Tracking Bitlocker Status using SCCM 2012

Posted on September 18, 2013 by humphric

Following this guide will let you track Bitlocker information on Windows 7 computers using the resource explorer feature of SCCM. It uses compliance settings to do so, however not in the normal way you might use compliance settings.

Contents

Bitlocker Status Monitoring

Overview

We are going to use Desired Configuration Management to run a script on target machines. The script will run on a regular schedule and place Bitlocker data into a new WMI class named SCCM_Bitlocker. Then, we will SCCM extend hardware inventory so that it collects data from this new class.

Compliance Rules Setting

First, we will need to create a configuration baseline, a configuration item and two compliance rules.

Configuration Item

Open the SCCM console on your site server.
Go to Assets and Compliance -> Compliance Settings -> Configuration Items.
Click the “Create Configuration Item” button on the ribbon.
On the ‘General’ screen, enter the name “Bitlocker Information” then click ‘Next’.
On the “Supported Platforms” screen, select the following items then click ‘Next’:
```
Windows Vista
Windows 7
Windows 8
Windows Server 2008
Windows Server 2012
```
On the “Settings” screen, click the button labeled “New”.
On the ‘Create Setting’ screen, enter the following information:
```
Name: Bitlocker WMI Provider
Setting type: Script
Data type: String
```
Still on the ‘Create Setting’ screen, click the ‘Add Script…’ Button.

On the ‘Edit Discovery Script’ screen, change the Script language to ‘VBScript’ then paste the following script into the ‘Script’ field.

'Record-BitlockerToWMI.vbs
'Sherry Kissinger, 2010
'http://social.technet.microsoft.com/Forums/en-US/configmgrgeneral/thread/5c9f9681-e665-4b3f-a83a-b554be65a921
'Extended by Connor Humphries. 2013. tyedyehumps@gmail.com. winventures.wordpress.com.
'Extended by John Puskar. 2013. johnpuskar@gmail.com. windowsmasher.wordpress.com.
'v22

Set WhShell = CreateObject("Wscript.Shell")
'on error resume next
dim gstrObjects(26,12)
dim gtempnum

function getData(WshShell, numVolumes, strings)
        '--------------------------
        'Run the Manage-bde.wsf, and put all the information into oExec to pull out later
        '--------------------------
        Set objFSO = CreateObject("Scripting.FileSystemObject")
        If objFSO.FileExists("c:\windows\system32\manage-bde.wsf") Then
                Set oExec = WshShell.Exec("cscript //Nologo c:\windows\system32\manage-bde.wsf -status")
                drive = ""
                drivename = ""
                i = 0

                While Not oExec.StdOut.AtEndOfStream
                        '-------------------
                        'For each line returned from oExec, check what's in it, and add to an array
                        '-------------------
                        line = oExec.StdOut.Readline()
                        if ucase(left(line,6)) = "VOLUME" then
                                'if drive <> "" then
                                '       targetmif.writeline("   End Group")
                                'end if
                                i = i + 1
                                numVolumes = i
                                drive = mid(line,8,2)
                                line = oExec.StdOut.Readline()
                                drivename = line
                                line = ""
                                                strings(i,0) = drive
                                strings(i,1) = drivename
                                strings(i,12) = Now
                        end if

                        if drive <> "" and trim(line) <> "" then
                                parts = split(line,":")
                                Select Case replace(trim(parts(0))," ","_")
                                        Case "Size"
                                                strings(i,2) = trim(parts(1))
                                        Case "BitLocker_Version"
                                                strings(i,3) = trim(parts(1))
                                        Case "Conversion_Status"
                                                strings(i,4) = trim(parts(1))
                                        Case "Percentage_Encrypted"
                                                strings(i,5) = trim(parts(1))
                                        Case "Encryption_Method"
                                                strings(i,6) = trim(parts(1))
                                        Case "Protection_Status"
                                                strings(i,7) = trim(parts(1))
                                        Case "Lock_Status"
                                                strings(i,8) = trim(parts(1))
                                        Case "Identification_Field"
                                                strings(i,9) = trim(parts(1))
                                        Case "Key_Protectors"
                                                Set WshShellTwo = CreateObject("Wscript.Shell")
                                                Dim TPM, strLine
                                                Dim Flag
                                                Dim oExecTwo
                                                Dim strCommand
                                                keys = ""
                                                strCommand = "cscript //Nologo c:\windows\system32\manage-bde.wsf -protectors -get " & drive

                                                Set oExecTwo = WshShellTwo.Exec(strCommand)
                                                Flag = false
                                                Set TPM = oExecTwo.StdOut
                                                        While Not TPM.AtEndOfStream
                                                                strLine = TPM.ReadLine
                                                                If InStr(strLine, "Protectors") Then
                                                                        Flag = True
                                                                End if
                                                                If Flag Then
                                                                        If strLine = "" or strLine = vbNull Then
                                                                                keys = keys
                                                                        Else
                                                                                If keys = "" or keys = vbNull Then
                                                                                        keys = Replace(strLine,"ERROR: ","",1,-1,1)
                                                                                Else
                                                                                        keys = keys & VBCrLf & Replace(strLine,"ERROR: ","",1,-1,1)
                                                                                End If
                                                                        End If
                                                                End if
                                                        Wend
                                                strings(i,10) = keys
                                        Case "Automatic_Unlock"
                                                strings(i,11) = trim(parts(1))
                                End Select
                        End If
                Wend
        Else
                Dim drive, drivename,size, bitLockerVersion, conversionStatus, percentageEncrypted
                Dim encryptionMethod, protectionStatus, lockStatus, identificationField
                Dim keyProtectors, automaticUnlock

                drive                                   = 0
                drivename                               = 1
                size                                    = 2
                bitLockerVersion                = 3
                conversionStatus                = 4
                percentageEncrypted             = 5
                encryptionMethod                = 6
                protectionStatus                = 7
                lockStatus                              = 8
                identificationField             = 9
                keyProtectors                   = 10
                automaticUnlock                 = 11

                numVolumes = 1
                strings(1,drive)                                = "All Drives"
                strings(1,drivename)                    = ""
                strings(1,size)                                 = ""
                strings(1,bitLockerVersion)     = "BDE Feature not installed"
                strings(1,conversionStatus)     = "Fully Decrypted"
                strings(1,percentageEncrypted)  = "0%"
                strings(1,encryptionMethod)     = "None"
                strings(1,protectionStatus)     = "Protection Off"
                strings(1,lockStatus)                   = "Unlocked"
                strings(1,identificationField)  = "None"
                strings(1,keyProtectors)                = "No key protectors found."
                strings(1,automaticUnlock)              = ""
        End If
End Function

Function CreateBitlockerWmiNamespace
        Dim wbemCimtypeSint16
        Dim wbemCimtypeSint32
        Dim wbemCimtypeReal32
        Dim wbemCimtypeReal64
        Dim wbemCimtypeString
        Dim wbemCimtypeBoolean
        Dim wbemCimtypeObject
        Dim wbemCimtypeSint8
        Dim wbemCimtypeUint8
        Dim wbemCimtypeUint16
        Dim wbemCimtypeUint32
        Dim wbemCimtypeSint64
        Dim wbemCimtypeUint64
        Dim wbemCimtypeDateTime
        Dim wbemCimtypeReference
        Dim wbemCimtypeChar16

        wbemCimtypeSint16 = 2
        wbemCimtypeSint32 = 3
        wbemCimtypeReal32 = 4
        wbemCimtypeReal64 = 5
        wbemCimtypeString = 8
        wbemCimtypeBoolean = 11
        wbemCimtypeObject = 13
        wbemCimtypeSint8 = 16
        wbemCimtypeUint8 = 17
        wbemCimtypeUint16 = 18
        wbemCimtypeUint32 = 19
        wbemCimtypeSint64 = 20
        wbemCimtypeUint64 = 21
        wbemCimtypeDateTime = 101
        wbemCimtypeReference = 102
        wbemCimtypeChar16 = 103

        'Create data class structure
        Set oServices = oLocation.ConnectServer(, "root\cimv2")
        Set oDataObject = oServices.Get
        oDataObject.Path_.Class = "SCCM_BitLocker"
        oDataObject.Properties_.add "Drive", wbemCimtypeString
        oDataObject.Properties_.add "DriveLabel", wbemCimtypeString
        oDataObject.Properties_.add "Size", wbemCimtypeString
        oDataObject.Properties_.add "BitLocker_Version", wbemCimtypeString
        oDataObject.Properties_.add "Conversion_Status", wbemCimtypeString
        oDataObject.Properties_.add "Percentage_Encrypted", wbemCimtypeString
        oDataObject.Properties_.add "Encryption_Method", wbemCimtypeString
        oDataObject.Properties_.add "Protection_Status", wbemCimtypeString
        oDataObject.Properties_.add "Lock_Status", wbemCimtypeString
        oDataObject.Properties_.add "Identification_Field", wbemCimtypeString
        oDataObject.Properties_.add "Automatic_Unlock", wbemCimtypeString
        oDataObject.Properties_.add "Key_Protectors", wbemCimtypeString
        oDataObject.Properties_.add "ScriptLastRan", wbemCimtypeString
        oDataObject.Properties_("Drive").Qualifiers_.add "key", True
        oDataObject.Put_
End Function

Function createWMI(stringarr, numVolumes, run)
        '------------------
        'Create the WMI Namespace
        '------------------
        CreateBitlockerWmiNamespace

        '------------------------------
        'Add Instances to data class
        Set oServices = oLocation.ConnectServer(, "root\cimv2")

        For j = 1 To numVolumes

                Set oNewObject = oServices.Get("SCCM_BitLocker").SpawnInstance_
                        oNewObject.Drive = "C:"
                        oNewObject.Drive = stringarr(j,0)
                        oNewObject.DriveLabel = stringarr(j,1)
                        oNewObject.Size = stringarr(j,2)
                        oNewObject.BitLocker_Version = stringarr(j,3)
                        oNewObject.Conversion_Status = stringarr(j,4)
                        oNewObject.Percentage_Encrypted = stringarr(j,5)
                        oNewObject.Encryption_Method = stringarr(j,6)
                        oNewObject.Protection_Status = stringarr(j,7)
                        oNewObject.Lock_Status = stringarr(j,8)
                        oNewObject.Identification_Field = stringarr(j,9)
                        oNewObject.Key_Protectors = stringarr(j, 10)
                        oNewObject.Automatic_Unlock = stringarr(j,11)
                        oNewObject.ScriptLastRan = stringarr(j,12)
                        oNewObject.Put_
                run = stringarr(j,12)
                'Uncomment the following lines to for troubleshooting interactively
'                WScript.Echo stringarr(j,0) & ", " &_
'                                         stringarr(j,1) & ", " &_
'                                         stringarr(j,2) & ", " &_
'                                         stringarr(j,3) & ", " &_
'                                         stringarr(j,4) & ", " &_
'                                         stringarr(j,5) & ", " &_
'                                         stringarr(j,6) & ", " &_
'                                         stringarr(j,7) & ", " &_
'                                         stringarr(j,8) & ", " &_
'                                         stringarr(j,9) & ", " &_
'                                         stringarr(j,10) & ", " &_
'                                         stringarr(j,11) & ", " &_
'                                         stringarr(j,12)
                Next

End Function

'----------------
' Main Function
'----------------
'Removes Existing SCCM_Bitlocker if exists
On Error Resume Next
Set oLocation = CreateObject("WbemScripting.SWbemLocator")
Set oServices = oLocation.ConnectServer(, "root\cimv2")
set oNewObject = oServices.Get("SCCM_BitLocker")
oNewObject.Delete_
'Again just in case
Set oServices = oLocation.ConnectServer(, "root\cimv2\SMS")
Set oNewObject = oServices.Get("SCCM_BitLocker")
oNewObject.Delete_
On Error Goto 0

dim runtime
getData WhShell, numVolumes, gstrObjects
createWMI gstrObjects, numVolumes, runtime

Still on the ‘Create Setting’ window, click the “Compliance Rules” tab.
On the ‘Compliance Rules’ tab, click ‘New’.

On the ‘Create Rule’ screen, enter the following information then click ‘OK’ to save the setting:

Name: Script Return State
Rule Type: Existential
The setting must comply with the following rule: The specified script does not return any values
Noncompliance severity for reports: Warning

Still on the ‘Create Setting’ window, again click “New” to create another settings.
On the ‘Create Rule’ screen, enter the following information then click ‘OK’ to save the setting:
>Name: WMI Updated
Rule Type: Value
The value returned by the specified script: ‘Begins with’
The following values: WMI
Noncompliance severity for reports: Warning
On the ‘Create Setting’ screen, click ‘OK’ to save the new setting.
On the ‘Create Configuration Item Wizard’ window, on the ‘Settings’ screen, click ‘Next’.
On the ‘Compliance Rules’ screen, click ‘Next’.
On the ‘Summary’ screen, click ‘Next’.
On the ‘Completion’ screen, click ‘Close’.

Configuration Baseline

Open SCCM console on a site server.
Navigate to Assets and Compliance -> Compliance Settings -> Configuration Baselines.
Click the ‘Create Configuration Baseline’ button on the ribbon.
On the ‘Create Configuration Baseline’ screen, enter the following information then click ‘OK’:
```
Name: Bitlocker Information Escrow
Configuration Data: Add -> Bitlocker Informtion
```
Right click the new Baseline and choose ‘Deploy’.
On the ‘Deploy Configuration Baselines’ screen perform the following operations then click ‘OK’ to deploy.
1. Choose a collection
2. Change the schedule to ‘Simple Schedule’
3. Change the field ‘Run Every’ to 1 Days.

Adding the Hardware Inventory Classes

First, we need to add the WMI class SCCM_Bitlocker to the CAS by running the compliance script manually. Then, we can add the class to hardware inventory via the SCCM GUI.

RDP to the CAS server.
Open notepad and save the script detailed in a previous step as C:\Install_Files\bitlocker-wmi-provider.vbs.
Open a command prompt as Administrator and run the following command:
```
cscript C:\Install_Files\bitlocker-wmi-provider.vbs
```
Open a powershell script and run the following command. It should output bitlocker information for the CAS server (probably indicating that bitlocker is diabled). If you get no response back, then there is a problem with the bitlocker-wmi-provider script.:
```
gwmi sccm_bitlocker
```
Open SCCM console on the CAS.
Navigate to Administration -> Client Settings.
Right click on the ‘Default Client Settings’ and select ‘Properties’.
Select ‘Hardware Inventory’ from the left pane.
Click the button labeled ‘Set Classess …’.
On the ‘Hardware Inventory Classes’ window click the button labeled ‘Add’.
On the ‘Add Hardware Inventory Class’ window click the button labeled ‘Connect’.
On the ‘Connect to Windows Management Instrumentation (WMI)’ window, enter the name of your cas server and click ‘connect’.
On the ‘Add Hardware Inventory Class’ window, search for the class named SCCM_Bitlocker and check the box next to the class, then click ‘OK’.
On the ‘Hardware Inventory Classes’ window, make sure that the SCCM_Bitlocker class is selected, then click ‘OK’. The newly added class should be at the top of the list.
A new class should appear named ‘SCCM_Bitlocker’. Check the next to this new class then click ‘OK’.

You can confirm that the data is inventoried by right-clicking a device and choosing ‘Start’ -> ‘Resource Explorer’.

System Center Endpoint Protection Setup Help

Posted on March 4, 2013 by humphric

So we decided to switch from using McAfee Enterprise Agent with VirusScan 8.8 to System Center 2012’s Endpoint protection. The guide System Center 2012 Configuration Manager – Part 6. Adding the Endpoint Protection Role, configure Alerts and custom Anti-malware Policies. provides great and simple instructions for setting up your environment. Items outside of that guide which may prove helpful and discussed here are –

Automatic McAfee unistall failing on XP Machines
Queries to setup various collections for different Anti-malware Policies
Modification of Anti-Malware Settings
Location of logs if ADR’s aren’t working.

Automatic McAfee unistall failing on XP Machines

Sometimes McAfee doesn’t want to uninstall off of XP machines, to fix this an uninstall script is required. A version for VirusScan 8.8 follows. The original can be found here

REM McAfee Removal Script

REM  ECHO Removing AntiSpyware
"C:\Program Files\McAfee\VirusScan Enterprise\scan32.exe" /UninstallMAS
"C:\Program Files (x86)\McAfee\VirusScan Enterprise\scan32.exe" /UninstallMAS

REM Kill McTray & Trusted Validation
ECHO Klling procesess

taskkill.exe /f /t /im mctray.exe
taskkill.exe /f /t /im mfevtps.exe

ECHO Removing VirusScan 8.8

msiexec /x {CE15D1B6-19B6-4D4D-8F43-CF5D2C3356FF} REMOVE=ALL REBOOT=R /q

ECHO Remove McAfee Agent
"C:\Program Files\McAfee\Common Framework\frminst.exe" /forceuninstall /silent
"C:\Program Files (x86)\McAfee\Common Framework\frminst.exe" /forceuninstall /silent
"c:\Program Files\Network Associates\Common Framework\frminst.exe" /forceuninstall /silent

REM Remove McAfee Registry Keys
ECHO Removing Registry Keys

REG DELETE HKLM\SYSTEM\CurrentControlSet\services\McShield /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\services\McTaskManager /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfeapfk /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfeavfk /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfebopk /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfehidk /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mferkdet /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfetdik /f
REG DELETE HKLM\SYSTEM\CurrentControlSet\Services\mfevtp /f
REG DELETE HKLM\SOFTWARE\McAfee /f

Queries for Collection Setup

Looking around it was hard to find any examples of the queries people used in SCCM to setup their collections for Endpoint Protection.

Following are examples for doing this.

Members acquired via Name

Create a new Collection.
Provide a Name “SCCM Servers” and a Limiting collection “All Computers.”
Click OK.
At the Membership Rules stage Click “Add Rule” -> Query.
Then Name it “SCCM Servers” and click Edit Query Statement
Then when the Query Statement Properties window opens go to the Criterion tab and click the star.
Then the Criterion Properties windows opens click Select to choose what to search in.
Under “Attribute Class” Select “System Resource” then under “Attribute” Select “Name”, then click OK.
Under “Operator” select “upper case is like” then for value enter the name like %SCCM-%, click OK
Then click OK through the rest of the collection creation
This should now populate with computers with names containing whatever string you specified

This same process can be used to create a bunch of different types of queries, and a valuable part of this tool is the “Value…” button on the criterion properties window. Clicking on this button provides information that SCCM has already found to base your selection off of.

Criterion Properties and/or Query Language

The following outline a few steps to implement other collection query creations. The first example highlights the quick query collection creation using my already constructed queries. The information needed to do this with any of the other examples is present.

SQL 2008 Servers – Creates a collection of computers with SQL 2008 installed on them

For Fast Creation repeat steps 1-5 from “Members acquired via name”
Then click “Show Query Language”
Then copy and paste the information int the [Source Code] tags to create the filter
click OK through rest of process.

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.ResourceId in (select SMS_R_System.ResourceID from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName like "Microsoft SQL Server%2008%") and SMS_R_System.Obsolete = 0 and SMS_R_System.Client = 1

Hyper-V Machines

Repeat Steps 1-6 of “Members acquired via name”
Then the “Criterion Properties” windows opens click Select to choose what to search in.
Under “Attribute Class” Select “Server Feature” then under “Attribute” Select “Name”, then click OK.
Under “Operator” select “is equal to” then for value enter the name like “Hyper-V”, click OK
Then click OK through the rest of the collection creation

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SERVER_FEATURE on SMS_G_System_SERVER_FEATURE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_SERVER_FEATURE.Name = "Hyper-V"

Active Directory OU -This will populate a collection which will be made up of computers in the stated active directory OU.

Repeat Steps 1-6 of “Members acquired via name”
Then the “Criterion Properties” windows opens click Select to choose what to search in.
Under “Attribute Class” Select “Server Resource” then under “Attribute” Select “System OU Name”, then click OK.
Under “Operator” select “is equal to” then for value enter the name like “CHEMISTRY/DEPARTMENTAL COMPUTERS/OTHER LABS”, click OK
Then click OK through the rest of the collection creation.

>select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.SystemOUName = "THENAMEOFYOURDOMAIN/DEPARTMENTAL COMPUTERS/OTHER LABS"

XP Machines with McAfee Agent Installed

This was actually something I found that worked and just copy and pasted it into the query language. It seems that it checks if McAfee is installed then checks the operating system to determine whether or not it’s an XP machine.

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_OPERATING_SYSTEM on SMS_G_System_OPERATING_SYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_R_System.ResourceId in (select SMS_R_System.ResourceID from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName like "McAfee Agent") and SMS_G_System_OPERATING_SYSTEM.Caption like "Microsoft Windows XP Professional" and SMS_R_System.Obsolete = 0 and SMS_R_System.Client = 1

IIS Servers – This creates a collection based of servers with the IIS server feature installed.

Repeat Steps 1-6 of “Members acquired via name”
Then the “Criterion Properties” windows opens click Select to choose what to search in.
Under “Attribute Class” Select “Server Feature” then under “Attribute” Select “Name”, then click OK.
Under “Operator” select “is equal to” then for value enter the name like “IIS Management Console”, click OK
Then click OK through the rest of the collection creation.

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SERVER_FEATURE on SMS_G_System_SERVER_FEATURE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_SERVER_FEATURE.Name = "IIS Management Console"

SharePoint Server – These are helpful in populating a collection of Sharepoint Servers

File Path
1. Repeat Steps 1-6 of “Members acquired via name”
2. Then the “Criterion Properties” windows opens click Select to choose what to search in.
3. Under “Attribute Class” Select “Process” then under “Attribute” Select “Name”, then click OK.
4. Under “Operator” select “is equal to” then for value enter the name like “WSSADMIN.EXE”, click OK
5. Then click OK through the rest of the collection creation.
6. ```
select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SoftwareFile on SMS_G_System_SoftwareFile.ResourceID = SMS_R_System.ResourceId where SMS_G_System_SoftwareFile.FilePath = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft SharePoint 2010 Products\\"
```
Process
1. Repeat Steps 1-6 of “Members acquired via name”
2. Then the “Criterion Properties” windows opens click Select to choose what to search in.
3. Under “Attribute Class” Select “Process” then under “Attribute” Select “Name”, then click OK.
4. Under “Operator” select “is equal to” then for value enter the name like “WSSADMIN.EXE”, click OK
5. Then click OK through the rest of the collection creation.
6. ```
select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_PROCESS on SMS_G_System_PROCESS.ResourceId = SMS_R_System.ResourceId where SMS_G_System_PROCESS.Name = "WSSADMIN.EXE"
```
Service
1. Repeat Steps 1-6 of “Members acquired via name”
2. Then the “Criterion Properties” windows opens click Select to choose what to search in.
3. Under “Attribute Class” Select “Process” then under “Attribute” Select “Name”, then click OK.
4. Under “Operator” select “is equal to” then for value enter the name like “WSSADMIN.EXE”, click OK
5. Then click OK through the rest of the collection creation.
6. ```
select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SERVICE on SMS_G_System_SERVICE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_SERVICE.Name = "SPAdminV4"
```

File Servers

Repeat Steps 1-6 of “Members acquired via name”
Then the “Criterion Properties” windows opens click Select to choose what to search in.
Under “Attribute Class” Select “Server Feature” then under “Attribute” Select “Name”, then click OK.
Under “Operator” select “is equal to” then for value enter the name like “File Server”, click OK
Then click OK through the rest of the collection creation.

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SERVER_FEATURE on SMS_G_System_SERVER_FEATURE.ResourceId = SMS_R_System.ResourceId where SMS_G_System_SERVER_FEATURE.Name = "File Server"

Modification of Anti-Malware Settings

After creating all of those collections you eventually reach a point where you apply Anti-Malware settings to machines. This can be confusing if you first think you have to create them yourself, luckily SCCM has pre-made settings for certain types of machines. The only problem is these settings are applicable to single function machines but not something running ISS and SQL. So following is how to create the settings for ISS, then how to modify the settings for machines with multiple functions.

Standard Anti-Malware Settings Deployment – Machine running ISS

Open SCCM go to Assets and Compliance -> Endpoint Protection -> Anti-malware Policies.
Right Click “Antimalware Policies” .
Click “Import”.
Select the appropriate Policy i.e. “FEP_Default_ISS.xml”.
Then the “Create Antimalware Policy” window will open.
Name the Policy “Endpoint Protection ISS 6-7”.
Click on “Scheduled Scans”, you may want to enable scans how ever the default is disabled.
Click on “Definition Updates”.
Click on “Set Source” – This is where the client will look for definition updates, most likely in a production network multiple sources should be set so that if one system fails there are backups.
Click OK.
Right Click the newly created policy.
Click “Deploy”
Select your collection of machines runing ISS.
Now the Endpoint client will apply these settings to those systems overriding the default settings. However if other policies are applied to the same collection the policies with the lowest priority will have higher precedence

Customized Anti-Malware Settings Deployment – Machine with ISS and SQL

Follow Previous steps creating a new ISS policy however naming it “Endpoint ISS and SQL”
Right Click the “Antimalware Policies”
Click “Import”
Select “FEP_Default_SQL2008.xml”
Click on “Exclusion Settings”
Clcik on “Set” next to excluded processes
Now we need to copy all of the settings here that are exclusive to SQL and then add them to our already created ISS policy

The special processes are

"%ProgramFiles%\Microsoft SQL Server\MSSQL10.MSSQLSERVER\MSSQL\Binn\SQLServr.exe"
"%ProgramFiles%\Microsoft SQL Server\MSRS10.SSQLSERVER\Reporting Services\ReportServer\Bin\ReportingServicesService.exe"
"%ProgramFiles%\Microsoft SQL Server\MSAS10.SSQLSERVER\OLAP\Bin\MSMDSrv.exe"

Cancel out of the “Create Antimalware Policy” window for SQL
Go to the “Set” excluded processes for the “Endpoint ISS and SQL” and add the processes
Then click OK and now our policy is hybridized

For other policies the contents of “excluded files and folders” must also be copied.

Location of Logs

Some helpful information when dealing with System Center Configuration Manager is the name and location of logs applicable to what you are dealing with. These can be found on your SCCM server C:\Program Files\Microsoft Configuration Manager\Logs. While working on Endpoint the Automatic Deployment Rule log was quite helpful this file is named ruleengine.log.

System Center Configuration Manager (SCCM) 2012 PKI Certificate Setup with XP Machines

Posted on November 1, 2012 by humphric

This post is about setting up SCCM 2012 in HTTPS mode. Mainly though, this is a post on making sure the certificates issued by the Certificate Authority (CA) are issued properly.

To do the bulk of the work for setting up SCCM in HTTPS this blog post by Marius Sandbu SCCM 2012 and PKI is an excellent resource and one that I recommend following. It also includes the setup for the Certificate Authorities something quite helpful in this process.

The Microsoft Technet Documents also provide a great resource Step-by-Step Example Deployment of the PKI Certificates for Configuration Manager: Windows Server 2008 Certification Authority. It’s a great resource that provides steps for where Sandbu leaves off, namely at setting up the certificates for the distribution point.

However what I mainly wanted to focus on was something that didn’t seem to be documented thoroughly; the Group Policy affecting our PC’s to cause them to auto-enroll for certificates from the CA. Our network contains both Windows 7 and Windows XP machines. Something we discovered about Windows XP machines is that they don’t like certificates with SHA256 encryption or higher. Now this isn’t a problem if you want to setup your CA with a lower encryption, but otherwise it’s a problem. XP Machines attempt autoenrolling SHA256 certificates. When an XP machine requests a SHA256 certificate, the CA issues one but the XP machine can’t install it. This causes a loop, and can result in thousands of bad certificates issued per hour.

Microsoft released a hot-fix to fix this problem Windows Server 2003 and Windows XP clients cannot obtain certificates from a Windows Server 2008-based certification authority (CA) if the CA is configured to use SHA2 256 or higher encryption

This allows XP machines to accept the higher encrypted certificates. The next step is making sure that our Group Policy doesn’t cause XP machines without this HotFix to enroll for Certificates. The key is WMI Queries.

Goals of this Project

Create a Group Policy Object (GPO) to apply Auto-Enrollment.
Create WMI Filters.
Apply WMI Filters to GPO.

Create a Group Policy Object (GPO) to apply Auto-Enrollment

Open Group Policy Management.
Right click on the OU you will be applying the GPO to and create a new GPO.
Name it something like “Certificate Auto-Enrollment for Windows 7 & Above
Click on the GPO object and go to the Details tab and Disable it. (This way it doesn’t start doing anything till we’re all done).
The next step is to right click the GPO object and click Edit.
Then a window titles “Group Policy Management Editor” will open and we want to navigate to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Public Key Policies.
Then we want to right click on Certificate Services Client – Auto-Enrollment and click Properties.
Then the Properties window will open and you will want to set the configuration model to Enabled and place a check mark in the first two boxes “Renew…” and “Update…” then click apply.
After this you close this window and the GPO Editor window and your GPO has the right settings.
Now Repeat steps 1-9 instead naming the GPO “Certificate Auto-Enrollment for XPs with HF”.

Create WMI Filters

These WMI filters are used to apply the GPO’s to certain objects so that we don’t see any errors in certificate issuing.

In the Group Policy Management window scroll down to WMI Filters.
Right click on the WMI Filters and click new.
Then the “New WMI Filter” window will open.
Give your filter a name like “Win7 & Up” and a description about what it does
Then click add and paste in ” SELECT * FROM Win32_OperatingSystem WHERE Version like "6.%" ".
Now Repeat steps 1-3.
Then name it “WinXP with HF” and give it a description.
Then click add and paste in “SELECT * FROM Win32_QuickFixEngineering WHERE HotFixID = "KB968730"" (This identifies if the PC has the hotfix installed).

Apply WMI Filters to GPO

In the “Group Policy Management” window go back to our GPOs.
Click on the GPO.
Go to the bottom of the window where it says “WMI Filtering” and apply the appropriate filter.
Go to the “Details” tab and enable the GPO.
Repeat this for the other GPO.

After this PCs should begin Auto-Enrolling for certificates and you shouldn’t have any problems with your XP machines mishandling things.

winventures

Adventures through Windows

Tag Archives: SCCM