The common Ports used for Software Updates

http://technet.microsoft.com/en-us/library/bb892799.aspx

SCCM 2012 Hierarchy Technology Overview - SCCM 2012 Meetings

A good write up on CM 2012 http://myitforum.com/cs2/blogs/jrobb259/archive/2011/05/26/configuration-manager-2012-cep-webcast-hierarchy-technology-overview.aspx#comments

One other Great tool to fix client actions without Console (Right click tools)

I Just checked the tool and found it would useful for one works on SCCM Client health

It has key features as below

 

• Initiate most common SCCM client schedule actions.
• Initiate SCCM client health checks and fixes. Allows running checks with and without fixes as well as full health check.
• Initiate basic administrative actions on workstations.
• Switch between integrated authentication and alternate credentials. When logged on username has not enough rights it’s possible to specify alternate credentials by clicking on a link in top-right corner. Windows XP requires that cmdkey.exe is available in HTA folder.
• Use TXT, CSV, XLS or XLSX files as the data source. Files with TXT extension must have computer names on each line. Excel worksheets are read from column A starting from second row. Using exported CSV from SCCM console is also supported – script knows that computer names are in first column.
• Populate computer list from SCCM collection. Allows loading all collection members into a list.
• Manually enter computer names into a textbox. Allows manually entering one or more computers in a text box for quick actions.
• Supports both 32-bit and 64-bit OS on clients.
• Supports Windows XP SP2 and newer operating systems on clients.
• Displays real-time progress. Works when running HTA on Windows 7 or Windows Server 2008. Useful when there are thousands of computers and it would be nice to know how much is done. HTA window may not update as smoothly in Windows XP and Windows Server 2003, but it works.
• Log is created in a text area and in a file. Lastlog.log is written to HTA folder. By default the log is using Trace32 log formatting.
• Uses configuration file to store default settings.

Client Tasks that can be performed are classified in to 5 categories:

• 1. Client schedule actions
  • Hardware Inventory Cycle
  • Software Inventory Cycle
  • Discovery Data Collection Cycle (Send DDR)
  • Machine Policy Retrieval & Evaluation Cycle
  • Software Updates Deployment Evaluation Cycle
  • Software Updates Scan Cycle
  • File Collection Cycle
  • Windows Installer Source List Update Cycle
  • Software Metering Usage Report Cycle
  • Branch Distribution Point Maintenance Task
  • Certificate Maintenance Task
• 2. Client agent actions
  • Restart SMS Agent Host service
  • Repair SCCM client
  • Reset SCCM client policies
  • Reassign site code
  • Generate new SMS GUID
  • Delete trusted root key
  • Delete certificates (re-register client)
  • Change client cache size
  • Uninstall SCCM client
  • Install SCCM client
• 3. Client health actions
  • Check WMI; Fix WMI
  • Check services; Check & Fix services
  • Check admin$ share; Check & Fix admin$ share
  • Check assigned site; Check & Fix assigned site
  • Check registry; Check & Fix registry
  • Check inventory; Check & Fix inventory
  • Check client version
  • Full health check
  • Full health check with fixes
• 4. Advertisement actions
  • Query advertisement status
  • Rerun advertisement
  • Rerun user based advertisement
• 5. Other actions
  • Refresh group policies
  • Ping workstations
  • Execute remotely (as SYSTEM)
  • Get logged-on user
  • Log off current user
  • Reboot workstations
  • Shut down workstations
  • Power off workstations

Download it from here :-- http://sccmcat.codeplex.com/

Systems are in “A” collection But not in “B” Collection & Vice versa

ignore other collection

select SMS_R_System.ResourceID,SMS_R_System.ResourceType,
SMS_R_System.Name,SMS_R_System.SMSUniqueIdentifier,
SMS_R_System.ResourceDomainORWorkgroup,SMS_R_System.Client
from SMS_R_System where Client = 1 and ClientType = 1 and
ResourceId not in (select ResourceID from SMS_CM_RES_COLL_XXXxxxxx)

On Windows 2008 R2 with SP1 you may face MP Fatal error 1603 Problem

This could happened because of not supported versions to fix this you need to apply a patch  KB2489044. (I ran into this problem today at a customer place and fix is below)

 

Ms Link http://support.microsoft.com/kb/2489044/en-us

Asset Intelligence Sync Public Certificate Expired

You may see in AIUpdateSvc.log has entries of “WebException trying to enroll: Status = ProtocolError” and  “Exception attempting sync - The request failed with HTTP status 403: Forbidden.”

this could because of your SCCM Public certificate expired. yes by default Microsoft will install a public certificate that will expires on 3 years i.e., 4/25/2011.

 

To resolve this you need to Update the Certificates for Asset Intelligence

• Configuration Manager 2007 Service Pack 2: Install hotfix KB2483225. This hotfix installs the updated public certificate for System Center online authentication and no further action is required. As part of the hotfix installation, the updated certificate is configured for the Asset Intelligence synchronization point and your specific certificate will be automatically renewed.  For more information about this hotfix, see http://support.microsoft.com/kb/2483225/en-us.
• Configuration Manager Service Pack 1: Obtain a certificate file and manually configure the Asset Intelligence synchronization point to use the updated public certificate for System Center online authentication. Use the following steps:
  1. Email ai-cert@microsoft.com to request a certificate file that contains the updated public certificate for System Center online authentication.  Please note that this alias is for certificate distribution only and not for support questions.
  2. Store the certificate file in a location that is accessible to the site server.
  3. In the Configuration Manager console, navigate to System Center Configuration Manager / Site Database (<site code> - <site name>) / Site Settings / Site Systems.
  4. Click the Asset Intelligence Synchronization point site system computer name.
  5. Select the Asset Intelligence synchronization point, and click Properties.
  6. On the General tab of the Asset Intelligence Synchronization Point Properties, specify the path to the new System Center Online authentication certificate (.pfx) file, and click OK.

old version of SCCM Clients Collection

Some times old version could cause of some issues… below is a quick query to find the old version of systems

 

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where ((DATEDIFF(hh, SMS_R_SYSTEM.AgentTime, getdate()) < 23) and AgentName = "SMS_AD_SYSTEM_DISCOVERY_AGENT") and ( SMS_R_System.ClientVersion is null)