Latest Entries »


Sorry for the lack of new content lately.  My work life has been swamped since the middle of March with an acquisition, machine configurations, domain migration, etc.  This summer so far has flown by, I can’t believe we’re already halfway through July, last I knew it was June 1st!  I’ll try to post as much as I can, when I can, but along with this acquisition, I’ll be starting to move more towards SCCM and not so much SCE.  With the experience I’ve had with SCE it’ll always be permanently embedded in my brain, so I can still help if you’re having trouble.  As always, if you have questions, feel free to post!!!



Security bulletin indicates SP1 is being released to wsus this coming patch Tuesday!!

Microsoft released Service Pack 1 for Windows 7 yesterday.  It’s currently available to everyone via Windows Update.  I’m still waiting (impatiently, at that) for it to be released for wsus deployment.  You can download different varieties from here.  For you early adopters like myself, to start deploying it to your users, run the applicable exe with supported switches.


All switches are listed below

Options Description
/forcerestart If a restart is required, this option forces any open applications or documents to close.
/nodialog Suppresses the success or failure dialog box at the end of the installation.
/norestart Does not restart the computer after the installation is complete, even if a restart is required to complete the installation. You should use this option in conjunction with the /quiet option.
/promptrestart If a restart is required, a dialog box notifies the user that a restart is required to complete Setup. You should use this option in conjunction with the /quiet option.
/quiet Runs the installation in quiet mode. This mode shows no user interface during the installation of the updates. This is the same as unattended mode, except that the user interface is hidden. No prompts will appear during the installation process except the success or failure dialog box at the end of the installation. To suppress this dialog box, you must also specify the /nodialog option.
/unattend Installs the service pack in unattended mode. Only critical error prompts and a progress bar will appear during the installation. For example, Microsoft Software License Terms is not shown, and the computer will be automatically restarted.
/warnrestart[:<seconds>] If a restart is required, a dialog box notifies the user that the computer will restart in the specified number of seconds. The user can either cancel the restart or restart the computer immediately. The default setting for the automatic restart is 30 seconds.
/wsus Returns a failure code if the previous installation attempt failed. This option is needed only when you are deploying SP1 in a Windows Server Update Services (WSUS), SMS, or System Center Configuration Manager environment, or in any non-Microsoft product that uses the Windows Update Agent to report installation success.
/? or /help Displays command usage.

so for example you want a silent install with a reboot at the end:  windows6.1-kb976932-x64.exe /quiet /nodialog /forcerestart

Happy updating!



This is going to follow alot of the stuff already described in a previous post I made, I’m just going to update it with some tweaks for the latest version of Adobe Reader.  This assumes you have the Adobe Customization Wizard X installed.  If not, download it.  It’s version specific, so the Customization Wizard 9 will not work with this version.

First download Adobe Reader X from

Then extract the installation files from the exe.  The path indicates I put the downloaded exe file in c:.   The command is c:\adberdr1001_en_us.exe -nos_o”c:\readerx” -nos_ne  This runs the installer to extract the files but not actually install the program.  The files are now in c:\readerx.  Note: there is a space between .exe and -nos_o, but no space between -nos_o and “c:\readerx”, then another space between “c:\readerx” and -nos_ne.

Now that you have your files, open the msi in the customization wizard and go through the options to customize the installation the way you want.  Don’t panic that it claims the installer will remove old versions of reader and acrobat, it only removes old versions of reader and doesn’t touch acrobat, the way we want it.  Once you have the install the way you want, generate a transform from within the wizard and save it with all your other install files in c:\readerx

Copy this entire folder to a network share and go into SCE and create a new package. You’ll need to specify that you want files and folders, and not just the setup file, so the second option.  Select your readerx folder on the network share, then the acroread.msi file.

When it asks for installation parameters you’ll put in:  TRANSFORMS=”\\server\sharename\<yourmstfilename>.mst”  The installer is inherently silent and you specify this option in the customization wizard.  So /qn is not needed, in fact, it’ll error out if you put this in.  So if you want to try it before you deploy it, I’ll give you my command line so you can see what the whole thing looks like.  c:\windows\system32\msiexec.exe /i \\server\share\acroread.msi TRANSFORMS=”\\server\share\acroread.mst” /qn  – note this is the command line, DONT put this is sce and expect it to run.

There you have it!  The installer will remove old versions of Reader, leave Acrobat alone, install Reader X, and you’ll sleep a little better!  There are more advanced options for configuring update behavior, icon management, and locking down certain security options, but that’s a case-by-case basis and I won’t post that here, it you want to do this, let me know, I’ll help you as best I can.


I’m going to copy and paste most of this from the SCE Forums on TechNet.   I normally wouldn’t post isolated instances of problems, but when I was helping this other person, I found that his conditions existed in my environment as well, so it could very well be the case for everyone.

Issue #1:

When we discover systems in our domain, clients that are located in our Administrative office (same location as the SCE server) are contacted by SCE and we can see the installed software, number of hard drives, etc.  Systems that are not in our Administrative office (remote sites, same domain) are displayed, but do not have software inventory and lists zero hard drives.

If I log into the remote site systems, configure Windows Update to automatically update the system, and perform “Check for Updates”, within a few minutes SCE will start displaying information about that remote system.  If I don’t go through these steps, SCE will not display the number of hard drives or the installed software, etc.

Questions – Is this an issue with WSUS? Once these clients are talking to SCE, will they truly continue to communicate and receive updates from the SCE server?  Is there something we can do to correct this behavior before we discover any more clients?

Issue #2:

In the Computers workspace, on the All Windows Computers pane, if I double click on a client system (Win 7) I can view the CPU performance, but there are no performance counters available to view under Processor Queue Length or Memory Usage.  On servers, I see performance counters for CPU, Processor Queue Length and Memory Usage.

Questions – Similar to Issue #1, is this a WSUS issue?  Is there something I need to configure to collect or view the Processor Queue Length and Memory Usage data for the client systems, or is this data not available?

Issue #3:

In the Monitoring workspace, if I expand the Microsoft Windows Client tree and look under Performance, Windows Client OS Performance, there are no performance counters that can be selected/viewed under any of the options (Disk Capacity, Disk Performance, Disk Utilization, Memory Utilization (Page File), Memory Utilization (Physical), Network Adapter Utilization or Processor Performance).

Under the Microsoft Windows Server | Performance, there are performance counters for Disk Capacity, Memory Utilization (Page File), Network Adapter Utilization [Bytes Total/Sec] and Processor Performance.  There are NO performance counters for Disk Performance, Disk Utilization, Memory Utilization (Physical) and Network Adapter Utilization [Bytes Received/Sec and Bytes Sent/Sec].

My Reply:

Issue #1 probably isn’t related to an actual WSUS problem, but more of a wsus/client problem where the client more than likely hadn’t received the certificate generated from the installation, which is then relayed via group policy.

Issues# 2+3 – Keep in mind, the problem exists with Windows 7 clients (and presumably Vista as well).  XP Clients work fine

Looking at the performance counters for any random Win7 client, doesn’t display any graph data, but will show the counters for that particular client.  Checking the box next to the counter doesn’t change the display behavior within SCE.  When you right-click the counter and select properties, the target is “Windows XP Operating System”, which obviously doesn’t apply since as I mentioned this is a windows 7 box.  When I look at the same information for a windows xp box, graph data is displayed properly.  So I went into the Authoring pane and scoped my search to “windows xp client operating system” and “windows 7 client operating system”, most of the rules for xp are enabled, but windows 7 rules are disabled.  Find the windows 7 rule “System Processor Queue Length” and  “Memory Available Megabytes”, and do an override to enable them.  SCE will then notify you client of an enabled rule and modify the configuration to start gathering performance data.


It’s a matter of rules not enabled by default, or inadvertently disabled through another rule.  Fortunately, from what I can tell, the rule names stay the same for the most part, it’s just a matter of scoping you rules to the correct category.  Why Windows 7 rules aren’t enabled by default I can’t really say, but it’s easy enough to enable them now that you know what you’re looking for.

Links and Support

This site was more or less designed as a brain dump for me to help others who may come across complex problems that you don’t see everyday.

For “Officially Unofficial” support for System Center Essentials, WSUS, and Microsoft Deployment Toolkit please visit the TechNet forums hosted by Microsoft.  You will find numerous experts (myself included) in virtually every MS discipline available.

System Center Forums are here.

For System Center users, another community site is There are System Center family MVP’s that are frequently at this site which can also provide help for difficult problems, as well as assisting in development, say you want to create a new management pack or script something within SCE, they can help you.

WSUS Forums are here.

MDT Forums are here.

All Microsoft TechNet forums are listed here.


While I’m on the subject of deployment, along with Adobe, I get “How can I deploy Java”?

This one is even easier.

In this example I’ll use Java 6 Update 22.

Download the offline installer.  In this case the filename is jre-6u22-windows-i586-s.exe, and save it to your network share.

Go into SCE and create a new software package, point to the file above that you saved on your network share.  The additional installation parameters are “/s”  no quotes, it’s that easy.  This will install java silently and one less thing you have to worry about.

I get questions about this all the time….”How do I deploy Adobe Reader using SCE2010″?

It’s quite easy actually.

What you’ll need:

An offline version of the installer from Adobe – all versions of installers are here

Adobe Customization Wizard for the version you’re trying to deploy (yes, they ARE different, so get the right one)  The latest customization wizard for Reader X is here.  If you’re deploying Reader 9, get the Customization Wizard for version 9.

You have to transform the MSI with the customization wizard.  This provides for options pertaining to default pdf viewer, silent installs, remove old versions, etc.  Once you get it the way you want, the program creates an MST file.  At the top or the customization wizard you’ll actually see transformed by “nameofyourmstfile”.  Great, save those files to your network share where all your other deployment files are.

Go into system center and create a new package, point to the msi file, usually Acroread.msi by default.  Once you get to the additional installation parameters page you’ll put in  ALLUSERS=True TRANSFORMS=\\server\share\yourmstfile.mst   Remember if your mst path name has spaces in it, you MUST enclose the whole path in quotes or it will stop at the first space you have in the path name.  Deploy to a test group and make changes to the mst file as necessary.

Ever had the problem where Windows Update freezes during the download phase and won’t continue?
Check to see if BITS is running. If not, and it WON’T below

Try deleting the downloader cache files!

I’m not going to include XP users because:
1. I can’t remember the exact path
2. You’re still using XP, you’re a bit behind.

For Windows 7 users, the downloader cache/queue location is c:\ProgramData\Microsoft\Network\Downloader.
Inside this folder are .DAT files, remove them and see if BITS will now start thus, enabling Windows Update.
Note: This has only been tested for people using the Microsoft site, it “should” be the same for WSUS, but I can’t guarantee it.

Using System Center Essentials 2010 with SQL 2008R2 databases.

For those of you using SCE2010, you may (or may not) have found that SQL 2008R2 doesn’t play nicely, particularly in the area of drill-trough parameters with software/hardware summary reports.

I’ve created a fix for this and have had other colleagues test this with 100% success.  Keep in mind this is ONLY for SQL 2008R2.
You’ll need to modify the software summary report to do this.

Edit the report in Report Builder 3.0

You need to edit the Textbox properties of textbox8, not the placeholder properties. You can identify the box because it has “[ApplicationName]” written in blue.

So right click on the textbox, go to Text Box Properties.

Select “Action” on the left, you should see “Go to report” and then the report name is your software inventory report.

Under “Use these parameters to run the report” you’ll see Name: ComputerTargetId and the value is an expression.

Click the fx button to open the expression.

Delete =Code.GetObjectList(“” + Code.CurrentObjectList + “”)

and put in =LookupSet(Fields!ApplicationName.Value + “,” + Fields!ApplicationVersion.Value,Fields!ApplicationName.Value + “,” + Fields!ApplicationVersion.Value,Fields!ComputerTargetId.Value, “SUSDB”)

Save the report back to your report server and try running a software summary report, then click on a software title and make sure it takes you to the inventory report.

Please post if this doesn’t make sense or it’s not working or you need help, etc.

Disclaimer: This is MY fix, not an official fix from Microsoft. It’s been tested and confirmed to work in different environments, but I’m not responsible if it doesn’t work in yours or somehow corrupts your install or DB. This fix is also assuming your databases are using the default names created/installed by System Center Essentials 2010.