Package

Name The name of the package, up to 50 characters. This entry is required.
Version The version of the package, up to 32 characters. This entry is optional.
Publisher The publisher of the package, up to 32 characters. This entry is required.
Language The language version of the package, up to 32 characters. This entry is required.
Comment An optional comment about the package, up to 127 characters.

Program

Name The name of the program, up to 50 characters. This entry must be unique within a package and is used when defining advertisements. This entry is required.
Comment An optional comment about the program, up to 127 characters.
CommandLine Specifies the command line for the program, up to 127 characters. This entry is required.
StartIn The working folder for the program, up to 127 characters. This entry is optional.
AdditionalProgramRequirements Optional text that can include any other information or requirements for client computers, up to 127 characters.

Advertisements

Name Specifies the name of the advertisement, up to 100 characters. This field is required.
Comment Specifies optional text about the advertisement, such as a description. You can use up to 127 characters.

Collections

Name Specifies the name of the collection, up to a total of 127 characters. This field is required and must be unique within the Collections node.
Comment An optional comment about the package, up to 127 characters

Folders

Valid folder names are up to 127 characters and must not contain any of the following characters / | \ : * ” < >

You see error -2146232060 when attempting to configure your ACT database using the following steps:

1. In the Configuration Manager console, navigate to
   System Center Configuration Manager / Site Database / Computer Management / Application Compatibility Toolkit Connector/ Application Compatibility Toolkit Server
2. To open the properties of the ACT server right-click the ACT server in the results pane and select Properties. Alternatively you can select Configure ACT Server in the Actions pane or click the Actions menu and select Configure ACT Server.
3. To specify the Microsoft SQL server that contains the ACT database type the name of the server and click the Connect button. Alternatively, you can click the drop down and select Browse for more to open the Select Server dialog box. Select the server you want to use and click OK.
4. Specify the ACT Database to connect to using the drop down and selecting the database.
5. To close the ACT Configuration properties dialog box, click OK.

configure act server properties

At this point you receive the following error:

Check Connection

Cannot connect to COMPUTERNAME.

[-2146232060] Windows NT user or group ‘DOMAIN\ COMPUTERNAME$’ not found. Check the name again.

‘DOMAIN\ COMPUTERNAME $’ is not a valid login or you do not have permission.

check connection -2146232060

Microsoft will not be releasing a fix but the following modified script can be used to configure ACT connector to work with ACT 5.5 install, just change XXXX in the script as per the comments.

Server = "XXXXXX"    '<- Name of ConfigMgr server where ACT Connector is installed
SiteCode = "XXX"    '<- Three letter side code of ConfigMgr server where ACT Connector is installed
ActServer = "XXXXXX"    '<- Name of SQL server where ACT is installed
ActDatabase = "XXXX"    '<- Name of ACT database on SQL server (set during ACT install)
MachineAcct = ""    '<- Machine Account (Optional parameter)!  If the ACT is installed on different
'   server than the ACT Connector, then provide the machine account name the ACTC
'    provider runs under (domain\machineaccount$) where the machine account name is
'    the ConfigMgr server where the ACT Connector is installed.

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & Server & "\root\sms\site_" & SiteCode)
Set wbemObjectSet = objWMIService.InstancesOf("SMS_ActConfig")

'domain\smsserver$
If LCase(Server) = LCase(ActServer) Then
MachineAcct = ""
End If

For Each wbemObject In wbemObjectSet
wbemObject.Server = ActServer
wbemObject.Database = ActDatabase
wbemObject.Put_
If MachineAcct = "" Then
wbemObject.AddLinkedServer ActServer, ActDatabase
Else
wbemObject.AddLinkedServer ActServer, ActDatabase, MachineAcct
End If
Next

If Err.Number = 0 Then
msgbox "Success"
Else
msgbox "Failure " & Err.Number
End If

The original script can be found here Support for ACT 5.5 with the ACT Connector

Service Pack 2 for Configuration Manager 2007 delivers new platform support for Windows 7, Windows Vista SP2, Windows Server 2008 R2 and Windows Server 2008 SP2.

After installing SP2 you will need to create collections for Windows 7, Server 2008 R2 and possibly Windows Vista and Server 2008 if you have not already done so, I used the following script to create 4 new collections:

Click View Source to view\copy script

The script does not check for existing collections and I have only used it in a test environment so use at your own risk.

' Modified CreateDynamicCollection script from SCCM SDK.
' winDeploy 2009
Set swbemLocator=CreateObject("WbemScripting.SWbemLocator")
Set swbemconnection=swbemLocator.ConnectServer(".", "root\sms")
Set providerLoc=swbemconnection.InstancesOf("SMS_ProviderLocation")

For Each Location In providerLoc
    If location.ProviderForLocalSite = True Then
        Set swbemconnection = swbemLocator.ConnectServer(Location.Machine, "root\sms\site_" + Location.SiteCode)
        Exit For
    End If
Next

Call CreateCollection(swbemconnection, "All Windows Vista Systems", "select sms_r_system.ResourceID,sms_r_system.ResourceType,sms_r_system.Name,sms_r_system.SMSUniqueIdentifier,sms_r_system.ResourceDomainORWorkgroup,sms_r_system.Client from sms_r_system where OperatingSystemNameandVersion like '%Workstation 6.0%'")
Call CreateCollection(swbemconnection, "All Windows 7 Systems", "select sms_r_system.ResourceID,sms_r_system.ResourceType,sms_r_system.Name,sms_r_system.SMSUniqueIdentifier,sms_r_system.ResourceDomainORWorkgroup,sms_r_system.Client from sms_r_system where OperatingSystemNameandVersion like '%Workstation 6.1%'")
Call CreateCollection(swbemconnection, "All Windows Server 2008 Systems", "select sms_r_system.ResourceID,sms_r_system.ResourceType,sms_r_system.Name,sms_r_system.SMSUniqueIdentifier,sms_r_system.ResourceDomainORWorkgroup,sms_r_system.Client from sms_r_system where OperatingSystemNameandVersion like '%Server 6.0%'")
Call CreateCollection(swbemconnection, "All Windows Server 2008 R2 Systems", "select sms_r_system.ResourceID,sms_r_system.ResourceType,sms_r_system.Name,sms_r_system.SMSUniqueIdentifier,sms_r_system.ResourceDomainORWorkgroup,sms_r_system.Client from sms_r_system where OperatingSystemNameandVersion like '%Server 6.1%'")

Sub CreateCollection(connection, newName, queryForRule)
	'Update this collection on a schedule.
	Set Token = swbemconnection.Get("Sms_St_RecurInterval")
	Token.DaySpan = 1 'Use Token.HourSpan = 1 or for Token.MinuteSpan = 30 for test environment
	Token.StartTime = GetStartTime()

    ' Create the collection.
    Set newCollection = connection.Get("SMS_Collection").SpawnInstance_
    newCollection.Name = newName
	newCollection.Comment = newName + "."
    newCollection.OwnedByThisSite = true
	newCollection.RefreshSchedule = Array(Token)
	newCollection.RefreshType = 2

    ' Save the new collection and save the collection path for later.
    Set collectionPath = newCollection.Put_    

   ' IMPORTANT: If you do not specify the relationship, the new collection will not be visible in the console.
    Set newSubCollectToSubCollect = connection.Get("SMS_CollectToSubCollect").SpawnInstance_
    newSubCollectToSubCollect.parentCollectionID = "COLLROOT" ' Define to what collection the new collection is subordinate.
    newSubCollectToSubCollect.subCollectionID = CStr(collectionPath.Keys("CollectionID"))
    newSubCollectToSubCollect.Put_  ' Save the subcollection information.

    ' Create a new collection rule object for validation.
    Set queryRule = connection.Get("SMS_CollectionRuleQuery")
    validQuery = queryRule.ValidateQuery(queryForRule)   ' Validate the query (good practice before adding it to the collection). 

    ' Continue with processing, if the query is valid.
    If validQuery Then
        ' Create the query rule.
        Set newQueryRule = QueryRule.SpawnInstance_
        newQueryRule.QueryExpression = queryForRule
        newQueryRule.RuleName = newName + "." 

        ' Add the new query rule to a variable.
        Set newCollectionRule = newQueryRule

        ' Get the collection.
        Set newCollection = connection.Get(collectionPath.RelPath)
        newCollection.AddMembershipRule newCollectionRule ' Add the rules to the collection.
        newCollection.RequestRefresh False ' Call RequestRefresh to initiate the collection evaluator.
	  Else
	    MsgBox("Invalid Query: " + queryForRule)
     End If
End Sub

Function GetStartTime()
  Set objSWbemServices = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
  Set colTimeZone = objSWbemServices.ExecQuery ("SELECT * FROM Win32_TimeZone")

  For Each objTimeZone in colTimeZone
   strBias = objTimeZone.Bias
  Next

  dtmCurrentDate = Date
  GetStartTime = Year(dtmCurrentDate)

  dtmMonth = Month(dtmCurrentDate)
  If Len(dtmMonth) = 1 Then
   dtmMonth = "0" & dtmMonth
  End If

  GetStartTime = GetStartTime & dtmMonth

  dtmDay = Day(dtmCurrentDate)
  If Len(dtmDay) = 1 Then
   dtmDay = "0" & dtmDay
  End If

  If Len(Hour(Now())) = 1 Then
   Hours = "0" & Hour(Now())
  Else
   Hours = Hour(Now())
  End If

  If Len(Minute(Now())) = 1 Then
   Minutes = "0" & Minute(Now())
  Else
   Minutes = Minute(Now())
  End If

  GetStartTime = GetStartTime & dtmDay & Hours & Minutes & "00.00000"
  GetStartTime = GetStartTime & Cstr(strBias)
  GetStartTime = GetStartTime & "+***"
End Function

Had a blue screen of death and wondered which driver caused the error before you had chance to write down the stop code and parameters?

Normally I would load up the dump file in the Debugging Tools for Windows to find the culprit until I found this great utility by NirSoft called BlueScreenView.

It scans your minidump files and displays the time of the crash, the basic crash information and the details of the driver that caused the crash.

Download BlueScreenView

Logon on to a virtual Machine and insert integration service setup disk.
If you do not have a virtual machine up and running you can mount %windir%\system32\vmguest.iso

Extract the drivers by performing an admin install on the msi packages.

msiexec /a d:\support\amd64\Windows5.x-HyperVIntegrationServices-x64.msi TARGETDIR=C:\AIPx64
msiexec /a d:\support\x86\Windows5.x-HyperVIntegrationServices-x86.msi TARGETDIR=C:\AIPx86

rename C:\AIPx64\Hyper-V Integration Services C:\AIPx86\ Hyper-V_x64
rename C:\AIPx86\Hyper-V Integration Services C:\AIPx86\Hyper-V_x86

Copy Hyper-V_x64 and Hyper-V_x64 to your driver folder and you should end up with the following drivers and folder structure:

Hyper-V drivers directory

Disk Virtual Machine Bus Acceleration Filter Driver
Hyper-V Heartbeat
Microsoft Emulated S3 Device Cap
Microsoft Virtual Machine Bus Input Device Miniport
Microsoft Virtual Machine Bus Network Adapter Net
Microsoft Virtual Machine Bus Video Device
Storage miniport driver SCSI Adapter
Virtual Machine Bus

Network Level Authentication is an authentication method that can be used to enhance Remote Desktop Services Session Host server security by requiring that the user be authenticated to the RD Session Host server before a session is created.

Remote Desktop Connection

Network Level Authentication completes user authentication before you establish a remote desktop connection and the logon screen appears. This is a more secure authentication method that can help protect the remote computer from malicious users and malicious software.

Network Level Authentication will disconnect XP SP3 Remote Desktop Connection with the following error message

The remote computer requires Network Level Authentication, which your computer does not support.For assistance, contact your administrator to technical support.

Remote Desktop Disconnected

To enable Network Level Authentication on a XP SP3 client some registry settings must added which can be found in KB951608

The registry settings were tested using the Registration Entries (.reg) file below.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Security Packages"=hex(7):6b,00,65,00,72,00,62,00,65,00,72,00,6f,00,73,00,00,\
00,6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,73,00,63,00,68,00,61,00,6e,00,\
6e,00,65,00,6c,00,00,00,77,00,64,00,69,00,67,00,65,00,73,00,74,00,00,00,74,\
00,73,00,70,00,6b,00,67,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders]
"SecurityProviders"="credssp.dll"

So after adding the registry settings and rebooting the workstation the following error message may appear if you connect to the Remote Desktop Services Session Host using an IP address, the error should not appear if you use the hostname of the remote computer.

An authentication error has occurred (0×80090303)

Remote Computer: 172.16.0.100

Remote Desktop Connection 0x80090303

To fix this you need to download and install KB953760 which updates the following files

Once WindowsXP-KB953760-x86-ENU has been installed and files updated you can access the Remote Desktop Services session using an IP address.

Internal Consistency Evaluators

Internal consistency evaluators also called ICE’s are custom actions written in VBScript, JScript or as a DLL or EXE. When these custom actions are executed, they scan the database for entries in database records that are valid when examined individually but that may cause incorrect behavior in the context of the whole database.

On basic level ICE01 to 105 are a set of predefined rules created by Microsoft to confirm the contents, logic and structure of Windows Installer package (MSI).

The table below also includes the recent additions ICE101 to ICE105 which were introduced with Windows Installer 5.0

ICE Reference Table

MSDN – Package Validation

Example of Creating an Internal Consistency Evaluator (ICE) using Orca

Whilst the ICE list is pretty comprehensive there will be a point where you need to validate information that is not covered by the standard ICE unit tests, to do this you will need to add your own Internal Consistency Evaluator.

Here is an example of creating a vbscript Internal Consistency Evaluator wdICE01 to check that no hard coded paths (c :\) have been entered into the Registry table, wdICE01.vbs will be used to populate necessary tables in darice.cub

1.       Append the .ibd file extension to your vbscript                  example: wdICE01.vbs.ibd

2.       Using Orca, Open C:\Program Files\orca\darice.cub

3.       Select Binary table and add new row (CTRL & R).

Binary Table add new row

Enter Name of VBScript in name field.

Enter the path to the location of ibd file into the Data field (or Browse…) and click OK to add new row.

4.       Select CustomAction table and add new row

Custom Action table add new row

Enter ICE name into Action field

Enter Type into Type field (see table below)

Enter VBScript into Source field

Enter ICE name into Target field and click OK to add new row.

5.       Select _ICESequence table and add new row

_ICESequence table add new row

Enter ICE into Action field
Leave Condition empty

Enter sequence number into Sequence field and click OK to add new row.

Its a good idea to use a sequence number is greater than 1000 as not to interfere with built-in ICE sequences.

Save darice.cub (CTRL & L)

6.       Open MSI package and Validation Output (CTRL & L)

Validation Output Window

Click Go (ALT & G)

When validation has completed results are displayed, Click Close

The Table Error symbol |appears to the left hand-side of Tables containing ICE messages

Orca ICE Validation Window

The validation pane lists Warning and Errors found when the validation has been run and can be used to quickly change the table list window and table view focus highlighting the location of a specific validation error.

Example

Here is an example vbscript if you want to try it out

Function wdICE02()
On Error Resume Next

	Set recInfo=Installer.CreateRecord(1)
	If Err <> 0 Then
		wdICE02 = 1
		Exit Function
	End If

	'Give description of test
	recInfo.StringData(0)="wdICE02" & vbTab & "3" & vbTab & "wdICE02 - Performs a non case sensitive search for C:\ hard coded into the IniFile table  "
	Message &h03000000, recInfo

	'Give creation data
	recInfo.StringData(0)="wdICE02" & vbTab & "3" & vbTab & "Created 23/03/07. Last Modified 23/03/07."
	Message &h03000000, recInfo

	'Is there a IniFile table in the database?
	iStat = Database.TablePersistent("IniFile")
	If 1 <> iStat Then
		recInfo.StringData(0)="wdICE02" & vbTab & "3" & vbTab & "'IniFile' table missing, wdICE02 cannot continue its validation."
		Message &h03000000, recInfo
		wdICE02 = 1
		Exit Function
	End If

	'process table
	'					[1]	   [2]	    [3]	    [4]
	Set View = Database.OpenView("SELECT `IniFile`,`FileName`,`Key`,`Value` FROM `IniFile`")
	view.Execute

	If Err <> 0 Then
		recInfo.StringData(0)="wdICE02" & vbTab & "0" & vbTab & "view.Execute_1 API Error"
		Message &h03000000, recInfo
		wdICE02=1
		Exit Function
	End If 

	Do
		Set rec=view.Fetch
		If rec Is Nothing Then Exit Do

		'check for hardcoded string.
		If InStr(1,rec.StringData(4),"c:\",1) > 0 Then
			'Name of ICE  Message Type  Description  Help URL or location  Table Name  Column Name  Primary Key  Primary Key  Primary Key
			'(repeat for as many primary keys as needed)                  	http://msdn2.microsoft.com/en-us/library/aa369205.aspx
			rec.StringData(0)="wdICE02" & vbTab & "2" & vbTab &  "Path [4] is hard coded in [3] key within [2]" & vbTab & "" & vbTab & "IniFile" & vbTab & "IniFile" & vbTab & "[1]"
			Message &h03000000,rec
		End If
	Loop

	'Return iesSuccess
	wdICE02 = 1
	Exit Function
End Function

How to prevent users from connecting USB storage devices

To stop users connecting USB storage devices

The following items must be carried out to ensure that the USB storage driver
cannot be accessed, in cases where the USB storage driver has been installed the
services should be disabled.

• Deny Access to usbstor.inf and usbstor.pnf
• Disable the USB storage service

1.Deny Access to usbstor.inf and usbstor.pnf

Open the Group Policy Object and drill down to File System

Computer Configuration -> Windows Settings -> Security Settings -> File System

Right click and select Add File…
Enter %SystemRoot%\inf\usbstor.inf
Click OK

Assign the Deny permissions to Authenticated Users and System

Click OK
Click Yes
Click OK

Carry out same procedure for %SystemRoot%\inf\usbstor.pnf

2.Disable the USB Storage Service

The Start Dword value must be set to 00000004 (disable) in the registry

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbstore]
"Start"=dword:00000004

To disable this service using Group Policy create an adm template.

Copy the following section into a text editor and save the file as usbstore.adm

CLASS MACHINE
  CATEGORY  !!CATUSBManagement
     POLICY !!POLUSBManagement
        EXPLAIN !!POLUSBManagement_Help
          KEYNAME "System\CurrentControlSet\Services\usbstor"
             PART !!Part00 DROPDOWNLIST
                VALUENAME "Start"
              ITEMLIST
            NAME !!Name00 VALUE NUMERIC 0
         NAME !!Name01 VALUE NUMERIC 1
       NAME !!Name02 VALUE NUMERIC 2
      NAME !!Name03 VALUE NUMERIC 3
     NAME !!Name04 VALUE NUMERIC 4 DEFAULT
    END ITEMLIST
   END PART
  END POLICY
 END CATEGORY

 [strings]
 CATUSBManagement="USB Management"
 POLUSBManagement="USB Storage Service"
 POLUSBManagement_Help="Enables the changing of the startup type for the USB Storage Service.\nDisabled should be selected from startup type.\n\nYou should also set permissons on following files:\n\n%SystemRoot%\Inf\Usbstor.pnf\n%SystemRoot%\Inf\Usbstor.pnf"
 Part00="Startup type"
 Name00="Boot"
 Name01="System"
 Name02="Auto Load"
 Name03="Load On Demand"
 Name04="Disabled"

As this isn’t quite as simple as setting a Group Policy more instructions are included below, detailing how to load adm template using the Group Policy snap-in.

Add Administrative Template usbstore.adm

Open the Group Policy object that you want to edit.

Console tree, Administrative Templates

In the console tree, right-click Administrative Templates
Click Add/Remove Templates

Add/Remove Templates dialog

Click Add

Browse to template

Browse to .adm template and open, Click Close

The adm preference template is added

If you can see the policy\preference skip next two screens, if you see:
“There are no items to show in this view”

Filtering Menu

Right click in left pane
Select
View
Select Filtering…

Remove Filtering

Deselect\Untick
Only show policy settings that can be fully managed

Preference Preview

Double click the policy\preference, in this case USB Storage Service

Enable Preference

Select Enabled
Select startup type: Disabled
Click Apply\OK

This is a preference rather than a group policy so it will tattoo the registry:

This registry setting is not stored in a policies key and is thus considered a preference. Therefore if the Group Policy Object that implements the setting is ever removed, this setting will remain

A copy of the template used to disable usbstore service can be found here: disable usbstore adm

Adapted from KB823732 KB555324

MSI2SMS tool imports MSI and MST packages into Systems Management Server 2003 creating Package, Programs, Advertisement and desired settings without the need to use SMS console, the information is extracted directly from the MSI Package.

The MSI2SMS import tool not only saves time and effort it also ensures that a standard naming convention is used for Package, Programs and Advertisement throughout Systems Management Server 2003.