In Part 1, SCCM Prerequisites have been downloaded and the AD schema has been extended.

In Part 2, the dedicated SQL Server (with SSRS) has been installed and configured.

Server: M-SCCM1 

Article Parts:

• Part 1: SCCM 2012 R2 Environment Preparation / Requirements
• Part 2: SCCM 2012 R2 SQL Server Installation-Configuration
• Part 3: SCCM 2012 R2 Primary Site Installation

SCCM Primary Site Server – Installation

Components required

Storage Requirement

Service Accounts

• Create accounts and groups

• Add your account to the SCCMAdmins group
• Add SCCMAdmins group to Local Administrators of M-SCCM1 server

Account: svc-confmgrlocaladm

This account is needed if you deploy SCCM client by using the client push installation method.

The Client Push Installation Account is used to connect to computers and install the Configuration Manager client software. This account must be a member of the local Administrators group on the computers where the Configuration Manager client software is to be installed. This account does not require Domain Admin rights. You can specify one or more Client Push Installation Accounts, which Configuration Manager tries in turn until one succeeds.

Account: svc-sccmnaa

This account (Network access account)is needed during OS deployment in WinPE to access content on the network which is referenced by the task sequence. This account might also be used during operating system deployment when the computer installing the operating system does not yet have a computer account on the domain.

I will configure it later.

Account: svc-sccmjd

This account will be used for join computer to domain during a deployment. To do that, this account required AD permission:

On the “Join to Domain” task, you can specify the OU where you want to add the computer. So you have to Delegate Control on each OU that you want to use.

Right-click on the OU and select “Delegate Control…”

Add the account:

Select “Create a custom task to delegate”:

Select these options:

Select these permissions:

For more information about SCCM accounts, see TechNet article “Technical Reference for Accounts Used in Configuration Manager“: https://technet.microsoft.com/en-us/library/hh427337.aspx

Prerequisites

Windows Features

From PowerShell:

Add-WindowsFeature Web-Windows-Auth,Web-ISAPI-Ext,Web-Metabase,Web-WMI,RDC,NET-Framework-Features,Web-Asp-Net,Web-Asp-Net45,
NET-HTTP-Activation,NET-Non-HTTP-Activ,Web-Static-Content,Web-Default-Doc,Web-Dir-Browsing,Web-Http-Errors,
Web-Http-Redirect,Web-App-Dev,Web-Net-Ext,Web-Net-Ext45,Web-ISAPI-Filter,Web-Health,Web-Http-Logging,Web-Log-Libraries,
Web-Request-Monitor,Web-HTTP-Tracing,Web-Security,Web-Filtering,Web-Performance,Web-Stat-Compression,Web-Mgmt-Console,
Web-Scripting-Tools,Web-Mgmt-Compat
-Restart –Source V:\sources\sxs

Register ASP.NET with IIS.  Open an elevated command prompt and enter:

C:\Windows\Microsoft.NET\Framework64\v4.0.30319>aspnet_regiis.exe –r

Install ADK 8.1

Mount ISO previously created.

Launch “adksetup” and install these three features:

Note for automated installation: Command to do a silent install

Size Installed: around 1.7 GB

Install SCCM Primary Site

OK, now we can install the Primary Site. On M-SCCM1 VM mount two DVD drives:

• One with the SCCM 2012R2 ISO
• One with the SCCM Prerequisites ISO (create during Preparation)

Launch the Installer and select “Install”

Leave the default option:

Enter your Key (or choose 180 days evaluation):

Accept all Licenses, these components will be installed (except SQL Server 2012 Express, I already installed a SQL Server):

Specify path to files downloaded previously (Prerequisites ISO mounted on DVD):

Select Language:

Enter Information (Site Code, name) and change path:

Select “Install the primary site as stand-alone”

If needed, it’s possible to install later a CAS Server:

Enter SQL information (note that we cannot specify an Instance port, so the SQL Browser service must be enabled):

(*) on remote SQL server, special firewall rules must be created (in addition to standard SQL rules). See “Part 2 – SQL Server Installation” for more information.

Specify Database files path:

SMS Provider:

Configure Communication:

We will configure HTTPS later

Now we specify that the server will host a “Management Point” and a “Distribution Point”:

Start the installation :

Installation Done:

Install Trace Log Tool

SCCM logs are store in: D:\Program Files\Microsoft Configuration Manager\Logs

A Log viewer tool name “Trace Log Tool” is available on the SCCM DVD.

Go to the DVD drive (x:\SMSSETUP\TOOLS) and copy CMTrace.exe to the server.

Now you can open SCCM logs:

Next

The next step is to configure the Primary Site and SCCM roles:

• Part 4: SCCM 2012 R2Primary Site Configuration

In addition, Firewall must be configured to allow clients / other SCCM Servers communication. See the article:

• ANNEX – SCCM 2012 R2 Configure Firewall

The post SCCM 2012 R2 Primary Site Installation appeared first on Tech-Coffee.

SQL server will be installed on a dedicated server. (If SQL server is installed on the same server as the SCCM Primary Site, some steps are not necessary)

Server: M-SQL1

Article Parts:

• Part 1: SCCM 2012 R2 Environment Preparation / Requirements
• Part 2: SCCM 2012 R2 SQL Server Installation-Configuration
• Part 3: SCCM 2012 R2 Primary Site Installation

Preparation

Components required

Storage Requirement

Note [Production]:

• Disk Sizes are for a Lab environment.
  
• For Production it is recommended to add:
  
  • 1x “BIN” disk for “SQL Server”, “System DB” and “Reporting Service” data.
    
  • 1x “TEMPDB” disk for TempDB Database and Log.
    

Service Accounts

• Create accounts and groups
  

Note [Production]: You can use MSA accounts for Database Engine and Agent Services

• Add your account to the SCCMSQLAdmins group
  
• Add SCCMSQLAdmins group to Local Administrators of M-SQL1 server
  

Prerequisites

Remote Registry:

Check if “Remote Registry” service is set to Automatic startup and started (*):

(*) required by SCCM if SQL is installed on a remote Server.

Install .NET 3.5 features:

Install-WindowsFeature NET-Framework-Core -Source V:\sources\sxs

Download the last Cummulative update for SQL Server: https://support.microsoft.com/kb/2772858/en-us Copy it on the SQL Server (e:\CU)

SQL Server – Installation

Launch a CMD (as Administrator), start setup from DVD drive (with CU included):

Select “SQL Server Feature Installation”:

Select features:

Select “Named instance” and enter a Name:

Note: You can add a “BIN” disk for instance root directory.

Required space:

Enter services account and configure Startup Type:

For security reason, it’s not recommended to enable Browser Service (but it’s required with SCCM if you want to change the instance port, see “SQL Design Note /Requirement” chapter)

Select collation: SQL_Latin1_General_CP1_CI_AS

Configure your Security option (it’s recommended to keep the “sa” account as a lifeboat account, but you have to rename it):

Enter your path:

On the SSRS page, select “Install and configure”:

Start the installation:

Check SSRS configuration

You can check Reporting DB creation:

From « Reporting Configuration Manager », service account:

Web Service Configuration:

Test it:

Report Manager URL Configuration:

Test it:

Status must be “Joined”:

SQL Configuration

Configure Instance Port

Use Script: SQL_Set-Instance-Port.ps1

Start a PowerShell console (as Administrator) and run:

SQL_Set-Instance-Port.ps1 -SQLInstance <instancename> – StaticPort <yourport>

Check Configuration:

Use Script: SQL_Get-Instance-Network.ps1

Note: “TcpDynamicPorts” column must be empty (if there is a 0, you have to remove it)

Restart instance and check services:

Set SPN

To use Kerberos authentication (in place of NTLM), a SPN must be created. Register SPN for the SQL Domain Service Account:

Check:

TIPS: Check Authentication mode from SQL:

SELECT net_transport, auth_scheme
FROM sys.dm_exec_connections
WHERE session_id = @@SPID;

-- Example to check SCCM connection:
SELECT session_id, net_transport, auth_scheme,encrypt_option, client_net_address,
client_tcp_port, local_tcp_port
FROM sys.dm_exec_connections
WHERE client_net_address = '10.0.1.10'

Configure Firewall

Use Script: FW_Create-SQLRules.ps1

This script creates incoming rules for SQL Instance, SQL Browser and SQL Broker services.

Edit the script and change the Instance port (1640 in this example).

NOTE for SCCM Installation:

These rules are not sufficient to install SCCM. The setup will fail to join the Remote SQL Server. It is also necessary to open additional Ports:

Use Script: FW_Create-SQLRules-AdditionalSCCM.ps1

Note: These ports are required only for installation, so you have two options:

• Disable SQL Server firewall during SCCM installation
  

• Open ports with the script bellow, install SCCM and disable rules after.
  

Configure rights for SCCM Server on SQL Server

This Step must be done if SQL Server is installed on a Remote Server.

The SCCM server computer account needs “sysadmin” rights on the SQL Server

On SQL Server, it’s impossible to add a computer accounts as logins. So the solution is to create a group with the SCCM computer account and add SQL rights to this group.

On the SQL Server, create a local group “SCCMServers” and add the SCCM Server account:

From Management Studio, create a new login with this group and add “sysadmin” right.

Select the local group created before:

Give the “sysadmin” Server role:

Close Management Studio.

Administrators Right:

Add the SCCM Server computer account to the local “Administrators” group on the SQL Server:

Else there is a failed during install checks:

The post SCCM 2012 R2 SQL Server Installation-Configuration appeared first on Tech-Coffee.

• One server for SQL and Reporting services
  
• One server for SCCM Primary Site
  
• One server for a secondary SCCM Management and Deployment Point (it will be used later for SUP roles and Application Catalog).
  

All servers are installed with Windows Server 2012 R2.

This article not covers a SCCM CAS (Central Administration Site) Server deployment (need if you plan to deploy multiple Primary Sites).

Article Parts:

• Part 1: SCCM 2012 R2 Environment Preparation / Requirements
• Part 2: SCCM 2012 R2 SQL Server Installation-Configuration
• Part 3: SCCM 2012 R2 Primary Site Installation

SCCM 2012 R2 – Design Guide

This part is not cover in this article. For more information see TechNet:

• Fundamentals of Configuration Manager
  https://technet.microsoft.com/en-us/library/gg682106.aspx
  

• Planning for Configuration Manager Sites and Hierarchy
  https://technet.microsoft.com/en-us/library/gg682075.aspx
  

• Site and Site System Role Scalability
  https://technet.microsoft.com/en-us/library/gg682077.aspx#BKMK_SiteAndRoleScale
  

SQL – Design Guide

There are a lot of constraints for SQL on a SCCM environment.

High Availability:

• Configuration not supported:
  

• Configuration supported:

SQL Database Engine:

For Secondary Site:

Configuration:

TCP Port (Instance):

I’m currently testing to force the TCP port in the “SQL Server Native client” configuration, SCCM server can connect to the database but I have not tested whether there were other impacts (in addition, if it works, I’m not sure it is supported by Microsoft..). The solution of the alias is not working.

TCP Port (Broker):

SQL Server Memory:

SCCM Reporting Service Point (SSRS Instance):

Components Requirements

Notes: Internet Information Services (IIS)

SCCM Site Systems roles which require IIS:

• Application Catalog web service point
• Application Catalog website point
• Distribution point
• Enrollment point
• Enrollment proxy point
• Fallback status point
• Management point
• Software update point

Note: IIS must be enabled before SCCM Components installation

Components

(*) On a Deployment Point, WDS feature is automatically installed when PXE option is enabled. But if you want to specify a custom path for “RemoteInstall” folder you have to install and configure feature before enabling PXE.

Preparation

Sources needed:

• ISO – WS2012 R2 Standard or Enterprise
  
• ISO – SQL Server 2012 Enterprise with SP1
  
• ISO – SCCM 2012 R2
  
• FILES – SQL Server 2012 SP1 Update(s) (Actually CU7)
  
• FILES – ADK 8.1 (download offline files)
  
• FILES – SCCM Prerequisite files (see below)
  

Download SCCM Prerequisites

From a computer (x64) with Internet Connection:

• Navigate to SCCM 2012 R2 ISO source: .\smssetup\bin\X64
• Run SetupDL.exe <targetdir> (Example SetupDL.exe E:\CM2012PR)
  

This download .Net 4.0, SQL Express (not needed but you can skip this step), etc…

Build an ISO with this source and copy it on Hyper-V/SCVMM.

Download ADK Prerequisites

Download “adksetup.exe” file:

Windows Assessment and Deployment Kit (Windows ADK) for Windows 8.1 Update – https://www.microsoft.com/en-us/download/details.aspx?id=39982

For more information about ADK tools, see TechNet article – “Windows Deployment Tools Technical Reference“: https://technet.microsoft.com/en-us/library/hh825039.aspx

Select “Download the Windows Assessment….” and specify a path

Build an ISO with the sources:

Extend Active Directory Schema for SCCM

Extend the AD schema is not mandatory for SCCM. However it facilitates client administration, especially for the following points (TechNet extract):

For more information, see TechNet article “Determine Whether to Extend the Active Directory Schema for Configuration Manager” – https://technet.microsoft.com/en-us/library/gg712272.aspx

Four actions are required to successfully enable Configuration Manager Clients to query AD DS to locate site resources:

• Extend the Active Directory schema.
• Create the System Management container.
• Set security permissions on the System Management container.
• Enable Active Directory publishing for the Configuration Manager site

For more information, see TechNet article “Prepare the Windows Environment for Configuration Manager” – https://technet.microsoft.com/en-us/library/gg712264.aspx#BKMK_PrepAD

Note about previous versions:

The SCCM 2012 R2 AD Schema Extensions are the same as SCCM 2007, 2012 or 2012 SP1. So if you have already extended the schema for a previous mentioned above, you do not have to extend it again to install SCCM 2012 R2.

Extend the Active Directory schema

Create a checkpoint of your Domain Controller (I have only one DC):

Logon a server with an account that is a member of “Schema Admins” security group.

From SCCM ISO run .\SMSSETUP\BIN\X64\extadsch.exe

Check schema extension result, open extadsch.log located in the root of the system drive.

Create the System Management Container

Configuration Manager does not automatically create the System Management container in Active Directory Domain Services when the schema is extended. The container must be created one time for each domain that includes a Configuration Manager primary site server or secondary site server that publishes site information to Active Directory Domain Services

Start ADSI Edit, go to the “System” containter and create a new Object:

Select “container”:

Enter “System Management”:

Set Security Permissions on the System Management Container

Open properties of the container “System Management” created previously.

In the “Security” tab, add the site server computer account and Grant the “Full Control” permissions.

Click Advanced, select the site server’s computer account, and then click Edit.

In the “Applies to” list, select “This object and all descendant objects“.

Click OK and close the ADSIEdit console.

The post SCCM 2012 R2 Environment Preparation Requirements appeared first on Tech-Coffee.