Category Archives: SCCM

Config Migration Tip – Use PowerShell to export and import Security Roles

I have been doing a lot of migration prep work and wanted to share a big time saver for moving security roles. You can use PowerShell to export and import security roles. If you have lots of custom roles this is a huge time saver.

To export all of the custom roles

After you collect all the xml files for the roles and are ready to import them use this


Restoring SMS Registry from the SCCM Site Backup

Well I had an interesting morning. For the past couple of weeks I have had to repair several site servers where key ccm and sms registry key had been deleted. At 1st it appeared that a client repair had gone bad and killed the keys. But this morning it was track down to someone running a client repair script incorrectly. They were targeting a remote client but the script was removing local registry keys. However today it happened on a primary server and we were looking at a site recovery to fix it. What follows may not be supported but it worked for me; if you are looking at site recovery worst case is this does not work and you will need to do the recovery anyway.

On this system the script attempted to deleted the HKLM\Software\Microsoft\SMS key and all sub keys. Most were still present because the SCCM services and components had them open and the delete failed. But a lot were missing! So we when looking for possible backups.¬†I attempted to load the backup copy of the Software hive from windows\system32\config\regback but that was unsuccessful. Next I turned to the System Backups but the recovery plan for this server was to rebuild and then restore the application drives so the OS drive was not backed up. Well the site recovery was looking more and more like the solution. As I checked that backup from the site maintenance process the file \SiteServer\SMSbkSiteRegSMS.dat file reminded me that the back up includes the HKLM\Software\Microsoft\SMS key. So I took a peek at the DAT file in notepad and sure enough it had the registry info. After loading the DAT file as a custom hive in regedit I exported the custom hive and the sms key. (Always remember to back up the registry you are about to change. Got to remember to explain this to the script author ūüôā ) In the reg file for the custom hive I updated the path so that all of the key were for HKLM\Software\Microsoft\SMS. After ensuring that all of the SMS services where stopped, the custom hive reg file was imported into the registry. Some checking to ensure thing like server names and site codes where correct and the sms services were restarted. After celebrating the lack of red in the server logs, the site was declared functional and I snuck off for a nap.

Quickly get system stats for Software Update Point\Management Point

Like most of us out here is SCCM land Patch Tuesday generally means that you will see a performance for the WSUS app pool that you will need to ensure does not lead to issues. Here is a quick PowerShell command  to get the CPU utilization and the current connections the websites. I use it for monitoring both management points and software update points. Because it is using performance counters it is easy to add other counters that are relevant to your own environment.

get-counter supports remote systems with the -ComputerName parameter so to check Multiple systems use


Software Updates not applying after a Site Reset

There is a long story about why that I have not had time to post about, one of the SCCM environments had to be recovered with a Site Reset. The reset was successful and everything appeared to be functioning normally. The next day the patching team started to report a few clients not applying patches. Now this is not unusual, there are always¬†some clients that¬†have issues, but by the end of the day it¬†they were reporting that it was all clients.¬†¬†The bulk of the clients were reporting ¬†‚ÄėAssignment ({xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx}) already in progress state (AssignmentStateDetecting). No need to evaluate UpdatesDeploymentAgent‚Äô in the UpdateDeployment.log. Gabriel Alicea¬†has a great post that solved the issue –

The moral of the story is that the Site Reset changed the version of the wsus catalog to 1 on the primary server but the software update point and the database had a different number. Stopping the services on the primary,updating the registry values, restarting the services and then running a sync allowed the clients to correctly evaluate the scans and apply patches.


Preping SCCM Boot Disks to use with WDS or 3rd Party PXE

I have been busy after taking an extended vacation and then catching up at work, but a couple of folks on twitter have been sharing about using the SCCM Boot Disks with WDS. This is something that I do and learned from Johan Arwidmark . If you work with Configuration Manager you may have heard of him before. ūüôā Here his current post on the subject¬† and it has a link to Zeng Yinghua (Sandy)‘s post on this using iPXE rather then WDS.

What I have to add is a quick Powershell script to automate prepping the Boot Disk for use outside of a integrated SCCM PXE DP.

Step 1 РCreate the Boot disk as a ISO

Step 2 – Extract the ISO contents.

Because I do this for a couple of boot disk in several environments I name the iso and the directory that they are extracted to something that helps keep track of them easily. For example Lab_x64, Lab_x86, Prod_x64, etc ..

The script below will use the folder name that you extract the files to name the wim file as well. While not a big deal if you only do one disk at a time, it helps when processing several at the same time.

Step 3 – Prep the boot.wim file for use via PXE.

This is the script that I use

This will go thought each of the directories in the $sources variable and mount the boot wim with dism. If there is not a \SMS\Data  folder it will create it. Next it copies the contents of the SMS\DATA folder from the source directory extracted from the iso and copies it to the mounted wim file. After that the script does an optional step. For my environment when we use WDS there is need to execute a Pre-Execution step. The files for this are staged in the Tools directory. So the script creates the directory and copies the files. Next it copies the TSconfig.ini for the Pre-Execution step. This is also optional.  The script then unmounts the wim file and commits the changes.

After all of the boot.wim files have been updated the script will copy each to a staging directory and name the files based on the name of the source folder. So Lab_x64.iso was extracted to d:\SCCM_export\Lab_x64 and the boot.wim from that directory is named Lab_x64.wim.

Step 4 – Copy to your WDS server and add to the menu.

Thanks Johan and Sandy for posting and reminding me about this.


Management Point Troubleshooting

Just a quick note, If you are looking into issues with a management point responding with a 500 error for policy.

If http://servername/SMS_MP/.SMS_AUT?MPCERT is ok

and http://servername/SMS_MP/.SMS_AUT?MPLIST gives a 500 error.

Check your database it could be down. Not how I wanted to end a Monday but at least in this case it was a SAN network issue impacting the database server. Once that was resolved the SCCM site came right back up.


Distribution Points not reporting Usage data

I am scratching my head about the what happened on this issue, but let me explain. We had a issue come up in our SCCM RAP. (If you are a Premier Customer, I highly recommend the RAP as a service. Get it, Use it, and Use it often.) There were about 30ish distribution points that were not reporting usage stats for our 2012 R2 Configuration Manager site. A quick check showed that the distribution points where alive and well but that the scheduled task that reports the usage statistics was gone. ¬†If you need a good primer on how to check out a distribution point see this post from Scott’s IT Blog. To resolve this I simply exported the task from a working distribution point and imported on the systems where it was missing. To be honest though it did not get fixed everywhere. A couple of months go by and we rerun the RAP and look at the results. Now there are over 300 distribution points not reporting statistics because of a missing scheduled task. This makes me beg and plead to speed up our upgrade project for Current Branch. But until then I have to keep everything going, so a little powershell to the rescue.

First I choose to export the existing scheduled task from a working server and save it as c:\temp\Content Usage.xml

The Rap web site is great for reporting the issue but not so much for getting the details in a way that is easily usable in a script. So here is a SQL query to identify distribution points not reporting usage date.

This will give you a list of server names that you can save in a file. Now for the powershell to recreate the scheduled task and run it.

Give it a little time and rerun the SQL query to verify that the systems are reporting usage data and are being removed from the report.


Updating SCCM Client Logging Options

If you spend anytime supporting¬†System Center Configuration Manager, you will develop a special love for log files. Often I find that I¬†need to change the logging options on a small group of clients to troubleshoot.¬†It could be because I need a larger¬†file size or need¬†to enable debug logging.¬†While making the changes is fairly painless on one system, doing it on several can drive me to drink several cups of coffee. (To be fair just going to work drives me to drink….coffee.) Here is the script I use to make the changes and then put everything back to normal afterwards. The script is below but I am including the Powershell Gallery and GitHub Links as well.

Powershell Gallery






Reporting on the Total Physical Memory installed vs the Memory visible to the OS

Recently I was asked if SCCM could report on the total physical memory installed. No problem there is even a built in report for that, I replied. No the requester explained, on systems with a 32 OS installed those reports only show the max memory the OS can see. So we sit down and go through the Resource Explorer and find that we are collecting the Win32_PhysicalMemory Class from WMI as part of our hardware inventory. A quick little query gets the info for that can be made into a report.