Understanding System Center 2012 Configuration Manager

System Center 2012 Configuration Manager is a user-centric product that focuses on the management of users and the devices they have rather than the management of devices and the people who use them. You can use the newest release "System Center 2012 R2 Configuration Manager" to manage assets, applications, compliance, and software updates, in addition to deploying operating systems, and monitoring and reporting on your environment.

In this post, you will learn about the basic and new features of System Center 2012 R2 Configuration Manager, the various types of sites, and the site system roles that you can deploy. System Center 2012 R2 Configuration Manager takes advantage of a redesign of several features in previous versions of Configuration Manager. This post covers the enhancements and modifications made to the Configuration Manager console. 

System Center 2012 R2 Configuration Manager lets you use a single console to manage devices on internal networks and beyond your organization’s perimeter firewall. Administrators can manage an entire Configuration Manager hierarchy through a single console. They do not need to connect remotely to servers in different sites if they want to manage those sites’ Configuration Manager site system roles.

System Center Configuration Manager 2012 R2 has hundreds of features and functions that an IT administrator can leverage as part of their system configuration and management practices; some of the core features in the product are:

• Operating system deployment—At the start of the system's life cycle is the installation of the core operating system. SCCM provides all the tools an organization needs to deploy an operating system, either as an imaged installation (formerly, organizations used Norton Ghost, but no longer need to because SCCM includes image creation and deployment tools) or as a scripted method of installation.
• Patching and updating—Once the operating system has been deployed, SCCM includes the mechanism to patch and update systems. Although many organizations use the Windows Server Update Services (WSUS), a Microsoft role for patching and updating systems, SCCM leverages everything WSUS does but also provides IT administrators a more active patching and updating addition to WSUS. The Software Updates node of the SCCM console, is an example of the detail of the update information. The active update system enforces updates, forcing systems to be patched, updated, and rebooted based on policies that the IT department publishes and ensuring consistency in the update cycle of systems.
• Asset tracking—As part of the operating system deployment and patching and updating process, the management tool needs to know what type of hardware, software, and applications make up the system so the system can be properly updated. SCCM includes the tools necessary to track the hardware and software assets of the systems it is managing.
• Remote control—In the event that a user working on a system needs help, or that a system needs to be serviced, SCCM has a remote-control process that allows the IT administrator or a help desk individual to remotely control and support a user or manage a system whether the system is on the network or remote of the network.
• Software deployment—Although the operating system deployment will install the base operating system on a server or client system, applications need to be installed and managed as well. SCCM provides the tools to push out software applications, whether it is something as simple as a plug-in or utility or as complex as a complete suite or server-based application, including unique application configuration and customization.
• Desired Configuration Management—Beyond just having an operating system and applications installed on a system, keeping a system configured in a standard setup is crucial in consistency controls. SCCM provides a process called Desired Configuration Management, or DCM, that has policies established for system configurations so that a system cannot be changed or modified beyond the configuration standards set by policy for the system. This ensures all systems have the same software, drivers, updates, and configuration settings meeting stringent audit and controls standards consistent with regulatory compliance rules.
• Internet Client—A very significant component in SCCM is the Internet Client. In the past, for a system to be managed, the system had to be connected to the network. For remote and mobile systems, that means the system has to be VPN'd into the network to have patches and updates applied or for the IT department to inventory or remotely control the system. With the Internet Client and the use of a PKI certificate installed on the system, a remote or mobile system merely needs to be connected to the Internet anywhere in the world, and the SCCM client will automatically connect back to the corporate SCCM server through a secured tunnel to allow SCCM to inventory, patch, apply policies, and update the system. The remote system does not need to VPN into the network or do anything other than simply establish connectivity to the Internet.
• Reporting—SCCM integrates into the product a report generation tool, that comes with a full set of out-of-the-box reports, including the ability for IT personnel to create customized reports on everything from asset inventory reports to standard configuration reports to reports on the patch and update level of each laptop and desktop in the entire enterprise. Reports can also be customized in the report tool querying any data sets of information collected by SCCM and producing reports specific to the needs of the organization.

Through the Configuration Manager console, you can manage client devices that are running Windows® operating systems, including Windows Vista®, Windows 7, Windows 8, and Windows 8.1. You also can deploy Configuration Manager clients to enable the management of computers that are running non-Microsoft® operating systems, such as supported versions of the Apple operating system, Mac OS X, in addition to supported Linux distributions and variants of UNIX.

Configuration Manager supports the management of devices beyond a perimeter firewall through integration with Windows Intune™, which is the Microsoft cloud-based client-management product. When linked with Configuration Manager through the Windows Intune connector, you can manage devices that are running Windows RT, Windows RT 8.1, Windows Phone® 8, and supported versions of the Android and Apple (iOS) mobile operating systems. You also can use the Windows Intune connector to enable Configuration Manager to manage computers that are not domain-joined that are running Windows PC operating systems.

System Center 2012 R2 Configuration Manager also supports distribution points based on Windows Azure™. Windows Azure distribution points enable delivery of Configuration Manager–based content from Windows Azure to clients. This reduces the complexity involved in providing content to client devices that are outside an organization’s perimeter firewall either temporarily or permanently.

System Center 2012 Configuration Manager Service Pack 1 (SP1) introduced new features that were not available in the original Release to Manufacturing (RTM) version. The release of System Center 2012 R2 Configuration Manager builds on the SP1 release and introduces additional features.

New Features in System Center 2012 Configuration Manager SP1

System Center 2012 Configuration Manager SP1 introduced the following significant features that provide support for:

·         The Configuration Manager client on computers that are running Windows 8.
·         The ability to deploy Windows 8 or to perform upgrades of Windows 7 computers to Windows 8 by using Configuration Manager.
·         Windows To Go.
·         User data and profiles configuration that enables Configuration Manager to manage folder redirection, offline files, and roaming profiles.
·         Deployment of Windows Store apps (.appx files) to Windows 8 clients through sideloading or links to the Windows Store. Sideloading is the process by which Windows Store apps are deployed to devices without using the Windows Store.
·         The metered Internet connection and the Always On, Always Connected Windows 8 features.
·         Using Windows Server 2012 on site systems and client devices.
·         Using SQL Server 2012 to host the Configuration Manager database.
·         Mac OS X, Linux, and UNIX computers as Configuration Manager client devices.
·         Mobile devices that are running the Windows Phone 8, Windows RT, iOS, and Android operating systems through a Windows Intune organizational account.
·         The inclusion of Windows PowerShell® cmdlets that you can use to automate Configuration Manager operations through Windows PowerShell command-line interface scripts.
·         Windows Azure distribution points.
·         The ability to expand a stand-alone primary site into a hierarchy with a new central administration site.
·         Migration of a Configuration Manager SP1 hierarchy to another Configuration Manager SP1 hierarchy.
·         More than one software-update point in a site.
·         The ability to trigger some client operations, such as downloading policy and triggering malware scans, from the Configuration Manager console.
·         Microsoft Application Virtualization (App-V) virtual environments that allow App-V applications to share data from file systems and registries.
·         Increased email alert subscriptions.

New Features in System Center 2012 R2 Configuration Manager
In addition to the features discussed above, System Center 2012 R2 Configuration Manager includes the following new features that provide support for:
·         Windows Server 2012 R2 and Windows 8.1
·         Boot images that you create by using Windows Automated Installation Kit for Windows 7 SP1.
·         The new site system role for certificate registration points. This role enables deployment to, and management of, certificates to Configuration Manager client devices.
·         Certificate profiles that support user and device certificates to managed devices that are running the iOS, Windows 8.1, Windows RT 8.1, and Android operating systems.
·         Merging of System Center 2012 R2 Configuration Manager hierarchies.
·         Migration of System Center 2012 Configuration Manager test-environment data to a System Center 2012 R2 Configuration Manager production environment.
·         The enrollment of Mac OS X computers and deployment of client certificates through an enrollment wizard.
·         The ability to reassign Configuration Manager client devices, including managed mobile devices, to a different site in the Configuration Manager hierarchy, either individually or through bulk reassignment.
·         The enrollment of Android devices by using the Company Portal app that is available through the Google Play store. The Company Portal app includes the Configuration Manager management agent that enables management capabilities such as password settings, a camera, and encryption settings.
·         The enrollment of iOS devices by using the Company Portal app that is available through the Apple App Store. The Company Portal app enables users to change or reset a password, download and install organization apps, enroll, unenroll, or remove organizational content from their iOS device.
·         Devices that run the Windows RT, iOS, and Android mobile operating systems support the Required deployment purpose.
·         The wipe and retire function, which enables administrators to remove only organizational content from devices.
·         Windows Intune, which can manage Windows 8.1 devices that are not domain-joined and do not have the Configuration Manager client installed.
·         Additional Compliance Settings related to mobile devices.
·         Deploying web applications through a new deployment type.
·         Windows 8.1 app bundles (.appxbundle) to optimize the deployment of Windows Store apps and resource packages.
·         Featured applications that display prominently in the Company Portal.
·         Configuration of per-application VPN profiles that enable an application to open a VPN connection.
·         Remote connection profiles, which enable users to connect remotely to their work computers from the company portal.
·         VPN profiles, which enable you to deploy VPN settings to devices that are running iOS, Windows RT, and Windows RT 8.1.
·         Wi-Fi profiles that enable you to deploy Wi-Fi connection settings to devices that are running iOS, Windows 8, Windows 8.1, Windows RT, and Windows RT 8.1.
·         Maintenance windows for software updates.
·         Previews of software updates in an automatic deployment rule.
·         Altering the deployment package for an existing deployment rule so that you can add new software updates more efficiently.
·         The ability to view resultant client settings so that you can see effective client settings that are applied to specific devices.
·         Non-default locations for site database files.
·         The creation of pre-staged content files for task-sequence content.
·         Virtual hard disk management.
·         New task sequence steps that include Run PowerShell Script, Check Readiness, and Set Dynamic Variables.
·         Pull-distribution points that enable administrators to configure priorities for source distribution points.
·         Pushing of status information about completed actions by pull-distribution points to the site server.
·         Summary reports of distribution point usage, which enables administrators to view details that compare individual distribution point utilization.
·         Configuration Manager reporting, which supports role-based administration with all of the reports’ data filtered based on the permissions of the user who runs the report.

Upgrading to System Center 2012 R2 Configuration Manager

You can upgrade to System Center 2012 R2 Configuration Manager only from System Center 2012 Configuration Manager SP1. You cannot upgrade directly to System Center 2012 R2 Configuration Manager from System Center 2012 Configuration Manager. You must first install SP1 before upgrading to System Center 2012 R2 Configuration Manager.

Overview of System Center 2012 R2 Configuration Manager

System Center 2012 R2 Configuration Manager provides a unified infrastructure and a single console through which you can manage physical, virtual, and mobile clients. It also provides tools and improvements that make it easier for IT administrators to do their jobs.

Several features of System Center 2012 R2 Configuration Manager provide the tools that help an organization provide highly effective IT services in several areas:

·         Asset management. These tools enable you to gather and use information about a network’s users and devices.

·         Change management. These tools enable you to deploy and manage applications in a network,

identify and remediate devices that do not have correct configurations, upgrade existing client systems or deploy new client systems.

·         Administrative Features. These tools enable you to monitor an environment that you manage with Configuration Manager, in addition to the tasks that you perform within that environment.

The following table outlines the features of System Center 2012 R2 Configuration Manager.

Feature	Feature usage
Asset management
Hardware and software inventory	Use these tools and resources to maintain a record of your organization’s hardware and software.
Asset Intelligence	Use this feature to obtain more insight from the inventory data that the Hardware and Software Inventory features record. Asset Intelligence uses a catalog that contains software and license information to identify the inventoried software.
Software Metering	Use this feature to monitor and collect software usage data and generate reports to determine how applications are used in your organization.
Change management
Application Management	Use these tools and resources to create, manage, deploy, and monitor your organization’s applications.
Software Updates Management	Use these tools and resources to manage, deploy, and monitor software updates in your organization.
Operating System Deployment	Use this feature to plan and deploy operating systems by using images.
Content Management	Use these tools and resources to manage content files for applications, packages, software updates, and operating system deployment.
Compliance Settings	Use these tools and resources to help you assess, track, and remediate the configuration compliance of your organization’s client devices.
Power Management	Use these tools and resources to manage and monitor the power consumption of your organization’s client devices.
Client Health	Use these tools and resources to manage and monitor the health of your Configuration Manager client software.
User Data and Profiles	Use this feature to control folder redirection, offline files settings, and roaming user profiles for Configuration Manager clients.
Remote Connection Profiles	Use this feature to manage inbound remote connections to Configuration Manager clients.
Company Resource Access	Use this feature to provision Configuration Manager clients with virtual private network (VPN) settings, Wi-Fi profiles, and certificates.
Network Access Protection	Use this feature as a health validator. It works in conjunction with Network Access Protection (NAP) in Windows Server® 2008, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2.
Endpoint Protection	Use this new functionality in System Center 2012 R2 Configuration Manager to protect clients against malware. This functionality was available previously in Microsoft Forefront® Endpoint Protection.
Administrative features
Reporting	Use the Microsoft SQL Server® SQL Reporting Services in Configuration Manager for report generation. Administrators can create subscriptions that enable report generation on a specific schedule and for distribution in various formats by email.
Monitoring	Use this feature to supervise site systems and client health. It also provides automatic remediation for specific client errors.
Remote Management	Use this feature to access any client computer in the hierarchy remotely so that you can assist a user. Use the remote control to troubleshoot configuration issues with your organization’s hardware and software on client devices and to provide help desk support when access to a user’s computer is necessary.
Role-based Administration	Use this feature to assign roles and permissions for administrators that enables them to access and use Configuration Manager features.

System Center 2012 R2 Configuration Manager assesses your environment comprehensively, deploys operating systems, and updates your servers, clients, and devices across physical, virtual, distributed, and mobile environments. It is optimized for the Windows operating systems. It is an optimal choice for gaining enhanced insight into and managing IT systems. There are several benefits of using System Center 2012 R2 Configuration Manager, which the following sections detail.

Empowering User Productivity by Using Configuration Manager

Often, users do not realize they require a particular application until they need it. However, if your organization employs traditional processes and methods for application installation, this could mean that your users have to wait several days for software installation. However, if you use the Configuration Manager application management features, you can accelerate this process so that users can request and receive software more quickly.

Additionally, by using the Configuration Manager asset management features, an IT staff can monitor systems that are running low on resources. Detecting and alleviating issues before they interrupt users is another way Configuration Manager can help empower user productivity.

Unifying Management and Security Features

Typically, users log on to the Internet continuously for business and personal reasons. This online activity makes their systems vulnerable to constantly evolving malware and other security threats. System Center 2012 R2 Configuration Manager includes an Endpoint Protection feature that can help alleviate some of these challenges. However, the evolving nature of Internet threats presents a challenge for any protection software to block every potential issue. Configuration Manager’s compliance-management features can help alleviate potential threats by ensuring that your environment’s clients have the proper versions of software installed and configured properly.

Licensing for System Center 2012 Server Management

There are two editions of the System Center 2012 suite: Standard and Datacenter, which the following table details.

Server License	Products	Virtual machines per license
System Center 2012 Standard Edition	·         App Controller ·         Configuration Manager ·         Data Protection Manager ·         Endpoint Protection ·         Operations Manager ·         Orchestrator ·         Service Manager ·         Virtual Machine Manager	Two
System Center 2012 Datacenter Edition		Unlimited

You can purchase System Center 2012 R2 licensing for client management in a variety of packages. System Center 2012 includes licensing for a version of SQL Server Standard edition that supports System Center 2012. This can be any version of SQL Server Standard edition that supports System Center 2012.

System Center 2012 R2 Configuration Manager Hierarchy

You can deploy System Center 2012 R2 Configuration Manager as a stand-alone primary site or as multiple primary sites that connect to a central administration site. The primary reason for using multiple sites is to support a larger number of clients. When using a hierarchy that consists of multiple sites, you have one or more site system servers in each site. You cannot change a site’s hierarchical position without uninstalling and reinstalling System Center 2012 R2 Configuration Manager. Therefore, it is essential that you consider your requirements carefully and plan your deployment properly. When deploying a Configuration Manager site, you assign the site a three-character site code that must be unique in your hierarchy. You cannot change this code without uninstalling and reinstalling Configuration Manager.

In a System Center 2012 R2 Configuration Manager hierarchy, the sites have one of the following roles:

·         Central administration site. This is at the top of the hierarchy, and you can use it for generating reports and administration.

·         Primary site. You use primary sites to manage client systems. All client systems are assigned to a primary site.

·         Secondary site. You can use secondary sites to control bandwidth usage between physical locations. Client systems can report information to, and retrieve information from, a secondary site.

When you plan a System Center 2012 R2 Configuration Manager hierarchy, you should identify the number and type of sites that you require, where you will deploy them, and how you will deal with future expansion. Planning for expansion is an important step because the changes in System Center 2012 R2 Configuration Manager from older Configuration Manager versions enable Configuration Manager to support more clients with fewer sites.

There are many other factors that determine your hierarchy’s structure, including:

·         The current state of your network, such as wide area network (WAN) connection speeds, available bandwidth, and connection reliability.

·         The current state of your computing environment, such as the number of users, the number of locations, and user density at the locations.

·         Business or regulatory requirements.

From a functionality standpoint, there are only two reasons to deploy multiple sites: scalability beyond 100,000 clients and management of WAN links. However, based on your specific scenario, you might decide to use multiple sites even if you have less than 100,000 clients. For example, in an environment with very high WAN utilization, you might decide to minimize Configuration Manager traffic by placing a distribution point in a remote location and then scheduling deployments at off-peak hours. Another company might look at the same scenario and have requirements that mandate using a secondary or even a primary site at the remote locations, and possibly expanding the available WAN bandwidth.

When you install a System Center 2012 R2 Configuration Manager site, several site system roles install by default. The roles that install are required for each site’s core operation. You can move some of these roles to other servers, but you cannot remove them from the site. When you install additional site servers for optional roles, Configuration Manager also installs some default site system roles.

Default Site System Roles

When you install a site server, Configuration Manager installs the default system roles automatically. These roles are preconfigured, and you have minimal additional configuration options. The SMS Provider role is the only role that does not have an object exposed in the Configuration Manager console. Configuration Manager also installs two optional roles, the management point and distribution point roles, when you install a primary or secondary site server.

The following table lists the default site system roles.

Site system role	Description
Site server	The site server provides core functionality for the site.
Site system	The site system is a computer that provides specific Configuration Manager functionality to a site. This functionality depends on the site system roles that are deployed. You deploy roles during Configuration Manager site installation or when you deploy an optional site system role to a server.
Component server	Any site systems that run the SMS Executive service also host the component server site system role. This role is required to support other roles, such as a management point, and Configuration Manager installs and removes it with the other site system roles.
Site database server	The site database server is a computer that runs a Microsoft SQL Server instance that stores information for the Configuration Manager site. Typically, a site database server supports only a single Configuration Manager site. However, you can use distinct instances on clustered or nonclustered SQL Servers to host the database from different Configuration Manager sites, as long as each instance uses distinct ports.
SMS Provider	The SMS Provider is the interface between the Configuration Manager console and the site database.

Optional Site System Roles

Optional site system roles are site system roles that the core operation of a Configuration Manager site does not require. Although the management point and distribution point roles are optional, they install automatically on a primary or secondary site server when you install Configuration Manager. These roles are optional, and you can move them to other servers after installation. You must have at least one management point to support client systems and one distribution point to distribute files to client systems. After a site’s installation, you can install other optional site system roles on the site server or other servers.

The following table lists the optional site system roles.

Site system role	Description
Application Catalog web service point	Provides information from the Software Library to the Application Catalog website.
Application Catalog website point	Users navigate to this site to view a list of available applications.
Asset Intelligence synchronization point	Connects to a Microsoft website to download data for the Asset Intelligence catalog and to upload application signatures. You can install this site system role only on the central administration site or a stand-alone primary site.
Certificate registration point	Provides certificate deployment and management functionality for Configuration Manager clients.
Distribution point	Hosts source files for clients to download. You can control content distribution by configuring bandwidth throttling options.
Endpoint Protection point	Implements Endpoint Protection in the System Center 2012 R2 Configuration Manager environment.
Fallback status point	Assists in monitoring client installations. Enables you to identify unmanaged clients that are unable to communicate with their management point.
Management point	Provides a primary point of contact for client communication. Additionally, it provides policy and content location data to client systems and receives configuration data and status messages from clients. You must deploy at least one management point at each primary site that manages clients. You also must install a management point at each secondary site where you want to provide a local contact point from which clients can obtain machine and user policies.
Enrollment point	Provides complete mobile device enrollment and enables you to provision Intel Active Management Technology (AMT)–based computers with Public Key Infrastructure certificates.
Enrollment proxy point	Manages enrollment requests from mobile devices. To manage devices that are connected to Microsoft Exchange Servers, you must use an Exchange Server connector. To manage devices that are connected through Windows Intune, you must install the Windows Intune connector.
Out of band service point	Helps provision and configure AMT-based computers for out-of-band management.
Reporting services point	Helps integrate with SQL Server Reporting Services to create and manage reports for Configuration Manager.
Software update point	Integrates with WSUS to provide software updates to Configuration Manager clients.
State migration point	Stores user-state data during operating system migration.
System Health Validator point	Validates Configuration Manager NAP policies. You must install this on a NAP health policy server.
Windows Intune connector	Required when you configure a connection to a Windows Intune subscription for the management of mobile devices.