsoft.com/kb/925282

SCCM : "the self signed certificate can not be created sucessfully"

Came across this problem the other day.  When I tried to create a Task Sequence Media, I get this message "the self signed certificate can not be created successfully".  Hmm... make no sense at all.  Looking at the log file (CreateTsMedia.log) which is located at C:\Program Files\Microsoft Configuration Manager Console\AdminUI\AdminUILog.  There is this error about "Cannot acquire crypt context".  You wonder what that means...

After doing more research on Internet, the error was caused by a PXE certificate which was created previously and not removed automatically when PXE point was reinstalled.  The certificate needs to be remove manually..  The folder is location is at:   C:\Users\<UserID>\AppData\Roaming\Microsoft\Crypto\RSA.
Once I removed the folder under RSA, things go smoothly again...  

Mounting WIM with ImageX

It's been a while since I need to do one of this.  I think I better document this here for my reference.  This is no rocket science.

To mount a WIM file so that you can deploy some custom settings such as additional folders and stuff as part of the OS installation.  This is what you do:

1.  Install Microsoft Windows AIK.
2.  Run a command prompt with elevated privillege in Windows 7
3.  Create a directory c:\mounted_images
4.  Change directory to c:\Program files\Windows AIK\Tools\x86
5.  Imagex.exe /mount Z:\Windows7_Source\Sources\install.wim 1 c:\mounted_images

Once mounted, you should be able to make modification.

6.  Imagex.exe /unmount /commit c:\mounted_images

http://technet.microsoft.com/en-us/library/cc766067(WS.10).aspx

Software not getting installed from SCCM. execmgr.log showing spRebootRequest->JobStart failed 0x80004005

I ran into a situation a couple of times where softwares are not getting installed on the systems via SCCM deployment.  Upon checking the execmgr.log file,  I am seeing the job failed start with error messages spRebootRequest->JobStart failed 0x80004005.

As detailed in http://support.microsoft.com/kb/970635, under very rare condition, the job counter is not decremented when the job is finished.  The coordinating system prevents the system from being restarted because it thinks that the job is still running based on the job counter value.

The way to get it going again. 

1.  Check the registry key (HKEY_LOCAL_MACHINE\Software\Microsoft\Sms\Mobile Client\Reboot Management\JobCounter) and make sure that the value is not greater than 0

2. Restart the system manually.