http://blogs.technet.com/b/exchange/archive/2012/01/30/pst-time-to-walk-the-plank.aspx

It consists of two components that will be deployed separately: The ‘server’ component that will retrieve the scan lists and from where you will ‘manage’ the operations, and the client agent that will actually scan the computer to find the psts.

While the server installation is documented, the client agent, although pretty simple to install, is not and there is no built-in Push of the client from the Console.

There are two agent versions : one for 32bits, one for 64bits platform.

You can change the port being used by the agent when it communicates with the server host (by default it is port 6674). If you do so, do not forget to apply the change also when you install the server component. (to change the port, add the SERVICEPORT property to your command line)

On the other hand, you Need to define the Dns name of the Server component that the agent will communicate with. This is done via the CENTRALSERVICEHOST property.

Those Properties are available via Msi Transforms or by adding them to the command line.

The command would look like this:

32bits platform client:

Msiexec /i PSTCaptureAgent_x86.msi CENTRALSERVICEHOST=myhost.mydomain.com /!qb-

64bits platform client:

Msiexec /i PSTCaptureAgent.msi CENTRALSERVICEHOST=myhost.mydomain.com

Since there is no builtin detection of the platform by a separate setup that would install the correct client, you will need to deploy it via different collections or via a task sequence that would verify the type of Operating System for you.

Note that the 32bits version installs on 64bits OS, but the 64bits version should be installed on 64bits OS for better performance and would fail on 32bits OS.

In order to do this easilly, you create a task sequence with two ‘Install Application’ steps.

On the conditions tab, you verify that the following key exists:

HKEY_LOCAL_MACHINE\SOFTWARE\wow6432Node

If you are running a 64bits OS, this key will be present, otherwise not.

Finally one little remark that might save you some time: for the Host server, you should use a dedicated 64bits server (not an existing Exchange 2010 server) where you install the console and Outlook 2010 64bits.

After installing and configuring the product, deploying the certificates and downloading the catalogs from Adobe, I Published the updates to my Wsus server that is being used by SCCM.

However when trying to download the Adobe updates from the Sccm console,

it failed with error 502:

Since I could download Microsoft Updates from within the console, I checked the logs. You can find the Wsus sync logs for SCCM in your profile\Appdata in the file PatchDownloader.log

There i got more information, and was guided to potential problems with the Proxy settings.

I double checked the settings, and indeed it was there: although I had properly set the proxy, I had forgotten to add my local domains in the exception list for the proxy.

I added the domain where my Wsus server is to be found, and it worked without problem.

Note that you can use UpdDwnldCfg.exe to set the proxy information on the Sccm computer from the command line – the option ‘/Allusers’  will define the settings for all users, which looks like what you could do with Proxycfg.exe on Win2003 machines.

If you need to support Adobe, Sun, and other third party products and you use Sccm, do not forget to check SCUP 2011 as it is a very usefull tool. Too bad that Catalogs are only available from some vendors so far…

One of the features that catched my eye is Software Approval.

How it works :

When the user launches the Application Center (new silverlight based ’Run Advertised Program’), he gets the usual available programs for the machine.

But on the top of the page, the user can click on the link to the Application Catalog

By clicking on the link the user is redirected to the Application Catalog

The view is divided into three tabs:

The application catalog itself where administrators can publish available software (wether it is directly available for user install or can be requested for future install.

The ‘My application Requests’ tab lists the requests made by the user and the current state of approval

The ‘My Devices’ tab list the devices linked to the user (there are different ways to do this, one being to let the user decide if the current device is it’s primary one).

If the user requests a software that does not require approval, the software can be directly installed.

If on the other hand, the application requested has been marked as ‘Request Approval’ then the installation will not occur at once, but only when the approval process has been completed, and even in this case, the user will have to go back to the tab to install it, it won’t be automatic.

From the administrator’s point of view, this is a very convenient way of managing freely-available software (file viewers, optional software,etc), or to make users aware of the list of company approved software available.

Indeed, in the application catalog, you do not just find the default application display name but you can define software attributes and link to external content or your company web site for additional information.

You could for instance make different versions of a software suite available to the client, explaining the differences between the versions and the price tag, then let the user request the software but not install it directly. This guarantees that users don’t install non-approved software.

When the user wants to request the software he is prompted with additional information, basically the reason why he needs the application.

Note that the user can Cancel a request while approval is pending.

Behind the scenes

As soon as the user requests the application it will appear within the Sccm Console under Approval Requests. The administrator or any delegate with proper priviledges can approve the software request from the user (only) directly from the console.

All

Good, you think ? Think again! While in a small company a couple of persons could authorize software for everybody, imagine how you would manage hundreds of requests per week …

The issues:

The first thing that comes to mind is: ‘how am I going to notice that there is a software request from a user ? ‘. Indeed there is -afaik- no alerting based on new requests.

Once you notice the request, another problem is to contact the person in charge of the department or purchasing in order to confirm that the request can be fulfilled.

Finally, if the request is granted or rejected, there is no obvious way for the user to know it, except of checking his requests regularly from the client.

Finally, the view is not filtered by RBAC, so you don’t have a way to filter what software each approver will be able to approve based on collection membership.

Let’s try to improve the process…

While Sccm 2012 general availability should be announced at MMS 2012, in fact the whole System Center suite will get updated. (Scom, Scsm, Orchestrator, Scvmm…).

I decided to install Orchestrator 2012 in order to see if it could help with this kind of problem. Being presented as a Datacenter Automation tool, I guessed it would at least be able to solve this little problem

I don’t have much experience with Opalis/Orchestrator, I won’t go into details on how to install or configure the server. Just note that Orchestrator runs Actions that you define through runbooks. It is a kind or workflow for your enterprise management.

All data is here: the Database

The basic way of getting alerts when new requests are submitted would be to monitor the Sccm database for unfulfilled requests.

The table where the request are stored is v_UserAppRequests

Note that the requests have a state of 1 until they are accepted (the state then changes to 4; rejected requests get a state of 3)

In the same table, you get the requesting user, the computer on which the request has been done as well as the application name and request id.

That is what our first Orchestrator Query will monitor (you can schedule how frequently the query will run)

This query will return all requests that are neither approved nor rejected.

The second query will check if the user requesting the application is a primary user in User Device Affinity (this means that the person that needs to approve the software install will know if the target machine is the requestor’s primary computer or not)

The Sccm table that contains the information is vUsersPrimaryMachines (it contains only IDs, so we need to find also the user name linked to the ID.

Once we know what software has been requested, on which computer and by who, we just need to contact the right person for the approval.

In this example, I can send a message to both a fixed email address (Helpdesk for instance) and the Manager of the user if defined in Active Directory

We start with a  ‘.Net Action’: Powershell script

 you need to load the AD module of Powershell

get the name of the requestor that we got from the first db request

since the account is in the format domain\user, change it to a samaccountname format in order to query AD to find the Manager attribute of the user.

The script also queries the email address of the Manager (note: not visible up here)

Wrap it all together:

Finally a mail is sent with the appropriate information:

Since Orchestrator is very flexible, you can also open directly a call in your ticketing application so that a proper Itil based workflow is launched, and get back the result of the approval via the same path before updating the Sccm database and closing the ticket once the software is installed.

Note that SC Service Manager 2012 has native connectors to Orchestrator, Scom, Sccm and the level of automation for this kind of workflows is simply amazing.

(see link: http://technet.microsoft.com/en-us/edge/Video/ff711330)

Here is the layout that was requested:

                               App A Version    App B Version             App C Version            App D Version

Machine X                        6.0.5                   1.2                               1.0                                 2.8

Machine Y                         6.05                   1.0                                1.0                                2.6

Machine Z                         6.0.5                  1.1                             doesn’t exist                   2.8

This would of course be very usefull when dealing with groups of applications that would have to interact with each-other.

For example purpose, I will create a report that shows some Adobe products, which also means that some filters in the query would be different for other products.

Here is a query we can use for the base extract:

SELECT  Distinct ‘Product’=

Case

When b.displayname0 like ‘Adobe Acrobat%’ Then ‘Adobe Acrobat’

When b.displayname0 like ‘Adobe Photoshop%’ Then ‘Adobe Photoshop’

When b.displayname0 like ‘Adobe Dreamweaver%’ Then ‘Adobe Dreamweaver’

When b.displayname0 like ‘Adobe Framemaker%’ Then ‘Adobe Framemaker’

Else b.displayname0

End,

‘Version’ =

Case

when b.version0 like ’12%’ then ’12′

when b.version0 like ’3%’ then ’3′

when b.version0 like ’11%’ then ’11′

When b.version0 like ’10%’ then ’10′

When b.version0 like ’9%’ then ’9′

when b.version0 like ’8%’ then ’8′

when b.version0 like ’7%’ then ’7′

when b.version0 like ’006%’ then ’6′

when b.version0 like ’6%’ then ’6′

when b.version0 like ’5%’ then ’5′

when b.version0 like ’4%’ then ’4′

End,

‘Publisher’=

Case

When b.publisher0 like ‘Adobe%’ Then ‘Adobe Corporation’

End,

a.Netbios_Name0

FROM         v_R_System AS a INNER JOIN

v_Add_Remove_Programs AS b ON a.ResourceID = b.ResourceID INNER JOIN

v_FullCollectionMembership AS c ON a.ResourceID = c.ResourceID

WHERE

((b.displayname0 like ‘Adobe Acrobat%’) or (b.displayname0 like ‘Adobe Photoshop%’)

or (b.displayname0 like ‘Adobe Dreamweaver%’) or (b.displayname0 like ‘Adobe Framemaker%’))

And (b.version0 <> ’1.0′)

order by netbios_name0

When creating the report, we choose the Matrix format, and set The product for the Columns and the Netbios_Name0 for the rows, with Version in the details

Here is how it looks

In some other context, you might want to change the row colours based on conditions (If AppA version is lower than AppC version, then it’s unsupported > set background row colour to RED)

Since a lot of admins are now testing or moving to application virtualization, let’s have a look at how we can use the tool to ease our app-v repckaging process.

In order to install the Sap installation server, refer to the document on the SAP support site:

http://www.sdn.sap.com/irj/scn/index?rid=/library/uuid/80f043df-b655-2d10-e9a4-bba6967de101

[If you need a step by step, post a comment here and I will post one on this blog when I find the time]

I based the changes for App-v repackaging on the following blog post  from Nicke Kallen (Viridis IT)

http://www.viridisit.se/eng/blog/?p=782

Once your server is installed, launch NwSapSetupAdmin.exe from the /Sapgui720/admin/setup folder

Go to the Packages tab, and create a package that contains the components you want to deploy (in my case, I just took the same components that I deploy on the computers)

Then select the ‘Configure Packages’ tab. Here we can adjust the deployment so that it matches the requirements of an App-v package.

The important steps here are:

Define Q drive path for SapBiDestDir and SapFrontEndDir. You can adjust them by clicking Modify Parameters

DO NOT FORGET to press SAVE to apply the changes.

I choose the Q:\Sap7201 folder, this is where my client will be installed.

The next step is to customize the deployment itself via SapScript

You can define scripts that the installer will run before, during and after Install (or Update)

(This scripting environment is based on vbscript, so it might look familiar to some of you)

The first thing to do is to define our Sap/Common folder on the Q: drive. We will use this folder to copy over files at the end of the deployment.

Select On Begin Install (you could as well create the directory in the On End Install tab, just make sure it exists before we copy the files)

and define the location in the same way it is done up here.

Note that the common files folder should preferably be a subfolder of your SapFrontEndDir directory,

The first line of the script simply defines the path, the second one executes the change.

Now move to the On End Install tab

[Here is the script I use in this tab]

NwEngine.Shell.SetRegValue “HKLM\SOFTWARE\SAP\SAPsetup\SAPstart\AutoUpdate\SAPLogon.exe\UpdateMode”, “REG_SZ”, “ForceOff”
strSrcFile1  = NwEngine.Variables.ResolveString(“%WinDir%\System32\librfc32.dll”)
strSrcFile2  = NwEngine.Variables.ResolveString(“%WinDir%\System32\SAPbtmp.dll”)
strSrcFile3  = NwEngine.Variables.ResolveString(“%WinDir%\System32\icuin34.dll”)
strSrcFile4  = NwEngine.Variables.ResolveString(“%WinDir%\System32\libsapu16vc90.dll”)
strDstFile1  = “Q:\SAP7201\SAP\Common Files\librfc32.dll”
strDstFile2  = “Q:\SAP7201\SAP\Common Files\SAPbtmp.dll”
strDstFile3  = “Q:\SAP7201\SAP\Common Files\icuin34.dll”
strDstFile4  = “Q:\SAP7201\SAP\Common Files\libsapu16vc90.dll”
NwEngine.Shell.CopyFile strSrcFile1, strDstFile1
NwEngine.Shell.CopyFile strSrcFile2, strDstFile2
NwEngine.Shell.CopyFile strSrcFile3, strDstFile3
NwEngine.Shell.CopyFile strSrcFile4, strDstFile4

NwEngine.Shell.DeleteFile strSrcFile1
NwEngine.Shell.DeleteFile strSrcFile2
NwEngine.Shell.DeleteFile strSrcFile3
NwEngine.Shell.DeleteFile strSrcFile4

OrgRegValue = “HKLM\System\CurrentControlSet\Control\Session Manager\Environment\Path”
targetValue = “C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;Q:\SAP7201\SAP\Common Files”
NwEngine.Shell.SetRegValue OrgRegValue, “REG_EXPAND_SZ”, targetValue

A small explanation here:  the first line disables automatic updates, lines 2 to 13 copy files from System32 to our sap\common files folder that we created in the former step and then deletes them from the original location.

The last part of the script adds our Common files folder to the PATH variables.

Note that since I use a virtual machine, I just took the default PATH reg key and added my common files path to it. This makes it much more simple. However, If you install other apps that will be used by the Sap Client, your path might be different, so always check it before repackaging.

Our package is now ready. The only thing to do now is to launch the repackager and run our package installation. The command can be found in the Properties tab of the Package.

You can remove /silent from the command if you want to see the dialog boxes and confirm what package you want to install.

There are a couple of benefits to using these tools:

- the install of the client is now fully automated, you don’t have to double check that each point has been done

- we use the same sources and patch versions for normal installation and V-app package since the same server is being used

- The patching of the client is easier, you just patch the server, redeploy the client which is now up to date, and deploy the changes to the virtual clients.

Note that I did not use this in production yet, so take usual precautions, this is only an example of what can be done.

Please post comments as your feedback is the best way to improve the information.

Let’s open a Project from the Application Conversion Wizard…

Let’s choose where our packages reside.

If you are repackaging a lot of applications, chances are that those are managed by SCCM

or at least that the sources have been consolidated in the same network location.

Since I use Sccm, this will be my choice.

After providing the connection data, the tool will query your SCCM server and return all packages that were found.

This includes all application formats. [Note that this might take a bit of time]

Now all you need to do is select the applications you want the tool to convert.

As was the case for basic conversion I can now define the virtual machines that can be used for conversion.

Note that you can use more than one VM at a time to make the process quicker.

You can then customize the default App-V package options that will be used as default and per specific application.

Once done, the whole process should run unattended, reporting in real time what is going on.

I did not test the program in production due to lack of resources but it looks very powerfull when used in combination with Sccm

since you keep the paths, application commands, etc.

Note that you will need the Enterprise version of Adminstudio (and the additional Virtualization pack) to use this functionality.

Flexera posted a webcast demo of the tool on their site (needs registration):

How to Automate Application Repackaging and Conversion to Virtual Formats with AdminStudio

You can also download a trial version that will allow you to test most of the functionality.

Indeed, while a lot of companies have been standardizing on Msi packages, this won’t be of much help now you are moving to a completely different packaging method. Of course, if you followed recommendations and have documented the install process for each setup that you rebuilt as Msi, this information will be very usefull. But wouldn’t it be nice if you could just take those Msi and convert them to App-v packages ?

That would be very nice indeed. And that is exactly what the Adminstudio Automated Application converter(s) are supposed to do for you (with a little help from you of course).

For those of you who have spent some of their time in the last ten years repackaging applications, it is very probable that you worked or at least heard about Adminstudio (Formerly Installshield, Macrovision, and now Flexera Software). For the others, let’s say that it is a suite of tools that allow to build Msi packages from other formats via snapshots or installation monitoring, very similar to what the Sequencer does for App-v.

Before I go further, some remarks. I have no link to Flexera software, except as a customer for several years now. One other important point is that the solution has a cost. You would need to buy a license for Adminstudio* and an additional license for the ‘Virtualization pack’. Note that the limited editions available for free if you already have a Sccm license won’t work for this. Last warning: the option to create an Msi to install the app-v package offline is not available in the evaluation version.

Fine, so how does it work ? Let’s start with a basic Msi package.

Open Installshield, and open your Msi package (I took Adobe Acrobat Reader X as an example),

Select Application Conversion Wizard

.

Choose the type of virtual application you would like to create (note the different choices below, with the first one being the Msi

‘wrapper’ that allows to deploy your app-v packages, not a standard Msi output)

For Msi sources, the program is able to repackage to App-v without having to install the application.

For other types of sources (setup.exe, etc), the repackager will use a virtual machine to install the package

like you would do manually with the Sequencer. The operation of the VM is done via scripting through the corresponding APIs.

For this Msi we won’t use a Virtual machine.

Next step is to define the platforms that you want the package to run on.

[Note: For those who have used the Command line sequencer, those settings (Platforms, compression, etc) are properly kept]

You have the option to change files and shortcuts and registry settings, as well as define mst files to apply.

You can define here Dynamic Suite Composition Dependencies.

The Build process now simulates the Msi install and creates an App-v package from it.

The report logs include potential problems with the package.

One thing to be aware of, is that the current release (Adminstudio 10) is based on App-v Client 4.5, not the latest 4.6 client.

That’s it for the ’basic’ conversion of Msi packages with Installshield / Adminstudio (needs at least Standard Professional version 10 + Virtualization Pack). As you can see, for some packages it might make you win quite a bit of time, but if you have already repackaged to App-v, you know that most probably this Adobe Reader App-v package will have to be edited before it deploys and works properly. You can now edit App-v packages directly in the console.

Ok, now I hear you say <’So what’s the big deal about this Virtualization Pack ? Didn’t you talk about “Automated conversion” ?>

That’s right, what I have shown so far is not very different from the Sequencer, except for the fact that you won’t need to install the Msi.

If you already use Adminstudio in your enterprise. you might want to not only repackage third party apps to App-v but also generate App-v packages

for your in-house developped applications and Installshield can also help here.

But for the Automated Conversion part, you will have to wait… well not for the next version of Adminstudio,  just for the next post

As you map this in your environment you sometimes will end up with a separate main OU for users / computers and Sub-OUs that are exactly similar to your previous implemenation:

Note that when you do this Sccm will not scan the sub-folders.

see http://support.microsoft.com/kb/983514/en-us

Extract: <

Consider the following scenario:

• You enable the Active Directory System Discovery method or the
  Active Directory User Discovery method on a System Center Configuration
  Manager 2007 Service Pack 2 (SP2) site server.
• You add the paths of some organizational unit (OU) to the Active Directory
  containers list. The Recursive search option is
  enabled.
• Some OUs that are in the container list and some related child OUs share the
  same common name (CN).

In this scenario, some of these OUs that share
the same CN are not discovered when the Active Directory System Discovery
method or the Active Directory User Discovery method runs.

For
example, the following OUs are added to the Active Directory containers list.

• OU1
• TestOU1
• OU2

The “OU1″ OU has the following child OUs:

• TestOU1
• TestOU4
• TestOU5

The “OU2″ OU has the following child OUs:

• TestOU1
• TestOU6

In this example, the “TestOU1″ OU occurs three times.
However, only one “TestOU1″ OU is discovered when the Active Directory System
Discovery method or the Active Directory User Discovery method runs.

>

One way to effectively check you don’t have the problem is to open the Ad*dis.log files and look for entries starting with !!!!Valid AD container

Compare that to what you have configured in your Discovery Methods. It should match. If it does not, apply the hotfix and you will see that it solves the problem and missing entries will appear at next discovery.

Sometimes however Windows 7 does not work exactly the same way as previous versions, and enabling a GPO can have unexpected side effects:

‘Turn off all balloon notifications’ is supposed to mask annoying -or at least distracting- notifications from the user.

While it works as expected, a side effect is that you won’t get Prompted to change your password before it expires ! (or more precisely, you won’t be able to see the notification as it’s disabled)

One alternative is to re-enable the setting, and select Turn off feature advertisement balloon notifications to limit the number of notifications.

Now that the base report is ready, a few changes to the code will bring us a same kind of report for MS products…