Using Software distribution and Desired Configuration Management to fix non-compliant computers

Desired Configuration Management (DCM) is a feature in Configuration Manager which helps us tracing non-compliant computers. In Configuration Manager 2012 the feature also allows us to automatically remediate non-compliant computers. With Configuration Manager 2007 we can use a combination of DCM and Software Distribution to achieve the same functionality.

In this example I will create a DCM CI that will report a workstation as non-compliant if Adobe Flash automatic update is enabled. To fix the problem, I have a script that will disable the check for new updates. The script will be deployed using a normal software package.

Part I – Desired Configuration Management

Create the DCM objects

A DCM rule consist of a least one Configuration Item (CI) that is added to a Baseline. The baseline is advertised to a collection and compliant data are automatically sent back to the site server.

Create the CI

1. In the Configuration Manager Console, navigate to Computer Management, Desired Configuration Management, Configuration Items.
2. Right Click and create a new General CI.
   
3. Name the CI, Automatic Update, assign a custom category and click Next.
   
4. Click New, File or Folder
   
5. Select
   Type: File
   Path: %windir%\system32\Macromed\Flash\
   File or folder name: mms.cfg
   Name pattern search depth: Specified path
   
6. Select the Validation tab. We want to make sure that a single file exists and the file size is 19 kb.
   Instance count operator: Equals
   Value: 1
   
7. Click New, File Size and select
   Operator: Greater than or equal to
   Value: 19
   
8. Click OK twice and finish the wizard using the default values.

Create the Baseline

1. In the Configuration Manager Console, navigate to Computer Management, Desired Configuration Management, Baselines.
2. Right Click and create a new baseline.
   
3. Name the baseline Automatic Updates, assign a custom category and click Next.
   
4. Click applications and general, select the Automatic updates CI and click finish the wizard.
   
5. Right click the baseline and Assign it to a collection using the default values.

Part 2 – The Software deployment

Create the Collection

The target collection for our software deployment is based on a dynamic query that looks for the unique baseline name.

1. Create the dynamic query rule
   1. Create a new simple value
   2. In Attribute class select Configuration Item Compliance State
   3. In Attribute select Configuration State Name
      
   4. Click OK
   5. In the Criterion Properties window click Value and select non-compliant
      
   6. Click OK to save the criteria
   7. Create a new criteria:
      1. Attribute class select Configuration Item Compliance State
      2. Attribute select Localized Display Name
      3. In the Criterion Properties window click Value and select Automatic Updates
      4. Click OK to save the criteria
      5. Back in the in query statement your criteria’s should look like this:
         
      6. Click Show Query Language:
         select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_CI_ComplianceState on SMS_G_System_CI_ComplianceState.ResourceID = SMS_R_System.ResourceId where SMS_G_System_CI_ComplianceState.ComplianceStateName = "non-compliant" and SMS_G_System_CI_ComplianceState.LocalizedDisplayName = "Automatic Updates"
      7. Click OK to save the query statements and finish the collection

The package and advertisement

The package is a VB script that will copy mms.cfg to the correct location. Create the two files and place them in the same source location.

1. Create a text file and type AutoUpdateDisable=1 save the file as mms.cfg
2. Create a new VB script called disableAUflash.vbs

   Dim objFSO,ObjNet
   
   Dim strUsername,strDestfile, strScriptLocation
   
   strFileName = "mms.cfg"
   
   strScriptLocation = Replace(WScript.ScriptFullName,WScript.ScriptName,"")
   
   Set objShell = CreateObject("WScript.Shell")
   
   Set objFSO = CreateObject("Scripting.FileSystemObject")
   
   strAppData = objShell.ExpandEnvironmentStrings("%windir%")
   
   strDestFolder = strAppData & "\system32\Macromed\Flash"
   
   If Not objFSO.FolderExists(strDestFolder) Then
   
   objFSO.CreateFolder strDestFolder
   
   End If
   
   objFSO.Copyfile strScriptLocation & strFileName,strDestFolder&"\",True

3. Create the package and run the script as the program, like this “cscript.exe disableAUflash.vbs
   
   
4. Make sure the program runs under the local system account without any user interaction.
   
   
5. Finish the package and program using default settings. Remember to copy the package to your distribution points.
6. Create a new advertisement with a recurrence schedule. In my example I run the package once a week. Also make sure you configure the rerun behavior to always rerun program.

   

Local DCM report from non-compliant computer

Local DCM report after running the package