MMS Session SS03 Manage Your Environment Using Microsoft Forefront Integration Kit for Network Access Protection through FCS to SCCM Integration

Make sure you stop by Titian 2201B at 10:15 on Thursday to watch me attempt to keep from looking like a deer in the headlights while I present the document I wrote on integrating Forefront Client Security (FCS) and ConfigMgr. I look forward to the opportunity to show off the documentation that I mentioned in an earlier blog post. I have gotten some pretty good feedback on the document and nobody has complained that it set their datacenter on fire (phew!) but MMS is a tough crowd from a technical perspective. I hope to see some of you there!

Automating ConfigMgr Query Creation with Powershell

I'm currently working on implementing a fairly large System Center Configuration Manager (ConfigMgr or SCCM depending on who you ask and the time of day) hierarchy. The hierarchy spans multiple domains on the workstation side of the house and we are targeting and tracking client deployment on a per domain basis.  With 11 domains and 4 queries per domain on 3 site servers I wanted to make my life a little easier so I spent some quality time with the ConfigMgr SDK and the PowerGui Script Editor to hack out a script to do it for me.

The script simply has 2 arrays that it iterates over, one for domains, and the other for the queries to create.  The array for the Domains is a plain vanilla list of strings.  The Array for the Queries is a bit more complex since it required more than a single piece of data per query.  I used an array of hashmaps for this.  There may be a more elegant way to handle this (an array of custom objects perhaps) but my days of perl have made me relatively comfortable with complex nested data structures. 

All of that was simple.  But issues with the Put() method on the WMI class gave me quite a bit of trouble.  Apparently, the put method occasionally fails to function for no apparent reason.  To resolve this I had to trap the exception and re-call the put method.  That worked splendidly.  After figuring out a bit more of the structure of the objects returned I was also able to spit out a nice bit of text if the creation succeeded of error out if it failed. 

One major item to note, the SDK will allow you to create duplicate queries.  So be prepared to delete some stuff if you play around with this script.  And now what you've probably been scrolling past all of this text to find...

$site = 'SMS'
$siteserver = 'SCCMServer01'

[array] $domains = @(
    'DOMA',
    'DOMB',
    'DOMC',
    'DOMD'
)

[array] $queries = @()

$queries += @{
    'Name' = '|DOMAIN| - All Workstations';
    'Expression' = 'select SMS_R_System.Name, SMS_R_System.SMSAssignedSites, SMS_R_System.IPAddresses, SMS_R_System.IPSubnets, SMS_R_System.ADSiteName, SMS_R_System.OperatingSystemNameandVersion, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.LastLogonUserDomain, SMS_R_System.LastLogonUserName, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.NetbiosName from  SMS_R_System where SMS_R_System.Client = 1 and SMS_R_System.ResourceDomainORWorkgroup = "|DOMAIN|" and SMS_R_System.OperatingSystemNameandVersion like "Microsoft Windows NT%Workstation%"';
    'TargetClassName' = 'SMS_R_System';
}
$queries += @{
    'Name' = '|DOMAIN| - All Client Workstations';
    'Expression' = 'select SMS_R_System.Name, SMS_R_System.SMSAssignedSites, SMS_R_System.IPAddresses, SMS_R_System.IPSubnets, SMS_R_System.OperatingSystemNameandVersion, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.LastLogonUserDomain, SMS_R_System.LastLogonUserName, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.NetbiosName from  SMS_R_System where SMS_R_System.OperatingSystemNameandVersion like "Microsoft Windows NT%Workstation%" and SMS_R_System.ResourceDomainORWorkgroup = "|DOMAIN|" and (SMS_R_System.Client = 1 or SMS_R_System.Client is not null )';
    'TargetClassName' = 'SMS_R_System';
}
$queries += @{
    'Name' = '|DOMAIN| - All Non-Client Workstations';
    'Expression' = 'select SMS_R_System.Name, SMS_R_System.SMSAssignedSites, SMS_R_System.IPAddresses, SMS_R_System.IPSubnets, SMS_R_System.OperatingSystemNameandVersion, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.LastLogonUserDomain, SMS_R_System.LastLogonUserName, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.NetbiosName, SMS_R_System.ADSiteName from  SMS_R_System where SMS_R_System.OperatingSystemNameandVersion like "Microsoft Windows NT%Workstation%" and SMS_R_System.ResourceDomainORWorkgroup = "|DOMAIN|" and (SMS_R_System.Client = 0 or SMS_R_System.Client is null )';
    'TargetClassName' = 'SMS_R_System';
}
$queries += @{
    'Name' = '|DOMAIN| - All Computers';
    'Expression' = 'select SMS_R_System.Name, SMS_R_System.SMSAssignedSites, SMS_R_System.IPAddresses, SMS_R_System.IPSubnets, SMS_R_System.OperatingSystemNameandVersion, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.LastLogonUserDomain, SMS_R_System.LastLogonUserName, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.NetbiosName, SMS_R_System.ADSiteName from  SMS_R_System where SMS_R_System.ResourceDomainORWorkgroup = "|DOMAIN|"';
    'TargetClassName' = 'SMS_R_System';
}

function New-SMSquery {
    Param (
        [string] $SiteServer = '.',
        [string] $Site,
        [string] $Name = $(throw "Missing required parameter (Name)"),
        [string] $Expression = $(throw "Missing required parameter (Expression)"),
        [string] $TargetClassName = 'SMS_R_System'
    )
    Process {
        trap [System.Management.Automation.RuntimeException] {
            if ($_.Exception.ErrorRecord.TargetObject -eq 'put') {
                $newquery.put()
                continue
            } else {
                break
            }
        }
        $eap = $ErrorActionPreference
        $ErrorActionPreference = 'stop'
        $QueryClass = [wmiclass]"\\$Siteserver\root\sms\site_$($Site):SMS_Query"
        $newquery = $QueryClass.CreateInstance()
        $newquery.name = [string] $Name
        $newquery.expression = [string] $Expression
        $newquery.targetclassname = [string] $TargetClassName
        $newquery.put()
        $ErrorActionPreference = $eap
        return $newquery
    }
}

foreach ($d in $domains) {
    foreach ($q in $queries) {
        $newq = new-SMSQuery -SiteServer $SiteServer -Site $Site -Name $($q.Name.Replace('|DOMAIN|',$d)) -Expression $($q.Expression.Replace('|DOMAIN|',$d)) -TargetClassName $($q.TargetClassName)
        $newq | gm
        if ($newq[0].IsInstance) {
            Write-Host "Created query: $($newq.Name) ($($newq.QueryID))"
        } else {
            Write-Error "Failed to create query $($q.Name.Replace('|DOMAIN|',$d))"
            exit
        }
    }
}

A sad day for Fantasy gaming

It is a sad day for Fantasy gaming, Online, offline, single player, multi player or tabletop.  The great Gary Gygax has passed away this morning. Gary is responsible for great amounts of joy for many people across the world. He will live on forever in the works he set in motion.

Roll a hand full of dice in his honor.

Not all bots are evil

There appears to have been a malicious compilation of the EnergyMech IRC Bot that is currectly "in the wild".
The SANS ISC has reported this. Unfortunately the diary entry is not entirely clear and can be read that EnergyMech itself is a malicious bot. I have spoken with another handler about it and he will be speaking with the handler that wrote the entry regarding the wording.

News like this makes it even harder for legitimate users of IRC bots and even IRC in general to find hosts that allow these legitimate bots, clients and servers to operate on.

IRC is not evil
It is used by thousands a day for discussions just like Forums and IMs.

IRC bots are not evil
They provide channel control services where the network does not provide it, as well as other services. Some examples are RSS reading, Stock Quotes, Web Services, Weather information, Trivia game and Dictionaries.

IRC is not dead
On one of the neworks I am currently connected to there are 43,757 other users connected. That's more than some towns.

IM is realtime but cannot replace the ability to have a central gathering place for numerous people to discuss a shared interest.
Forums are central gathering places for people to discuss shared interests but are not real time.

I'm officially published in Beta

Some of you may know that I've been working on some documentation for integrating MS System Center Configuration Manager and MS Forefront Client Security so that they could play nice together. Well the document has been delivered to MS and posted as a Beta on Codeplex. Assuming it doesn't turn anybody's network/servers into smoking rubble, it should be posted on the main Microsoft site in the next couple weeks.

The Verdict is In!

Many of you probably already know that my absence from life in general over the last few months has to do with the fact that I was selected for a Jury in a large criminal case in Federal court.  After 8 and a half weeks of testimony and 3 days of deliberation we reached a verdict and were finally released to go back to our normal lives.

For info on the trial and the results see the following article from chron.com: Former El Paso Corp. traders are found guilty.

Initial steps with Scripting System Center Configuration Manager

I've begun delving into the ConfigMgr SDK to start writing some scripts for it.  My primary interest is in working on a set of Resource Kit tools for Desired Configuration Manager.  I've found that everything I've looked so far has been in WMI.  Which is both a blessing and a curse. It certainly makes it easier to access from Powershell's native Get-WMIObject Cmdlet.

Obviously the first thing I needed to be able to do was figure out the right namespace.  Easy!  root/sms looks good.  Wait there's almost no information here... Time poke around some more.  Hey look an object named SMS_ProviderLocation What could that be?  Turns out it lists the sites that it knows about and most importantly it has a flag on which one is the local site and where the namespace for that site is. 

The method to my madness scripting wise is to break down every task in to the smallest reasonable chunks and create scripts or functions out of them.  This is what I have done for getting the sitecode.

get-sitecode.ps1

Param (
    [switch] $Verbose = $True,   
    [string] $ComputerName = '.'
)
Begin {
    if ($Verbose) {
        # Set verbosity
        $VerbosePreference = 2
    }
    $ErrorActionPreference = "Stop"
    # Constructed Variables
    $script:Namespace = $("root\sms")
    Write-Verbose $("Namespace: " + $Script:Namespace)
}
Process {
    #get baselines
    $q = 'select * from SMS_ProviderLocation where ProviderForLocalSite = true'
    $wmi = Get-WmiObject -ComputerName $ComputerName -Namespace $Script:Namespace -Query $q -ErrorAction Stop
    Write-Output $wmi.SiteCode
}

So it's been a while since my last post...

It's been quite some time since my last post. So I figured I should put something out here so Blogger doesn't think I died or something.
I'm right now siting at a bar in the Denver airport waiting for my flight to start boarding.

But that's the end of my story, let me begin at the beginning.
About 2 months ago now I got a phone call on my cell.  Totally out of the blue and unexpected I was being asked if I would be willing to entertain the possibility of leaving my comfortable position at The Bank and move to a small, young company.  The company had the benefits of being small, young, growing like a weed and being pushed as the go to partner for security monitoring by an exceptionally large and prosperous company we all love to hate.

The next day nobody could piss me off.  There's nothing quite like somebody you respect as really knowing their stuff calling because they want you to work for them.  An interview and trip to the office later and I'm pretty well hooked.  We worked out the details of an offer I simply couldn't refuse and I put in my notice.  They encouraged me to put in an extra week as a courtesy to The Bank which I also agreed was for the best.  To top it all off I left that week to head off for a week of vacation.  Promising new job, a little more financial freedom and vacation all at once?  I must have dome something right in a previous life!

Once I finish off the rest of my time at The Bank, which seemed to pass instantly and drag on forever at the same time, I showed up at my new office.  Oh I actually get my own office now?  Start poking around and find that they simply haven't had a systems admin and there's a ton to be done from that perspective as well as the job they hired me for.  Within the week I felt like I was contributing to the Team (very unusual for me to feel that way in my experience).
The hours have been flying by.  This is the busy season so there's been a lot of work to do and not enough hours to do it in.  We rush to complete a project that the Aforementioned (not so) "Evil Empire" hired us to do because they looked to us as the experts.  Then I fly to Redmond, the seat of the Empire.

The Empire's dominion is everything you could think of it to be.  They set me up in the product lab and gave me a run through of the tool they use to build their lab environments.  My jaw drops, the clouds part, the sun shines, angels sing and life becomes so much easier.  Of course it'll be available internally everywhere in the Empire in a year or so and not to see the light of day outside for a few years.  15 minutes of "work" later my lab is building itself with nothing for me to do but watch and listen to the people around me.
It was amazing, the tool and the conversations both. These people were me.  (NOTE:  Had to shut down and actually get on the flight. Frontier has a cool feature, along with doing the Jet Blue thing and offering DirectTV in-flight, they have a channel that shows your current position, speed and altitude. I'm presently at 458 MPH at 36472 feet ASL.)

 

Where was I? Oh yes, listening to the people around me in the lab. They were talking about random stuff related to testing the products the lab was centered around.  Their conversations were very technical and enthusiastic.  They had fun playing with their toys, reveling in the chance to make life better for Tech Geeks everywhere.  I ate lunch and had drinks with various Peon Geeks as well as Product Managers and architects.  All of them truly loved the products they were working on.  They expressed a desire to understand how their products were used in the real world and what the deficiencies were.  It is apparent that the rumors of the Empire taking good care of it's people are true.  Refrigerated cases with Sodas and juices were on every floor, every office had been uniquely marked by the inhabitant, there were pool tables and foosball tables that one would occasionally during lunch or near the end of the day see see Geeks playing at while discussing what they were working on. 

 

There was an obvious desire to "tell all" but alas every company must keep it's secrets about what lays ahead.  What we did learn was both exciting and encouraging.

 

The future looks bright for the Corporate IT Geek.  I feel blessed to have the opportunity to be involved even at the fringes of the groups who are the movers and shakers of this industry.

 

Signing off from 520MPH, 40647 Ft ASL somewhere over Colorado, K5WTF

Windows Home Server Install

So I found a machine laying around last night that met the modest specs required by WHS. After popping a bigger hard drive in it I started the install. It was a relatively painless install with no choices required (both good and bad) . The lack of choices is a small annoyance.

I'd like to be able to name my server whatever I want for instance but you do not get a choice there. The name is chooses incidentally is Server. While accurate it simply doesn't fit with the names of my other machines.

Also of a greater annoyance is the extremely high number of reboots required during the installation process. I didn't count but wish I had at this point. I'm surely hoping this is a Beta artifact.

Once it finished rebooting for the 47millionth time, it started up and I was able to login as administrator with a blank password which it immediately prompted me to change. It did allow me to continue with a blank password which I found out accidentally. As always when this is released as an embedded appliance, default passwords will be the primary security weakness. The first client to connect should force a password change from the client side (appliance units will be totally headless) to make this seamless and simple for the user.

I had some pretty significant difficulties getting the client installed and working on my first machine. However, these were all issues with my network at home. Recent updates of Fedora had broken my DDNS setup on the DNS domain I'm using internal to my home network. This kept the client from being able to resolve the server's name properly. After correcting this issue, the client connected up flawlessly.

Due to the late evening start time and the DNS problems, I didn't have time to delve any further into my new toy. I do however look forward to playing with the backup system in the next few days.

Windows Home Server Beta

You may or may not have seen the recent news that Windows Home Server has gone Beta 2. I applied for and received an invitation to the Beta.

I'm 60% through the 1755.4MB download of the most recent build package with all of the accompanying discs for client software and recovery etc.

Nothing much to say about it yet but I'm quite excited to see how it plays once I get it home and installed.