deployment Archives - Jack Stromberg

Recently, I had to install System Center 2012 Configuration Manager R2. I have had no prior experience using this product up to this point, so I thought I would document my notes and findings while giving the installation a whirl.

Prerequisites

Domain Controller
- DNS Role (could be on a seperate machine)
- DHCP Role (could be on a seperate machine)
Server 2012 R2 instance for SCCM
- Should be joined to the domain
- 200GB HDD
  - 40-50GB for OS
  - 150GB for SCCM
Windows 7 Client for Testing
- Should be joined to the domain

If you wish to use a different Operating System version for your server or client, you can find a list of supported configurations from the following technet article: http://technet.microsoft.com/en-us/library/gg682077.aspx

Here are my tutorials on deploying System Center 2012 R2 Configuration Manager Standalone

Tutorial

Manually create the System Management Container in Active Directory Domain Services
1. From the following technet article: http://technet.microsoft.com/en-us/library/bb632591.aspx
  Configuration Manager does not automatically create the System Management container in Active Directory Domain Services when the schema is extended. The container must be created one time for each domain that includes a Configuration Manager primary site server or secondary site server that publishes site information to Active Directory Domain Services.
  1. Log on to one of your domain controllers
  2. From Server Manager, select Tools -> ADSI Edit
  3. Right click ADSI Edit and select Connect to...
  4. Ensure the Connection Point is set as Default naming Context and click OK
  5. Expand Default naming context <FQDN>, expand <distinguished name>, right-click CN=System, click New, and then click Object
  6. In the Create Object dialog box, select Container, and then click Next
  7. In the Value box, type System Management, and then click Next
  8. Click Finish
Add Permission to the System Management Container
1. From the following technet article: http://technet.microsoft.com/en-us/library/bb633169.aspx
  After you have created the System Management container in Active Directory Domain Services, you must grant the site server's computer account the permissions that are required to publish site information to the container.
  1. On your domain controller navigate to Server Manager -> Tools -> Active Directory Users and Computers
  2. Click View and select Advanced Features
  3. Expand your site, System, System Management and select Properties
  4. On the System Management Properties dialog box select the Security Tab
  5. Click Add.. on the Security Tab
  6. Click the Object Types... button, check Computers, and click OK
  7. Type in the computer's name and click OK
  8. Check Full Control on the Security Permissions for your SCCM machine
  9. Click the Advanced button, select the computer account, and click Edit
  10. Select This object and all descendant objects in the Applies to section and click OK
Create Service Accounts for System Center in Active Directory
1. SCCMDJ
  1. This service account is actually defined as the Task Sequence Editor Domain Joining Account. The account is used in a task sequence to join a newly imaged computer to a domain. This account is required if you add the step Join Domain or Workgroup to a task sequence, and then select Join a domain. This account can also be configured if you add the step Apply Network Settings to a task sequence, but it is not required.
2. SCCMCP
  1. The Client Push Installation Account is used to connect to computers and install the Configuration Manager client software if you deploy clients by using client push installation. If this account is not specified, the site server account is used to try to install the client software. This account will need to be a local administrator on the machine we want to push software to.
3. SCCMNA
  1. The Network Access Account is used by client computers when they cannot use their local computer account to access content on distribution points. For example, this applies to workgroup clients and computers from untrusted domains. This account might also be used during operating system deployment when the computer installing the operating system does not yet have a computer account on the domain.
4. SCCMRA
  1. The Reporting Services Point Account is used by SQL Server Reporting Services to retrieve the data for Configuration Manager reports from the site database. The Windows user account and password that you specify are encrypted and stored in the SQL Server Reporting Services database.
5. NOTE: There are other service accounts that can be created for SCCM other than these as well. You can see a full listing from the following technet article (additional note, descriptions for the service accounts above were copied from this same article): http://technet.microsoft.com/en-us/library/hh427337
Download a copy of Microsoft System Center 2012 R2 Configuration Manager and Endpoint Protection from the Volume Licensing Center or the Technet Evaluation Center
1. This is called System Center 2012 R2 Config Mgr Client Mgmt License in the Volume Licensing Center
2. The evaluation copy can be found here: http://technet.microsoft.com/en-us/evalcenter/dn205297.aspx
3. NOTE: In this tutorial, I will be using the ISO distributed from the volume licensing center
Extend the Active Directory schema for Configuration Manager
1. Mount/extract the System Center 2012 R2 Configuration Manager media to your SCCM machine
2. Navigate to D:\SMSSETUP\BIN\X64 (or where ever your installation media is). Right click on a file called extadsch.exe and right click, Run as Administrator
3. You will notice a black command prompt popup and then dissappear. Once it has dissappeared, open the following text document: c:\ExtADSch.txt
4. Verify the schema has been successfully extended
Install Pre-requisits to System Center Configuration Manager 2012 R2
1. Execute the following powershell command
  1. Add-WindowsFeature Web-Windows-Auth,Web-ISAPI-Ext,Web-Metabase,Web-WMI,BITS,RDC,NET-Framework-Features,Web-Asp-Net,Web-Asp-Net45,NET-HTTP-Activation,NET-Non-HTTP-Activ,Web-Static-Content,Web-Default-Doc,Web-Dir-Browsing,Web-Http-Errors,Web-Http-Redirect,Web-App-Dev,Web-Net-Ext,Web-Net-Ext45,Web-ISAPI-Filter,Web-Health,Web-Http-Logging,Web-Log-Libraries,Web-Request-Monitor,Web-HTTP-Tracing,Web-Security,Web-Filtering,Web-Performance,Web-Stat-Compression,Web-Mgmt-Console,Web-Scripting-Tools,Web-Mgmt-Compat -Restart
2. Execute the following command
  1. C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe -r
  2. NOTE: Apparently there was/is? a bug in the .NET framework which causes an error later on. Although optional, I would run this just be sure the .NET framework works properly with two different versions installed. You can read more about this command here: http://msdn.microsoft.com/en-US/library/k6h9cz8h(v=vs.80).ASPX
3. Install Windows Server Update Services
  1. Execute the following commands (ensure you change the values to where you want the WSUS definitions and SQL server locations reside)
    1. Install-WindowsFeature -Name UpdateServices-Services,UpdateServices-DB -IncludeManagementTools
    2. cd "c:\Program Files\Update Services\Tools"
    3. ./wsusutil.exe postinstall CONTENT_DIR=E:\WSUS sql_instance_name=SQLSERVERNAME
4. Install User State Migration Tool (USMT)
  1. Download a copy of the User State Migration Tool (USMT) from Microsoft's website: http://go.microsoft.com/fwlink/?LinkId=301570
  2. Right click and run adksetup.exe as an administrator (Click Yes if prompted by UAC)
  3. Click Next on the Specify Location screen
  4. Click Next on the Join the Customer Experience Imporovement Program (CEIP) screen
  5. Click Accept on the License Agreenment screen
  6. Check Deployment Tools, Windows Preinstallation Environment (Windows PE), and User State Migration Tool (USMT), and then click Install
  7. Click Close on the Welcome to Windows Assessment and Deployment Kit for Windows 8.1
5. Run Windows Updates to ensure you are fully patched
Install and Configure SQL Server
1. Install SQL Server
  1. This step can vary on how you want to deploy SQL server. In this particular environment, a SQL cluster had already been deployed in the organization, so I will take advantage of that. However, in smaller environments, you can install the SQL Service on the same machine. You can find a compatibility matrix and which versions of SQL Server can be installed: http://technet.microsoft.com/en-us/library/gg682077.aspx#BKMK_SupConfigSQLDBconfig
2. If you have a remote SQL server, make sure you add the SCCM computer account as a local administrator of the SQL server. More information on how to do that can be found in this guide: http://jackstromberg.com/2014/06/sccm-2012-r2-site-server-computer-account-administrative-rights-failed/
Install System Center 2012 Configuration Manager R2
1. Navigate to your installation media and double click on splash.hta to launch the installer
  1. NOTE: If you are doing an offline install (no internet), run the setupdl.exe installer from your installation media (example: D:\SMSSETUP\BIN\X64\setupdl.exe)
2. Click on Install (Click Yes if prompted by UAC)
3. Click Next >
4. Ensure Install a Configuration Manager primary site is checked and click Next >
5. Enter your license key or hit Install the evaluation edition of this product and click Next >
6. Accept the license agreemt for the Microsoft Software License Terms
7. Accept the license agreements for SQL Server 2012 Express, SQL Server 2012 Native Client, and Silverlight, then click Next >
8. Check Download required files and put them on your desktop
  1. This will grab the latest copy of SCCM. If you need to do an offline installation, you can manually run the offline installer from your installation media (in my case: D:\SMSSETUP\BIN\X64\setupdl.exe).
9. Select your language to run System Center server in and then click Next >
10. Select your languages to support on your client devices and click Next >
11. Set a site code (I would use an airport code if you only have one office in each office location), enter your site name, and then change the installation folder to use your second partition. Once done, click Next >
12. Check Install the primary site as a stand-alone site and click Next >
13. Click Yes on the Configuration Manager dialog box that explains you can configure SCCM to be in a heirrachy to scale at a later time
14. Enter in the SQL Server Name (FQDN) to your database server and click Next >
  1. If you installed the SQL Server service on this same machine, it should be the FQDN to your SCCM machine. If you have a SQL Server you would like to point to, enter in the FQDN of that server.
15. Click Next > on the Database Information screen
16. Click Next > on the SMS Provider Settings
17. Check Configure the communication method on each site system role and then click Next > if you do not have PKI setup. If you have a PKI implemented in your environment, you may go ahead and choose All site system roles accept only HTTPS communication from clients.
  1. Click Yes to continue if you selected All site system roles accept only HTTPS communication from clients
18. Ensure Install a management point and Install a distribution point are checked and click Next >
19. Click Next > on the Customer Experience Improvement Program
20. Verify the settings you chose on the Settings Summary and then click Next >
21. Click Begin Install on the Prerequisite Check once you have passed all of the potential issues. In this case, I have a few that are false possitives, so I am going to go ahead with the install.
22. Once done installing, hit Close

Try opening up the System Center 2012 R2 Configuration manager console. If it opens, congrats on your newly deployed System Center! 🙂

Here is a tutorial on deploying VMware vCloud Networking and Security 5.5 (formerlly called vShield). Unlike other VMware products, this product must be installed as an appliance. VMware provides you an OVA file that contains the entire virtual appliance, so minimal configuration is needed. Here is a good overview of the product and how it works: http://vmwarelearning.com/vcloud_net_sec/

Before beginning, here are the following hardware prerequisites. These prerequisites can be found from the official VMware deployment guide: http://www.vmware.com/pdf/vshield_51_quickstart.pdf

Memory
- vShield Manager: 8GB allocated, 3GB reserved
- vShield App: 1GB allocated, 1 GB reserved
- vShield Edge compact: 256 MB, large: 1 GB, x-large: 8 GB
- vShield Data Security: 512 MB
Disk Space
- vShield Manager: 60 GB
- vShield App: 5 GB per vShield App per ESX host
- vShield Edge compact and large: 320 MB, lx-Large: 4.4 GB (with 4 GB swap file)
- vShield Data Security: 6GB per ESX host
vCPU
- vShield Manager: 2
- vShield App: 2
- vShield Edge compact: 1, large and x-Large: 2
- vShield Data Security: 1

Installing VMware vCloud Networking and Security 5.5 Appliance

Download the VMware vCloud Networking and Security 5.5 OVA file from myvmware.com
Login to vCenter
Select File->Deploy OVF Template...
Click Browse...
Select the VMware-vShield-Manager-5.5.x-xxxxxxx.ova file you downloaded and click OK
Select Next >
Select Next >
Select Accept and then click Next >
Enter a name for the VM and click Next >
Select a datastore to place the VM on storage and click Next >
Select how you want to provision the VM and click Next >
Select the destination network and click Next >
Enter in a password for the default admin user and for privileged CLI access and click Next >
Click Finish
Power on the VM
Open up a console the VM
Login to the VM using the username admin and the "user password" you specified in step 13.
Type enable and hit enter (use the "privileged user password" you specified in step 13).
Type setup and hit enter to launch the network configuration wizard
Enter in the static IP Address you wish to assign to the appliance and hit enter
Enter in the Subnet Mask for your network and hit enter
Enter in the Default gateway for your network and hit enter
Enter in your Primary DNS server's IP address and hit enter
Enter in your Secondary DNS server's IP addres and hit enter
Enter in your domain search list (DNS Suffix if you host your own internal DNS) and hit enter
Type y to confirm your changes and hit enter
Press control+alt+insert to send the control+alt+delete command to the VM to restart the guest.
Note: Logging out like the wizard tells you didn't work for me. Had to do the reboot.
Open up your webbrowser and head over to the static IP address you gave your appliance
Enter in the username admin and the password default to login

Configuring VMware vCloud Networking and Security 5.5 for vCenter

Click on the Edit button next to Lookup Service
Check Configure Lookup Service and enter in the information to your vCenter's Lookup Service instance:
Lookup Service Host
Lookup Service Port
SSO Administrator Username (should be admin@System-Domain or [email protected] if you used the default installation options)
SSO Administrator Password.
Click OK once configured.
Click Yes to trust the server's SSL certificate
Click Edit next to vCenter Server
Enter in your vCenter info and click OK
vCenter Server
Administrator Username
Administrator Password
Select Yes to trust the vCenter SSL certificate
Check Install this certificate and do not display any security warnings and then click the Ignore button when prompted
Click the Edit button next to NTP Server
Specify the IP address of the NTP server you wish to sync to and click OK
Click the Change Password link at the top to change the default admin password. Click OK when you are done.

At this point, you can begin to install the vShield App, vShield Endpoint, and vShield Data Security services by selecting one of your hosts and clicking the Install links. However, configuration of these options is outside the scope of this tutorial.

Note: One thing that I did notice that is different from vShield 5.1 is that once vShield Manager 5.5 is synchronized with vCenter, the management plugin will automatically be registered to vCenter and you can access vShield Manager from the vSphere Client.

Jack Stromberg

A site about stuff

Tag Archives: deployment

System Center 2012 Configuration Manager R2 (SCCM 2012 R2) Standalone Deployment

[Tutorial] Deploying VMware vCloud Networking and Security 5.5