One of the new features of the CM 1802 TP is the ability to create deployment templates for Task Sequences and then use that to apply to existing task sequences to create new deployments.
To create a template, during the deployment of a TS, in the Summary screen, there is a new button in the upper righthand corner “Save As Template…”.
Once you select that, you have a new popup box to select what you want included in the template and name the template.
In this case, I chose all of it and named it Win 10 Deployment.
Now to apply the template in a new deployment, in the first dialog, you have the Select Deployment Template button (above the Comments area).
Once clicked, you can select the template of your choice.
Video showcasing the updated feature which allows the user interaction to happen while the installation is taking place as the SYSTEM
To be able to review Windows 10 endpoints (Anniversary Update or higher) into Windows Defender ATP, you will need to onboard first. There are several ways to do so including scripts, Group Policy, Intune, Configuration Manager 2012 through current branch 1602. With the release of Configuration Manager branch update 1606, it now includes integrated Windows Defender ATP to be able to monitor and deploy the policies.
- To get started, login to the Windows Defender ATP site to download the policies https://securitycenter.windows.com/download
Choose the drop down Select your deployment tool, and select the System Center Configuration Manager (current branch) version 1606
- This will download a ZIP file with the onboarding package. Unzip it to where you can access it with ConfigMgr.
- Under Assets and Compliance, expand Endpoint Protection where you will see Windows Defender ATP Policies. Select Windows Defender ATP Policies , and click Create Windows Defender ATP Policy from the toolbar or right click.
- Follow the wizard to import the onboarding file you downloaded from the site. (NOTE: SCREENSHOT SHOWS OFFBOARDING, BUT SHOULD BE ONBOARDING)
- Once done, you will see the policies in the console. Right client or from the toolbar, click Deploy.
- You can do this for off-boarding as well. From the same site, you can select to download the off-boarding package and then follow the steps above to import into ConfigMgr.
A new feature in technical preview 1607 is the connector to OMS to allow syncing of data such as collections from ConfigMgr to OMS.
ASSUMPTION: You have knowledge of Azure and OMS configuration outside of SCCM.
Click OMS Connector and click on Create connection to Operations Management Suite from the toolbar
You will see the first dialog of the Connection to the Operations Management Suite Wizard. Click Next
Enter the Tenant, Client ID, and Client secret key in the next dialog. All this information can be gathered from the Azure Portal. You may need to create a new Application (Under the Directory -> Applications) for the Client ID and key (second screen shot below).
Once entered, you will need to click Verify to continue.
Once the it’s properly verified, you will see the options to add your subscription, resource group, and Workspace name. Click Add to add the ConfigMgr collection(s) that OMS will collect the data from.
Final confirmation box will show your selections.
- After few minutes, logon to the OMS portal (mms.microsoft.com). Do a Log Search for * Type=ComputerGroup.
Now you will see all the computers in the selected Collection (in the above settings) display in OMS. You will see the GroupSource equal to SCCM for those machines. My OMS was configured only for this so other servers are not there yet in my lab.
If you have questions on how to create OMS Workspace, the Client ID, etc. Message me on Twitter https://twitter.com/jparekh_tech
In Microsoft System Center Configuration Manager 1606 (Currently in Technical Preview), you can create device categories. These can be used to automatically place devices in device collections when you are using it with Microsoft Intune (Integrated/Hybrid mode). Users are then required to choose a device category when they enroll a device in Intune. You can additionally change the category of a device from the Configuration Manager console.
You can also assign a category on a non-Intune enrolled device such as a traditional domain joined PC.
Create a set of device categories
- In the Assets and Compliance workspace of the Configuration Manager console, expand Overview, then click Device Collections.
- Right Click on Device Collections and click Manage Device Categories.
- In the Manage Device Categories dialog box, you can create, edit, or remove categories.
Change the category of a device
- In the Assets and Compliance workspace of the Configuration Manager console, expand Overview, then click Devices.
- Select a device from the Devices list and then, in the Home tab, in the Device group, click Change Category.
- In the Edit Device Category dialog box, choose the category to apply to this device, then click OK.
Associate a collection with a device category
When you associate a collection with a device category, all devices in the category you specify will be added to that collection.
- In the Properties dialog for a device collection, click Add Rule > Device Category Rule.
- In the Create Device Category Membership Rule dialog box, select the category that will be applied to all devices in the collection.
- Close the Create Device Category Membership Rule dialog box and the collection properties dialog box.
Now all devices in the chosen Category will be dynamically be part of this collection and its associated deployments
Technical Preview for System Center Configuration Manager, version 1511, included the ability to create a collection where all devices in the collection make up a server group. Then, you could configure the server group settings to use when you deploy software updates to the server group, control the percentage of computers that are updated at any given time, and configure pre-deployment and post-deployment PowerShell scripts to run custom actions.
Technical Preview for System Center Configuration Manager, version 1605, adds the ability to update the computers in the server group in a specified order that you define, adds enhanced monitoring to view the status for the computers in the server group, and provides the ability to clear the deployment locks that is useful when clients have failed to install the software updates and are preventing other clients from installing their software updates.
Configuration Manager Vulnerability Assessment allows to scan managed systems for common missing security updates and misconfigurations which might make client computers more vulnerable to attack.
This release includes
Example checks are:
- Are unnecessary services installed and running?
- Do shared folders have appropriate permissions?
- Is Windows Firewall enabled?
- Are strong passwords enforced?
- Are unsecured guest accounts enabled?
After downloading the pack, you will need to install it which will extract the cab file into C:\Program Files (x86)\VACP (by default).
To import the Configuration Pack
In the Configuration Manager console, navigate to Assets and Compliance / Compliance settings / Configuration Baselines.
Right-click Configuration Items, Import Configuration Data to load the Import Configuration Data Wizard.
Click Add, browse to C:\Program Files (x86)\VACP (unless you specified another path) and select the .cab file in the install location of the .msi, and then click Open.
Summary of the 34 configuration Items will be shown. Click Next to continue.
- Follow the wizard instructions.
- There are three base lines created from the Configuration Items. The Vulnerability Assessment Configuration Pack.docx files associated highlights the details of each base line.
- Deploy the baselines to the proper collections as desired.