System Center Configuration Manager 2007 : Creating and Modifying Configurations (part 1)

Customizing configuration baselines and items may be a full-time task, depending on the role set for DCM in an organization. The toolset included with ConfigMgr 2007 provides a rich environment for authoring these objects, although it is not the only way to author them. The following sections discuss how to go about authoring baselines and configuration items using the console as well as a few alternative methods.

1. Console Authoring

The main purpose of the ConfigMgr console in DCM is to organize, assign, create, and edit configuration baselines and configuration items. The built-in toolset for these last two activities—creating and editing—is fairly complete; it allows you to define a wide range of evaluation criteria covering most of the scenarios needed.

To create a new configuration item, navigate to Site Database -> Computer Management -> Desired Configuration Management -> Configuration Baselines in the ConfigMgr console navigation tree and then select New. This results in a flyout menu where you can select to create one of the three creatable types of configuration items. The resulting Configuration Item Creation Wizards for all these types are similar to each other; each has the pages listed in Table 1.

Here are descriptions of the wizards:

• Identification— On this page, you set the name of the configuration item and assign any desired categories.

• Detection Method— This page, specific to only application configuration items and shown in Figure 16.7, allows you to configure how the installation of an application is detected. There are three methods:

  • Assumption— When this method is selected, DCM simply assumes that the application is installed without a check. Choosing this option is essentially the equivalent of creating a general configuration item.

  • Windows Installer (MSI) Detection— This method uses the list of products installed by Windows Installer to determine if an application is installed. If an application was not installed using an MSI, this method is not applicable.

    Expected data for this method includes the Globally Unique Identifier (GUID) and the version number for the application. The easiest way to get this information is to click the Open button and select the MSI originally used to install the application. This automatically populates the fields. You can also instruct DCM that the installation was installed “per user” by checking the corresponding box shown in Figure 1. This check box is grayed out until you select Use Windows Installer (MSI) detection.

    Figure 1. Configuration Item Detection Method page

    

    Note: Manually Determining a Product’s GUID

    Although not always apparent, most software applications today are installed using an MSI. The MSIs are typically hidden inside of executables and are not directly accessible. During installation, the MSI is extracted from the executable to a temporary folder and then installed from that folder. The easiest way to determine the application’s GUID and version if the MSI is hidden in this way—or not readily available for any reason—is to use WMI, and the easiest way to query WMI is the WMI console (WMIC).

    WMIC is part of every Windows installation and invoked from the command line.

    Here’s an example of a WMIC command to query for the GUID and version of all Microsoft Live products:

    wmic product where "caption like '%Live%'" get name, IdentifyingNumber, version
    
    					  

    This command outputs the product name, GUID, and version for every product that has Live in its name.

    
    

  • Script—This method uses a custom script—VBScript, JScript, or PowerShell based—to detect the installation of an application. The script should return some text to indicate the successful detection of an installed application and no text to indicate failure. A simple example VBScript to detect the installation of the Internet Explorer Administration Kit 7 follows:

    folderPath = "C:\Program Files\Microsoft IEAK 7"
    Set fso = CreateObject("Scripting.FileSystemObject")
    If fso.FolderExists(folderPath) Then
    WScript.Echo "IEAK 7 Found"
    End If

  Note: Script Success

  Scripts used in DCM are considered to be successful if they output anything to the standard output—often referred to as StdOut. The exact contents of the output are not evaluated; it’s just that something is output. Conversely, if nothing is output, the script is considered unsuccessful.

  
  

• Objects— On this page, displayed in Figure 2, you choose which objects to evaluate for compliance on a system. To add a check for an object, click New at the bottom of the page (circled in the figure) and choose the type you would like to check for from the pop-up menu. 

  Figure 2. Configuration Item Objects page

  

• Settings— Shown in Figure 3, you choose which settings to evaluate for compliance on a system. To add a check for a setting, click New at the bottom of the page and choose which type you would like to check for from the pop-up menu. The “Settings” section discusses possible settings.

  Figure 3. Configuration Item Settings page

  

• Applicability— Only available on general and application configuration items, this page (displayed in Figure 4) sets the Windows platforms for which the configuration item is applicable. If the Windows version does not match, the configuration item is not evaluated. The list of Windows platforms includes all ConfigMgr-supported platforms and is broken down by version, service pack, and hardware platform. You can specify All Windows platforms, or use the list to select one or multiple platforms, making the configuration item applicable to specific Windows platforms.

  Figure 4. Configuration Item Applicability page

  

• Microsoft Windows Version— Shown in Figure 5, this page is only available to operating system configuration items, but is very similar in function to the Applicability page described in the previous bullet. The primary difference is you can only specify a single Windows version. You can choose a Windows version from the drop-down at the top of the page or explicitly define the Windows version using the text boxes. If you chose a version from the list box at the top, the text boxes for the version are automatically populated.

  Figure 5. Configuration Item Windows Version page

  

The primary evaluation criteria used in configuration items is defined using the Objects and Settings tabs. These are described in detail next.