This is part one in a three part post regarding SCCM Computer Startup Scripts and SCCM Health.

Part 1- The script itself

Part 2 – The .MOF file additions

Part 3 – The SQL query for reporting

SCCM Startup Script

How to get clients installed.  How to keep them installed.  Those are the topics that a SCCM Computer Startup Script can take care of.

The script that I wrote looks for the existence of SCCM and ensures that the version is correct, the CCMExec.log has a current time stamp and ensures that the proper accounts are in the administrators group.

If the client doesn’t exists on the system the startup script will install it.

If WMI is broken, the script will fix it and install the client.

Finally, the script will also install the SCCM R3 patch.

To use this script you will need to supply your own variables such as Domain Name, SCCM Admin account name, etc.

You will need to create a new folder for this script.  In the folder you will need:

• SMSClient folder from the Config Manager installation directory
• CCMClean.exe
• CCMDELCERT.exe
• PSKILL.exe
• SCCM_Health_Check.vbs

————–

‘ NAME: SCCM_Client_Health_Check
‘ AUTHOR: Matthew Teegarden
‘ DATE  : 1/18/2011
‘ Based on the script by Chris Stauffer http://myitforum.com/cs2/blogs/cstauffer/archive/2009/12/18/sccm-sp2-health-check-startup-script-1-7.aspx
‘ COMMENT: Version 1.1
‘     1.0 – initial script
‘     1.1 – complete re-write.  added WMI check / Fix

Option Explicit
On Error Resume Next

Dim WshShell ‘ Wscript.shell
Dim fso ‘ FileSystemObject
Dim StrScanRun ‘ used for incremental count of the amount of times this script has run
Dim StrSCCMPath ‘ used for the location of SCCM client
Dim CCMSetupFolder ‘ used for the location of the CCMSetup folder
Dim SMSClientVersion ‘ used for storing SCCM Client Version
Dim InstallArgs ‘ used for SCCM Client installation switches
Dim ComSpec ‘ WshShell.ExpandEnvironmentStrings(“%COMSPEC%”)
Dim smsinstall ‘ SCCM Installation command
Dim strAdmAcct ‘ used for storing the AD Group that needs to be in the local administrators group
Dim strDomain ‘ stores the domain of the AD Group that needs to be in the local administrators group
Dim strGroupName ‘ stores the AD Group name that needs to be in the local administrators group
Dim objLocalGroup ‘ stores the Administrators local group
Dim strComputerName ‘ used for storing the computer name
Dim gstrSiteCode ‘ used to determine the site code of the strComptuerName
Dim Results ‘ used to store service state
Dim sFolder ‘ used to store folder path
Dim oFolder ‘ used to store specific folders
Dim oFile ‘ used for specific files
Dim WBEMFolder ‘ used for the wbem repository
Dim startdate ‘ used for SMSProvide log file access time
Dim enddate ‘ used for comparing the current time with last access time of the SMSProvider log file
Dim diffdate ‘ used to store the difference between startdate and enddate
Dim colItems ‘ used in For Each loops
Dim objItem ‘ used in For Each loops
Dim bAlreadyExists ‘ stores TRUE or FALSE values for strAdmAcct in the local Administrators group
Dim CurrentDirectory ‘ stores the location that the script is running from
Dim ScriptFullName ‘ stores the scripts full name.  Used with CurrentDirectory
Dim objWMI ‘ Used for the WMI service
Dim returncode ‘ used to store return codes of functions
Dim servicename ‘ used to pass a service name into functions
Dim Started, Stopped ‘ used for starting and stopping services
Dim StrSCCMInstall ‘ counter for how many times SCCM Client has been installed
Dim AssignedSite ‘ used for SCCM site assignment
Dim AutoAssignedSite ‘ used for auto site assignment
Dim SmsClient ‘ used for the SCCM WMI namespace
Dim strValueName ‘ used for storing registry values during the History Shift function
Dim strLogging ‘ used for turning logging on or off
Dim logfile ‘ used to write to the log file
Dim strKeyPath ‘ used to find the value (if exists) in the registry if the DISABLECACHEOPT and DISABLESITEOPT option was used during install
Dim strEntryName ‘ used to find the value (if exists) in the registry if the DISABLECACHEOPT and DISABLESITEOPT option was used during install
Dim strValue  ‘ ‘ used to find the value (if exists) in the registry if the DISABLECACHEOPT and DISABLESITEOPT option was used during install
Dim WMIisCorrupt ‘ used to determine if WMI is functional

Set WshShell = CreateObject (“WScript.Shell”)
Set fso = CreateObject(“Scripting.FileSystemObject”)

‘===========File System Constants==================================
Const ForReading = 1, ForWriting = 2, ForAppending = 8
Const OverwriteExisting = True
Const HARD_DISK = 3
‘===========Registry Constants=====================================
Const HKEY_LOCAL_MACHINE = &H80000002

InstallArgs = ” SMSSITECODE=AUTO SMSCACHESIZE=4096″‘ only needed if you have not extended AD other wise enter SCCM Client Install aguments
strAdmAcct = “Domain\Username or GroupName”    ‘Specify Desktop SMS Admin account domain/account
strDomain = “DomainName”
strGroupName = “SMS Admin Group Name”
strComputerName = WshShell.ExpandEnvironmentStrings(“%computername%”)
ComSpec = WshShell.ExpandEnvironmentStrings(“%COMSPEC%”)
strLogging = “enabled”

‘ Log file
If strLogging = “enabled” Then
    Set logfile = fso.OpenTextFile(“c:\ConfigMgrClient.Log”,ForWriting,True)
    logfile.Writeline “”
    logfile.Writeline Now
    logfile.Writeline “”
End If   

‘WMI Test
Set objWMI = GetObject(“winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2”)
Set colItems = objWMI.ExecQuery (“Select * from Win32_Service Where Name = ‘WinMgmt'”)
For Each objItem In colItems
    Results = objItem.name
Next
If Results = “” Or IsNull(results) Then
    If strLogging = “enabled” Then
        logfile.Writeline “WMI Is Corrupt”
    End If
    WMIisCorrupt = “True”
    CheckSCCMInstall
    AdvCliInst(ComSpec)
    WScript.Quit
Else
    If strLogging = “enabled” Then
        logfile.Writeline “WMI is good”
    End If
Set Results = nothing
End If

‘ Get Local CCM Path
StrSCCMPath = WshShell.RegRead(“HKLM\SOFTWARE\Microsoft\SMS\Client\Configuration\Client Properties\Local SMS Path”)
If StrSCCMPath = “” Or IsNull (StrSCCMPath) Then
    StrSCCMPath = WshShell.RegRead(“HKLM\SOFTWARE\Wow6432Node\Microsoft\SMS\Client\Configuration\Client Properties\Local SMS Path”)
End If   
If strLogging = “enabled” Then
    logfile.Writeline “Get local CCM Path = ” & StrSCCMPath
End If
If StrSCCMPath = “” Or IsNull (StrSCCMPath) Then
    CheckSCCMInstall
    AdvCliInst(ComSpec)
    WScript.Quit
End If

‘ Check for SCCM Helath Check registry key and create it if it doesn’t exist
StrScanRun = WshShell.RegRead(“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\Scan_Run”)
If StrScanRun = “” Or IsNull (StrScanRun) Then
    StrScanRun = WshShell.RegRead(“HKLM\SOFTWARE\Wow6432Node\SCCM\SCCM_Health_Check\Scan_Run”)
End If   
If StrScanRun = “” Or IsNull (StrScanRun) Then
    WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\Scan_Run”), “0”
End If   

‘ Write current time to the registry
WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\Last_Run”), Now()

‘ Check for CCMEXEC service
Results = ServiceState(“ccmexec”)’Check CCM Status
If strLogging = “enabled” Then
    logfile.Writeline “SMS Agent Host = ” & Results
End If
If LCase(Results) = LCase(“Running”)Then
    WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\CCM_Service_Check”), “Running”
    If strLogging = “enabled” Then
        logfile.Writeline “SMS Agent Host = ” & Results
    End If
‘ CCMExec serivice is running.  Do SCCM Health checks           
    Check_Client_info  ‘Check Client Variable                   
    CheckSitecode      ‘Check Client SiteCode
    ClientVersionCheck ‘Check Client Versiont
ElseIf LCase(Results) = LCase(“Stopped”)Then
    If strLogging = “enabled” Then
        logfile.Writeline “SMS Agent Host = ” & Results
  End If
    set Results = Nothing
    Call EnableService(“ccmexec”)
    KickService(“ccmexec”)
    WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\CCM_Service_Check”), “CCM Service was Stopped”
    ‘ CCMExec serivice is running.  Do SCCM Health checks                               
    Check_Client_info ‘Check Client Variable                   
    CheckSitecode      ‘Check Client SiteCode
    ClientVersionCheck ‘Check Client Version
ElseIf Results = “” Or IsNull (Results) Then
    If strLogging = “enabled” Then
        logfile.Writeline “SMS Agent Host not found”
  End If
    WMIisCorrupt = “True”
    CheckSCCMInstall
    AdvCliInst(ComSpec)
    WScript.Quit
End If

CheckSCCMInstall’Check to see if CCMSetup failed and fix error
Script_increment  ‘Increment Registery Key For script by 1 And move present value To history        
Check_AdminShare ‘ Check Admin$ Share
Check_SMSLOCALADMIN’Check Local Admin account
WS– USEnabled ‘ check to ensure windows update service is enabled

Function CheckSCCMInstall 
    On Error Resume Next
    CurrentDirectory = replace(WScript.ScriptFullName,WScript.ScriptName,””)
    If strLogging = “enabled” Then
        logfile.Writeline  “Starting CheckSCCMInstall”
    End If
    If fso.FolderExists(“C:\Windows\System32\CCMSetup\LastError”) Or fso.FolderExists(“C:\Windows\CCMSetup\LastError”) or WMIisCorrupt = “True” Then
        If strLogging = “enabled” Then
            logfile.Writeline  “LastError folder exists or Can not connect to WMI.  Deinstalling client and reinstalling”
        End If
‘     Set objWMI = GetObject(“winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2”)
‘     Set colItems = objWMI.ExecQuery (“Select * from Win32_Service Where Name = ‘CCMSETUP'”)
‘         For Each objItem In colItems
‘             objItem.StopService()
‘         Next
      WshShell.Run(“Net Stop CCMSetup /Y”), 0, True
        If strLogging = “enabled” Then
            logfile.Writeline  “Stopped CCMSEtup service if existed”
        End If
‘         Set colItems = objWMI.ExecQuery (“Select * from Win32_Process Where Name = ‘CCMSETUP.EXE'”)
‘         For Each objItem In colItems
‘             objItem.Terminate()
‘         Next
        oFile = CurrentDirectory & “PSKILL.EXE”
        fso.CopyFile oFile, “C:\”
        WshShell.Run “c:\pskill ccmsetup”,,True
        If strLogging = “enabled” Then
            logfile.Writeline  “Stopped CCMSEtup process if existed”
        End If
        oFile = CurrentDirectory & “ccmclean.exe”
        fso.CopyFile oFile, “C:\”
        WshShell.Run “c:\CCMClean /all /q”,,True
        If strLogging = “enabled” Then
            logfile.Writeline  “Ran CCMClean 1”
        End If
        WshShell.Run “c:\CCMClean /all /q”,,True
        If strLogging = “enabled” Then
            logfile.Writeline  “Ran CCMClean 2”
        End If
        oFile = CurrentDirectory & “ccmdelcert.exe”
        fso.CopyFile oFile, “C:\”
        WshShell.Run “c:\ccmdelcert.exe”,,True
        If strLogging = “enabled” Then
            logfile.Writeline  “Ran CCMDelCert”
        End If
        fso.DeleteFile “C:\windows\SMSCFG.INI”, True
        If strLogging = “enabled” Then
            logfile.Writeline  “Delete SMSCFG.INI”
        End If
        WshShell.Run(“Net Stop Winmgmt /Y”), 0, True
        If strLogging = “enabled” Then
            logfile.Writeline  “Stopped Winmgmt”
        End If
        fso.DeleteFolder (“C:\Windows\System32\WBEM\Repository”), True
        If strLogging = “enabled” Then
            logfile.Writeline  “Deleted Repository”
        End If
        WshShell.Run(“Net Start Winmgmt”), 0, True
        If strLogging = “enabled” Then
            logfile.Writeline  “Started Winmgmt”
        End If
        WshShell.Run(“C:\Windows\System32\rundll32.exe wbemupgd, UpgradeRepository”), 0, True
        If strLogging = “enabled” Then
            logfile.Writeline  “Ran C:\Windows\System32\rundll32.exe wbemupgd, UpgradeRepository”
        End If
        WshShell.Run(“Net Stop Winmgmt /Y”), 0, True
        If strLogging = “enabled” Then
            logfile.Writeline  “Stopped Winmgmt”
        End If       
        WshShell.Run(“Net Start Winmgmt”), 0, True
        If strLogging = “enabled” Then
            logfile.Writeline  “Started Winmgmt”
        End If
        WshShell.Run(“C:\Windows\System32\rundll32.exe wbemupgd, UpgradeRepository”), 0, True
        If strLogging = “enabled” Then
            logfile.Writeline  “Ran C:\Windows\System32\rundll32.exe wbemupgd, UpgradeRepository”
        End If       
        sFolder = WshShell.ExpandEnvironmentStrings(“%windir%\System32\WBEM”)
        Set oFolder = fso.GetFolder(sFolder)
        For Each oFile In oFolder.Files
            Select Case lCase(fso.GetExtensionName(oFile))
              Case “mof”, “mfl”
               WshShell.Run oFolder & “\mofcomp.exe “”” & oFile & “”””, 0, True
               If strLogging = “enabled” Then
                    logfile.Writeline  “Compiled ” & oFile
                End If
            End Select
        Next
        fso.DeleteFolder (“C:\Windows\System32\CCMSetup”), True
        fso.DeleteFolder (“C:\Windows\CCMSetup”), True
        fso.DeleteFile (“C:\ccmclean.exe”), True
        fso.DeleteFile (“C:\ccmdelcert.exe”), True
        fso.DeleteFile (“C:\PSKILL.exe”), True
    End If
    If strLogging = “enabled” Then
        logfile.Writeline  “Ending CheckSCCMInstall”
    End If
End Function   

Function Check_Client_info
    On Error Resume Next
    If strLogging = “enabled” Then
        logfile.Writeline  “Starting Check_Client_info”
    End If
    Set SmsClient = GetObject(“winmgmts:ROOT/CCM:SMS_Client=@”)
    SMSClientVersion = SmsClient.ClientVersion
    If SMSClientVersion = “” Or IsNull (SMSClientVersion) Then
        SMSClientVersion = WshShell.RegRead(“HKLM\SOFTWARE\Microsoft\SMS\Mobile Client\ProductVersion”)
    End If
    If strLogging = “enabled” Then
        logfile.Writeline  “Ending Check_Client_info”
    End If
End Function   

Function Script_increment
    On Error Resume Next
    If strLogging = “enabled” Then
        logfile.Writeline  “starting Script_increment”
    End If
    StrScanRun = WshShell.RegRead(“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\Scan_Run”)
    If StrScanRun = “” Or IsNull (StrScanRun) Then
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\Scan_Run”), “0”
    Else
        StrScanRun = StrScanRun + 1
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\Scan_Run”), StrScanRun
    End If
    If StrScanRun >= 2 Then
        History_Shift
    End If
    If strLogging = “enabled” Then
        logfile.Writeline  “Ending Script_increment”
    End If
End Function   

Function Check_AdminShare
On Error Resume Next
    If strLogging = “enabled” Then
        logfile.Writeline  “starting Check_AdminShare “
    End If   
    Set objWMI = GetObject(“winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2”)
    Set colItems = objWMI.ExecQuery(“Select * from Win32_Share Where Name = ‘ADMIN$'”)
    If colItems.Count > 0 Then
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\AdminShare_Check”), “Admin$ is present”
        If strLogging = “enabled” Then
            logfile.Writeline “Admin$ is present”
        End If
    Else
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\AdminShare_Check”), “Admin$ Is missing”
        If strLogging = “enabled” Then
            logfile.Writeline “Admin$ is missing”
        End If
        Set colItems = objWMI.execquery(“select state from win32_service where name=’LanmanServer'”)
        For Each objItem In colItems
            objItem.StopService
        Next
        Do Until Stopped = True
            Set colItems = objWMI.execquery(“select state from win32_service where name=’LanmanServer'”)
            For Each objItem In colItems
                If lcase(objItem.State) = lcase(“Stopped”) Then
                    Stopped = True
                End If
            Next
        Loop
        Set colItems = objWMI.execquery(“select state from win32_service where name=’LanmanServer'”)
        For Each objItem In colItems
            objItem.StartService
        Next
    End If   
    If strLogging = “enabled” Then
        logfile.Writeline  “ending Check_AdminShare “
    End If   
End Function

Function Check_SMSLOCALADMIN
    On Error Resume Next
    If strLogging = “enabled” Then
        logfile.Writeline  “starting  Check_SMSLOCALADMIN”
    End If   
    Set objLocalGroup = GetObject(“WinNT://” & strComputerName & “/Administrators, group”)
    For Each objItem In objLocalGroup.Members
    If InStr(UCase(objItem.ADSPath),UCase(strDomain & “/” & strGroupName)) <> 0 Then
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\Account_Check”), strAdmAcct & ” is in the Admins group”
        If strLogging = “enabled” Then
            logfile.Writeline strAdmAcct & ” is in the Admins group”
        End If
        bAlreadyExists = True
    End If
    Next
    If bAlreadyExists <> True Then
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\Account_Check”), strAdmAcct & ” was not in Admins group – adding”
        If strLogging = “enabled” Then
            logfile.Writeline  strAdmAcct & ” was not in Admins group – adding”
        End If
        objLocalGroup.Add(“WinNT://” & strDomain & “/” & strGroupName)
    End If 
    If strLogging = “enabled” Then
        logfile.Writeline  “starting  Check_SMSLOCALADMIN”
    End If   
End Function

Function WS– USEnabled
    On Error Resume Next
    If strLogging = “enabled” Then
        logfile.Writeline  “starting WS– USEnabled”
    End If
    Results = ServiceState(“wuauserv”)’Check Windows Update Status
    If LCase(Results) = LCase(“Running”)Then
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\WindowsUpdate_Service_Check”), “Running”
        If strLogging = “enabled” Then
            logfile.Writeline “Auto Updates Serivice = ” & Results
        End If
    ElseIf LCase(Results) = LCase(“Stopped”)Then
        If strLogging = “enabled” Then
            logfile.Writeline “Auto Updates Serivice = ” & Results
        End If
        Call EnableService(“wuauserv”)
        KickService(“wuauserv”)
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\WindowsUpdate_Service_Check”), “Windows Update Service was Stopped”
    End If
    Set Results = Nothing
    If strLogging = “enabled” Then
        logfile.Writeline  “ending WS– USEnabled”
    End If
End Function    

Function ClientVersionCheck
    On Error Resume Next
    If strLogging = “enabled” Then
        logfile.Writeline  “starting ClientVersionCheck “
    End If
    If SMSClientVersion = “” Then
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\CCM_Client_Check”), “Client Not Installed”
        If strLogging = “enabled” Then
            logfile.Writeline “SMSClientVersion = NO CLIENT”
        End If
        Call AdvCliInst(ComSpec)
        WScript.Quit
    Else
        If strLogging = “enabled” Then
            logfile.Writeline “SMSClientVersion = ” & SMSClientVersion
        End If
        Select Case SMSClientVersion
                ‘ RTM 4.00.5931.0001
                ‘ SP1 4.00.6221.1000
                ‘ SP2 4.00.6487.2000
                ‘ R3  4.00.6487.2157
            Case “4.00.6487.2157” ‘ SCCM SP2 R3 client version
                PolicyEval
            Case “4.00.6487.2000” ‘ SCCM SP2 client version
                If strLogging = “enabled” Then
                    logfile.Writeline “Needs R3 hotfix”
                End If
                CurrentDirectory = replace(WScript.ScriptFullName,WScript.ScriptName,””)
                smsinstall =ComSpec & ” /c msiexec.exe /p “& CurrentDirectory & “SMSClient\i386\hotfix\KB977384\sccm2007ac-sp2-kb977384-x86-enu.msp /L*v %TEMP%\sccm2007ac-sp2-kb977384-x86-enu.msp.LOG /q REINSTALL=ALL REINSTALLMODE=mous”
              WshShell.Run smsinstall,0,False
              If strLogging = “enabled” Then
                    logfile.Writeline “Install R3 hotfix”
                End If
                PolicyEval
        Case Else
            If strLogging = “enabled” Then
                logfile.Writeline  “ClientVersionCheck could not determine client version – installing client”
            End If
      Call AdvCliInst(ComSpec)
      WScript.Quit
    End Select
    End If
    If strLogging = “enabled” Then
        logfile.Writeline  “ending ClientVersionCheck “
    End If
End Function      

Function PolicyEval    
    On Error Resume Next   
    If strLogging = “enabled” Then
        logfile.Writeline  “starting PolicyEval  “
    End If
    Set oFile = fso.GetFile (StrSCCMPath & “Logs\CCMExec.log”)
    startdate = oFile.DateLastAccessed
    enddate = date()
    If isDate(startdate) Then
        diffdate = DateDiff(“d”, startdate, enddate)
        If strLogging = “enabled” Then
            logfile.Writeline “CCMExec.log last accessed = ” & diffdate
        End If
    End If
    If diffdate > 21 Then
        If strLogging = “enabled” Then
            logfile.Writeline “CCMExec.log last accessed more than 21 days ago. Repair client”
        End If
        Call AdvCliInst(ComSpec)
        wscript.quit
    End If
    If strLogging = “enabled” Then
        logfile.Writeline  “ending PolicyEval  “
    End If
End Function       

Function CheckSitecode 
    On Error Resume Next   
    If strLogging = “enabled” Then
        logfile.Writeline  “starting CheckSitecode   “
    End If       
    ‘Ensure that the client is auto assigned to sites and that the client is assigned to the correct site
    ‘based on the naming convention of the machine
    Set SmsClient = CreateObject (“Microsoft.SMS.Client”)
    AssignedSite = SmsClient.GetAssignedSite
    If ((Len(strComputerName) = 13) And (Mid(strComputerName, 7, 1) = “X”)) Then
                gstrSiteCode = Mid(strComputerName, 3, 4)
    end If
    WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\SCCM_AssignedSite”), AssignedSite
    If strLogging = “enabled” Then
        logfile.Writeline “SCCM Assigned Site = ” & AssignedSite
    End If
    Set objWMI = GetObject(“winmgmts:ROOT/CCM:SMS_Client=@”)
    AutoAssignedSite = objWMI.EnableAutoAssignment
    If AutoAssignedSite = True Then
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\SCCM_AutoAssignment”), “TRUE”
        If strLogging = “enabled” Then
            logfile.Writeline “SCCM Auto Assignement = TRUE”
        End If
    Else
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\SCCM_AutoAssignment”), “FALSE”
        If strLogging = “enabled” Then
            logfile.Writeline “SCCM Auto Assignement = FALSE”
        End If
        SmsClient.EnableAutoAssignment 1
    End If
    If gstrSiteCode = “MN00” Then
        If AssignedSite <> “P01” Then
            SmsClient.SetAssignedSite(“P01”)
        End If   
    Else
        If AssignedSite <> “CEN” Then
            SmsClient.SetAssignedSite(“CEN”)
        End If   
    End If
    If strLogging = “enabled” Then
        logfile.Writeline  “ending CheckSitecode   “
    End If   
End Function

Function KickService(servicename)
    On Error Resume Next
    If strLogging = “enabled” Then
        logfile.Writeline  “starting KickService ” & servicename
    End If   
    Results = ServiceState(servicename)
    Set objWMI = getobject(“winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2”)
    If Not LCase(Results) = LCase(“Running”)Then
        Set colItems = objWMI.execquery(“select state from win32_service where name='” & servicename & “‘”)
        For Each objItem In colItems
            ‘ Start Service
            objItem.StartService
        Next
        Do Until Started = True
            Set colItems = objWMI.execquery(“select state from win32_service where name='” & servicename & “‘”)
            For Each objItem In colItems
                If lcase(objItem.State) = lcase(“Running”) Then
                    Started = True
                end If
            Next
        Loop
    End If
    set Results = Nothing
    If strLogging = “enabled” Then
        logfile.Writeline  “ending KickService ” & servicename
    End If   
End Function 

Function EnableService(servicename)
    On Error Resume Next
    If strLogging = “enabled” Then
        logfile.Writeline  “starting EnableService ” & servicename
    End If
    Set objWMI = GetObject(“winmgmts:root\cimv2:Win32_Service.Name='” & servicename & “‘”)
        Results = objWMI.ChangeStartMode(“automatic”)
    If strLogging = “enabled” Then
        logfile.Writeline  “ending EnableService ” & servicename
    End If
End Function

Function ServiceState(servicename)
     On Error Resume Next
     If strLogging = “enabled” Then
        logfile.Writeline  “starting ServiceState ” & servicename
    End If   
     Set objWMI = GetObject(“winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2”)
   Set colItems = objWMI.execquery(“select state from win32_service where name='” & servicename & “‘”)
   For Each objItem In colItems
       Results = objItem.State
   Next
   If strLogging = “enabled” Then
        logfile.Writeline  servicename & ” is ” & Results
     End If   
     ServiceState = Results
    set Results = Nothing
     If strLogging = “enabled” Then
        logfile.Writeline  “ending ServiceState ” & servicename
    End If   
End Function

Sub AdvCliInst(ComSpec)
    On Error Resume Next
    If strLogging = “enabled” Then
        logfile.Writeline  “starting AdvCliInst”
    End If   
    If ComSpec = “” Then
        WScript.Quit
    Else
        CurrentDirectory = replace(WScript.ScriptFullName,WScript.ScriptName,””)
        smsinstall =ComSpec & ” /c “& CurrentDirectory & “SMSClient\CCMSetup.exe” & InstallArgs
        SCCM_Install
      WshShell.Run smsinstall,0,True
      If strLogging = “enabled” Then
            logfile.Writeline  “Starting CCMSetup”
        End If   
        Do While GetObject(“WinMgmts:/root/cimV2”).ExecQuery(“SELECT * FROM Win32_Process WHERE Name=’CCMSetup.exe'”).Count
            WScript.Sleep 1000
        Loop
        If strLogging = “enabled” Then
            logfile.Writeline  “Ending CCMSetup”
        End If   
        If strLogging = “enabled” Then
            logfile.Writeline  “Starting R3 patch”
        End If   
        smsinstall =ComSpec & ” /c msiexec.exe /p “& CurrentDirectory & “SMSClient\i386\hotfix\KB977384\sccm2007ac-sp2-kb977384-x86-enu.msp /L*v %TEMP%\sccm2007ac-sp2-kb977384-x86-enu.msp.LOG /q REINSTALL=ALL REINSTALLMODE=mous”
      WshShell.Run smsinstall,0,True
      If strLogging = “enabled” Then
            logfile.Writeline  “Ending R3 patch”
        End If   
    End If
    If strLogging = “enabled” Then
        logfile.Writeline  “ending AdvCliInst”
    End If   
End Sub

Function SCCM_Install
    On Error Resume Next
    If strLogging = “enabled” Then
        logfile.Writeline  “starting SCCM_Install”
    End If
    StrSCCMInstall = WshShell.RegRead(“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\SCCM_Install”)   
    If StrSCCMInstall = “” Or IsNull (StrSCCMInstall) Then
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\SCCM_Install”), “1”
    Else
        StrSCCMInstall = WshShell.RegRead(“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\SCCM_Install”)
        StrSCCMInstall = StrSCCMInstall + 1
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\SCCM_Install”), StrSCCMInstall
    End If
    If strLogging = “enabled” Then
        logfile.Writeline  “Ending SCCM_Install”
    End If
End Function

Function History_Shift
    On Error Resume Next
    If strLogging = “enabled” Then
        logfile.Writeline  “starting History_Shift”
    End If
    ‘ CCM service History move
    strValueName = WshShell.RegRead(“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\CCM_Service_Check”)
    If strValueName = “” Or IsNull (strValueName) Then
        strValueName = “CCM Service was Stopped”
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\CCM_Service_Check”), strValueName
    Else
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\HS_CCM_Service_Check”), strValueName
    End If   
    Set strValueName = Nothing   
    ‘ Admin$ Check History move   
    strValueName = WshShell.RegRead(“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\AdminShare_Check”)
    If strValueName = “” Or IsNull (strValueName) Then
        strValueName = “Admin$ Is missing”
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\AdminShare_Check”), strValueName
    Else
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\HS_AdminShare_Check”), strValueName
    End If   
    Set strValueName = Nothing
    ‘Account Check History move       
    strValueName = WshShell.RegRead(“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\Account_Check”)
    If strValueName = “” Or IsNull (strValueName) Then
        strValueName = strAdmAcct & ” was not in Admins group”
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\Account_Check”), strValueName
    Else
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\HS_Account_Check”), strValueName
    End If   
    Set strValueName = Nothing
    ‘Windows Update Service History move       
    strValueName = WshShell.RegRead(“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\WindowsUpdate_Service_Check”)
    If strValueName = “” Or IsNull (strValueName) Then
        strValueName = “Windows Update service was not running”
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\WindowsUpdate_Service_Check”), strValueName
    Else
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\HS_WindowsUpdate_Service_Check”), strValueName
    End If   
    Set strValueName = Nothing
    ‘SCCM_AssignedSite History move       
    strValueName = WshShell.RegRead(“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\SCCM_AssignedSite”)
    If strValueName = “” Or IsNull (strValueName) Then
        strValueName = “No Assigned Site”
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\SCCM_AssignedSite”), strValueName
    Else
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\HS_SCCM_AssignedSite”), strValueName
    End If   
    Set strValueName = Nothing
    ‘SCCM_AutoAssignment History move       
    strValueName = WshShell.RegRead(“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\SCCM_AutoAssignment”)
    If strValueName = “” Or IsNull (strValueName) Then
        strValueName = “SCCM Autoassignment failure”
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\SCCM_AutoAssignment”), strValueName
    Else
        WshShell.RegWrite (“HKLM\SOFTWARE\SCCM\SCCM_Health_Check\HS_SCCM_AutoAssignment”), strValueName
    End If   
    Set strValueName = Nothing
    If strLogging = “enabled” Then
        logfile.Writeline  “ending History_Shift”
    End If
End Function

Computer Client Agent Configuration

• By default the BITS portion of the Computer Client agent is set to “Apply to branch distribution points only”.
  • You can select “Not Configured” if all of your BDP’s have fast connections to the site server.
  • If your BDP’s are on slow links a good example setting would be:
    • Throttling window start time – 06:00
    • Throttling window end time – 02:00
    • Maximum Transfer rate during throttling window – 40Kbps
    • Allow BITS transfer outside of throttling window
    • Maximum transfer rate outside of throttling window – 100Kbps

Create New Branch Distribution Point (BDP)

• Ensure that the SCCM Site System account is a member of the local administrators group on the new BDP’s.
• Open the SCCM Console and navigate to Site Database > Site Management > [Site that you want to add the BDP to] > Site Settings > Site Systems
• Right click on Site Systems and select New Server
• Type in the name and FQDN of the new BDP
  • Select Next
• On the System Role Selection page select Distribution Point
  • Select Next
• On the Distribution Point page select Enable as a branch distribution point
  • Select use a specific partition > D:
  • Select next
• Select Next and Finish
• Create a file in the root of the C: drive called No_SMS_on_drive.sms
  • This will prevent the BDP from using the C: drive if the D: drive ever gets filled up.

Populate New Branch Distribution Point (BDP)

• The initial population of the new BDP should involve distributing a very small package. Doing that will create the SMSPKG[drive letter]$ folder on the BDP.
• Select a small package that you have created and add the new BDP’s as new distribution points.
• Wait until the SMSPKG[drive letter]$ directory is created.

Distribute Packages To The New Branch Distribution Point (BDP)

• If your BDP’s are on fast networks and you didn’t configure BITS throttling windows then you can just distribute packages like you would to any Standard Distribution Point
• If your BDP’s are using BITS throttling windows then chances are you will want to copy large packages manually for the initial setup and then utilize them like Standard Distribution Points when updating the packages
  • Right click the package that you want to manually copy and select the Deployment tab
  • Select “Administrator manfully copies this package to branch distribution points
    • You now have two options
      • Put the source on a DVD and send it to the branch office.
        • Have someone copy the source to the SMSPKG[drive letter] share
      • Copy the contents over the network without using BITS
  • Once the source files are on the BDP you can open the PerrDPAgent.log file and run a Branch Distribution Point Maintenance task from the SCCM Client.
  • Once all of the packages that you manually copied over are successful, you can go back into the properties of the package and select “Automatically download content when packages are assigned to branch distribution points”

Perhaps you have two different types of end user machines.  One type, the machines can be rebooted whenever software updates get applied according to the Change Schedule.  The other type, the machines can NOT be rebooted.  However, software updates still need to be installed on them and the business owner would be responsible for the reboot.  The goal is to get the updates to install on both types of machines, but prevent a reboot for the business critical machines. Attached are screen shots and test results of the various methods used when configuring and installing software updates. 

https://emptygarden.info/wp-content/uploads/2010/08/software-updates-test-results1.docx

SCCM Granular Security

SCCM Console Security

Your company has two (or more) different groups that utilize SCCM. To keep these groups separate and to ensure that one group can not affect another groups resources the following is needed.

Initial settings:

• The SCCM Central Site has two local users that are used as templates in SCCM Security. The two local users are disabled.
  • User Name = SCCM-Template-WorkstationGroup
  • User Name = SCCM-Template-ServerGroup
• Two collections have been created and dynamically populated with the appropriate resources.
  • WorkstationGroup
    • Contains only workstations
  • ServerGroup
    • Contains only servers
• Two folders have been created in the Packages node
  • WorkstationGroup – Packages
  • ServerGroup – Packages
• Two folders have been created in the Advertisements node
  • WorkstationGroup – Advertisements
  • ServerGroup – Advertisements
• You granted the appropriate security rights in the SCCM Console for both users.

Unfortunately the above method doesn’t allow for inherited permissions.

Example: ‘User A’ is a member of the ‘SCCM.WorkstationGroup’ group. The ‘SCCM.WorkstationGroup’ group has rights to a Collection named ‘WorkstationGroup’. If ‘User A’ creates a subcollection, the other members of the ‘SCCM.WorkstationGroup’ group will not have rights to that new subcollection, only UserA will.

That is where these scripts come in. Open the attachment for more details.

https://emptygarden.info/wp-content/uploads/2010/08/sccm-granular-security2.docx

I have a blog!!  I can’t believe it.  This is the happiest day of my life.