How to disable a SCCM software update deployment using Powershell

How to disable a SCCM software update deployment using Powershell

Since Microsoft added Powershell as integral part of System Center Configuration Manager, SCCM admin has now option to use Powershell to apply automation. As a part of this automation, I will show you how to disable a SCCM software update deployment using Powershell command.

With below Powershell script(three lines of code), you can automate software update deployment status. Create a .PS1 file from below and run it(on demand or make a schedule task to run it as per requirement).

Import-Module "D:\Program Files\Microsoft ConfigurationManager\AdminConsole\bin\ConfigurationManager.psd1"
CD CST:
Set-CMSoftwareUpdateDeployment -SoftwareUpdateGroupName Mar18-2012R2 -DeploymentName Mar18-2012R2 -Enable 0

Please note below:
1) Location of SCCM installation may vary. In my case it was D drive. So please change location as per your requirement to get the .psd1 file.

2) CD CST:  - CST is site code of my CAS site. It may be different in your case. Please change it as per your requirement

3) Set-CMSoftwareUpdateDeployment -SoftwareUpdateGroupName <name of your target SUG> -DeploymentName <name of you target deployment > -Enable 0 

Enable > 0 means to turn off and 1 means to turn on the deployment.

Go back to console and you will find that your target software update deployment has been disabled.

If this post helps you or you like it, kindly leave below your valuable comment. Thanks.

Read More

SCCM feeback given to Microsoft for adding Delta Discovery in Context Menu

Well, Microsoft Configuration Manager PG team added Feedback section on SCCM console couple of years back. Today, I thought to give them a feeback and my idea is:

"To add Delta Discovery option in Context Menu against discovery option like System, Group, User etc."

Hope, Microsoft PG team shall consider my idea.

Read More

ClickJack, MIME, Code Injection and CSS attack in HTTP header

I was working on SCCM server vulnerabilities in terms of OS and application installed on it.

There are four specific HTTP header attacks which your IT security team ask you to fix on those SCCM server where IIS is running.


Normally below four HTTP headers are important to add and set with value(value may differ as per the requirement) in your SCCM server with IIS not added earlier.

X-XSS-Protection: To prevent XSS(Cross Site Scripting) attack, header name  'X-XSS-Protection' has been set with value '1;mode=block' means XSS filter enabled and prevented rendering the page if attack detected.

X-Frame-Options : To prevent from ClickJacking attack on website, X-Frame-Options' header has been set with value 'SAMEORIGIN' means Frame/iframe of content is only allowed from the same site origin. It not good to set value of 'DENY'.

X-Content-Type-Options : To prevent from MIME attack, header name 'X-Content-Type-Options' has been set with value 'nosniff'' means to prevent content sniffing. 

Content-Security-Policy : To prevent from code injection attack, 'Content-Security-Policy' header has been set with value 'default-src 'self'' which means Load everything from defined source.

How to set the header and its value?

1) Open CMD or Open Run and type 'inetmgr' to open the IIS console. In my case, its IIS version 8.

2) Expend the IIS console node at left side and browse to your target website. In my SCCM server case, it was Default Web Site.

3) Click the target website.

4) Go to 'HTTP Response Headers' option(at middle) and double click to open it.

5) Click “Add” under Actions.

6) Enter Name, Value(as mentioned above) and click OK to apply. 

7) Restart the IIS.

Thats it !! Your are done.

Read More

Content Library Migration in SCCM 2012 and onwards

Situation may come to SCCM engineer's life that he/she may need to transfer the Content Library from one drive to another drive. Normally we do Content Library migration when we face disk space issue in existing drive and to create free space we have to move CL location to new drive where we can have sufficient space to accommodate existing size as well as future file size. 

I want to share the migration activity from real world scenario perspective.

Content Library folder contains three sub folders i) DataLib ii) FileLib and iii) Pkglib. Apart from CL folder, we SMSPKG and SMSPKGSIG folder are also important and which all are moved from source to target folder.

ContentLib folder along with PKG and SIG folder.

Inside SCCMContentLib folder

Steps to be taken to perform the Content Library(CL) migration from one drive to another:

1) Make sure you have Net backup(tape backup) of entire drive where CL exists or at least take tape backup of SCCMContentLib, SMSPKG and SPSPKGSIG folder.

2) Check SCCM back of that site where you need CL migration and if the backup is not latest(max of 5 days can accpeted), get the backup done and keep it.

3) Inform to depended teams who use the site for any kind of automation that use SCCM to create packages etc. and ask them to stop the activity until the migration activity will get completed. 

4) Follow the Change Management process and raise the CR with required approvals.

5) Once you have above 4s ready, you can perform CL migration on schedule date and time. Please remember that CL migration duration depends on size of the CL. More size, more time it will take. So keep patience.

To perform CL migration, you need ContentLibraryTransfer.exe tool which is a part of Microsoft's ConfigMgr 2012 Toolkit R2 and you can download the toolkit from HERE. 

Install the toolkit(with ServerSide tool) and open Powershell or CMD in elevated moe. Browse to Server Tools folder of ConfigMgr 2012 Toolkit R2 folder and type below command:

ContentLibraryTransfer.exe -SourceDrive <nameofthesourcedrive> -TargetDrive <nameofthedestinationdrive>  > C:\contentlib.log

In below screenshot, sourcedrive is I drive and target drive is G drive and I kept log file(which is must and useful to track the CL migration activity) in C drive.

6) You need to track the log file generated by the CLTransfer tool. Tool validates source and target drive, check free space at target drive with comparison to existing space in source drive. After that it stops SMS EXECUTIVE and COMPONENT services(to stop any incoming activity in CL folder) and then initiates the migration(it moves all folders from source to target folder).  

Once all folders are copied successfully to target drive, it drops no_sms_on_drive.sms file in source drive to avoid CL folder creation in source drive, start SMS EXECUTIVE and COMPONENT services and remove CL folders from source drive.

7) Post successful migration, you need to do following in order to check CL folder is working fine in new location.

i) Create one or two new package, distribute to couple of DP servers and check whether package is getting distributed successfully and entries are created in all sub folders of CL folder.

ii) Check validation of any existing packages.

iii) Check site server components.

iv) Check replication link.

If above checks(under Point No.7) go fine and components and link are fine, you need to understand that the activity is completed successfully.

8) Inform to dependent team to resume their works at site where you perform the CL migration. 


Note: There is no need to check pending packages at DPs and no need to remove them during CL migration because before starting the migration activity, CL migration tool stops the SCCM executive and component services which means the target site is inactive during the migration period. Once migration is completed, tool automatically restart the services to bring site into normal state. 

Read More

Bug in SCCM 1606

While updating the SCCM 1606 with hotfixes(KB3186654 and KB3202796), I experienced an issue. Latest SCCM 1606 hotfixes appeared in the SCCM console and I initiated download. Initially it showed 'downloading' but it remained keep in same state in next day also.

I started checking why still shows the state as 'downloading' just for a hotfix. I checked dmpdowloader.log and found error Failed to call Initialize. error = [error code: -2147467261, error message: Invalid pointer]. Finally I check the SMS_DMP_DOWNLOADER component and found that it is stopped. I tried to start it but failed. 

While digging more on this issue, I found that the SMS_DMP_Connector registry key was removed automatically. I cross checked in a test lab where SCCM 1606 as well as its hotfixes are not installed and found that registry key SMS_DMP_Connector(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\SMS_DMP_CONNECTOR) is intact with values ProxyUserName and ProxyUserPassword. I recreated SMS_DMP_CONNECTOR key in my problematic server and created both the values i.e. ProxyUserName and ProxyUserPassword(kept the value empty). 

Thats it !! Issue is solved. I experienced that the SMS_DMP_CONNECTOR key must present in the SCCM server where Service Connection Point(SCP) is configured. 

I think this is a SCCM 1606 bug and I hope the Microsoft SCCM developer team will fix it permanently. 

Hope you like this blog post. Happy reading !!

Read More

SCCM error - Call to HttpSendRequestSync failed for port 443 with status code 500

During my recent activity at SCCM server, I found below error in the mpcontrol.log :

Call to HttpSendRequestSync failed for port 443 with status code 500, text: Internal Server Error

I'll share you how I solved this issue. Once I got the issue in the mpcontrol.log, I tried to open the default webpage in the IIS installed in the same server. I found below error:

HTTP Error 500.19 - Internal Server Error

Detailed Error Information:

Module	DynamicCompressionModule
Notification	SendResponse
Handler	ExtensionlessUrlHandler-Integrated-4.0
Error Code	0x8007007e

This IIS error means(by checking the module), I understood that the Windows Server Update Services(WSUS) server that installed on the server,enabled 64-bit compression that caused any 32-bit applications running in IIS to fail. 

To fix the issue, I disabled WSUS compression by running below command at command prompt(elevated permission) : 

%windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/httpCompression /-[name='xpress']

After this, I reset the IIS , rebooted the server and checked the mpcontrol.log. Guess what ?? Error gone and MP functionality came back to normal.

I suggest all administrator to first check the IIS health status and permission before thinking of removing Management Piont(MP) and reinstalling it because simply removing and reinstalling the MP will not always fix the problem unless you understand the meaning of error in the mpcontrol.log and check the IIS health status and permission. 

In case of any reason, if we want to enable the compression, you can run below command to revert the change:

%windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/httpCompression /+[name=’xpress’,doStaticCompression=’false’,dll=’%windir%\system32\inetsrv\suscomp.dll’]

Hope someone may find it useful. 

Read More

SCCM 1602 New Features

Microsoft announced release of System Center Configuration Manager 1602 on 11th March 2016 and made it public on 24th March 2016. Company called it as first update to the SCCM Current Branch(CB) which is under new concept called SCCM as a Service.

Lets have a quick look at the new features of SCCM 1602 :

Now, let me brief each of these new feature under each category.

1) Site Infrastructure

a) In-place upgrade the operating system of site servers that run Windows Server 2008 R2:

This is cool feature. If you have SCCM 1602 or later version, you can upgrade the Site Server Operating System Version. If your site server is running with Windows Server 2008 R2, then you can easily upgrade the OS to Windows 2012 R2.

However you have uninstall WSUS 3.2 before you upgrade the OS to Windows Server 2012 R2 from SCCM 1602 console.

Please follow these official links from Microsoft before you proceed:

Windows Server Update Services Overview : https://technet.microsoft.com/library/hh852345.aspx
Upgrade Options for Windows Server 2012 R2 : https://technet.microsoft.com/library/dn303416.aspx

b) SQL Server AlwaysOn availability groups :

We can use SQL Server AlwaysOn Availability Groups to host the site database at primary sites and the central administration site as a high-availability and disaster-recovery solution. The availability group can be hosted on-premises or in Microsoft Azure.

2) Operating system deployment

There are new added features in Windows 10 servicing

Read More