System Center Configuration Manager for WS2K8 Released
What may eventually be considered one of the most useful and welcome new features for admins has finally been officially released by Microsoft. Today, the company announced that System Center Configuration Manager has officially "released to manufacturing." A 120-day trial evaluation version appeared on Microsoft TechNet this morning.
SCCM is the replacement for Systems Management Server 2003 R2, and its purpose is to enable an administrator from a central location to manage and configure operating systems remotely. This new version makes feasible an innovative method of deployment, which is actually already under way for Windows Vista: You can build your own "distribution image" of an operating system, complete with the applications and settings specific to your organization, and distribute it through your network for remote installation.
Another critical new feature is network access protection (NAP), which lets you set up a scheme whereby systems (including notebooks) cannot gain full access to your network until they meet certain "health" criteria that you specify. SCCM then sets up a process whereby those systems can "get healthy" before logging in.
Typically at this point, I'd provide a link to my description of this new Windows Server feature on InformIT's Windows Server Reference Guide, but that page was offline due to technical difficulties today. At any rate, UPDATE: The InformIT server's back up, so my full article on SCCM appears here. Here's how I described NAP last April:
Here's how NAP works: The management server contacts Windows Update and other online distribution points for updated software. In learning about these updates, the SCCM software on the management server activates a wizard, which will of course require your intervention. Using this wizard, SCCM builds a series of policies whose rules govern whether non-updated systems have full or restricted network access. Those policies are distributed to the remediation server.
When a client seeks a DHCP server, under Longhorn, it provides that server with a kind of signature that represents its "health." Under Microsoft parlance, a non-updated client is relatively unhealthy (although in practice, the update can sometimes cause the problem, which is why it's necessary that you know your updates thoroughly as you're using the SCCM wizard).
The DHCP server runs the health certificate by the SCCM policy manager to see whether the client is healthy enough to be granted access. If the certificate fails this test, the DHCP server places the client on a kind of quarantine. It can access the remediation server, but not much else. The remediation server "heals" the client with the updates, then the client requests access again. If the health certificate passes the test the second time around, all is forgiven.
UPDATE - Microsoft Senior Technical Product Manager for SCCM 2007 Jeff Wettlaufer wrote BetaNews on Wednesday to remind us that the new edition is not just for Windows Server 2008. Our headline for this story may have given that implication, so we stand corrected. The new edition also works with Windows Server 2003 R2.