AADConnect – get Sync’ed and excluded OU’s via powershell

AADConnect has a JSON file and the ability to export – and there are also various AADConnect documenters out there… but sometimes you just want to get a core piece of info without having to start the GUI of wade through many pages of JSON.

Get-ADSyncConnector | select Name

Note the name of your “internal” domain as the connector (the one that doesn’t have “AAD” at the end)

(Get-ADSyncConnector -name <ConnectorName>).Partitions.ConnectorPartitionScope.ContainerInclusionList

(Get-ADSyncConnector -name <ConnectorName>).Partitions.ConnectorPartitionScope.ContainerExclusionList

Synology – choppy network performance

A few months back, my Synology NAS (DS2413+) started having some poor performance over the network – it wasnt horrendous – but it was noticeable. Speeds during transfer were generally fine, but simple cut/paste operations took longer than expected – and moving large files to the NAS seemed to swap between poor and decent transfer rates. It is connected to the networked via a 2 x 1GB bond, up to date firmware wise etc etc… Its been rock-solid and awesome for many year prior to this (overall, the synology experience has been generally awesome)

After a while of not really worrying about it too much, i got little annoyed with the performance and decided to look into further…. basic logging showed no issues, resource monitor showed no issue, the switch showed no issues…

On the NAS, I went into control panel | File Services | SMB | Advanced settings and noticed the “maximum SMB protocol” was set to “SMB2 and Large MTU”…. given that everything on the network is now Server 2019 or Windows 10 – there was no reason not to use SMB3…. i was also a little perturbed that SMB3 was not the default setting for “maximum”. I also changed the minimum to “SMB2 with large MTU” – even though i don’t think i have any SMB2 devices left on the network.

Once this was changed, all was good again… not sure if there was a patch on the MS side which resulted in this or if its a synology thing… or some type of strange combo…. either way – the Synology is something i rarely check (outside of firmware updates) – and changing to SMB3 was always going to be a good thing.

Powershell fails to download from gallery – Wanring: Unable to download from URI xxx

Recently had this issue…. i was able to get to the specified URI via the browser with no issue.

Came across this post – https://techcommunity.microsoft.com/t5/windows-powershell/failed-downloading-az-and-other-modules-for-powershell/m-p/1292985 and this command fixed it for me

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Apparently support for older protocols was dropped in April 2020

While i agree with the move – its just a bit frustrating that, by the nature of the change, the site cant communicate the new requirement back.

Finding the right SQL view for your SCCM report

One of the banes of many SCCM admins existence is reporting. Some SCCM people are SQL guns, others, like me, know what they need to to get by, but a strong SQL understanding – that just isn’t me (and i know i’m not alone!).

One of the key things with SCCM reports, and something that some consultancies we deal with ignore is the requirement to use views for your reports, not directly talk to the tables.

The official SCCM doco dances around this and doesn’t explicitly state it (even though it does reference views constantly, it does not specifically state that using tables is unsupported – and it should)

https://docs.microsoft.com/en-us/sccm/core/servers/manage/creating-custom-report-models-in-sql-server-reporting-services

https://docs.microsoft.com/en-us/sccm/develop/core/understand/sqlviews/sql-server-views-configuration-manager

 

These posts are far better at laying it out as it is

https://www.enhansoft.com/what-are-the-supported-sql-server-views-to-use-with-sccm-reporting/

https://www.enhansoft.com/why-is-it-important-to-use-supported-sql-server-views-with-sccm-reporting/

 

The TL;DR version of the ehansoft articles is:

  • The SCCM reporting services account is specified during setup and is granted access to all the views – but not the tables etc
  • The 2nd enhansoft article lays out why views are utilised instead of tables – and the associated benefits
  • You can grant datareader access to accounts over the SCCM database to get around this – but its officially (MS) unsupported, and can cause a range of issues (again, laid out in the 2nd article)
    • There are people out on the web that recommend just allocating permissions – even some MVPs – which doesn’t help
  • My recommendation is to remain in “supported” territory and update the report to use views rather than tables directly (knowing full well that we have all referenced tables directly at some point in our careers!)

 

A couple of things i have found handy with this are:

 

When you know the table you wish to reference, but aren’t sure which views you can use (and you want to do the right thing and use a view)

SELECT * FROM INFORMATION_SCHEMA.VIEWS WHERE VIEW_DEFINITION like ‘%tablename%’ OR VIEW_DEFINITION like ‘%tablename%’ OR VIEW_DEFINITION like ‘%tablename%’

 

When you can find what your looking for in the database

https://www.apexsql.com/sql-tools-search.aspx

 

 

Draytek – central AP management – not so great

I grabbed a couple of Draytek Vigor AP902 access points to work in conjunction with my Draytek Vigor 2925 router and Draytek Vigor 910c access point.

I dont mind the Draytek gear in general – for a home setup it is sufficient… however i did find i needed better wireless range thought that 3 AP’s with roaming would be a good fit…. and Drayteks central management swayed me towards getting an all-draytek solution. (as if you can manage 3 AP’s centrally, why wouldn’t you?!)

In short – it was/is a disappointment. The central AP management interface, accessed via the vigor 2925 is quite basic and there is no feedback indicating if applying a configuration to AP’s has been successful or not (for example).

The biggest issue however is that my PSK was applied incorrectly to all access points – this became apparent when all devices lost connectivity, despite the PSK being “the same”

When logging in directly to one of the access points to troubleshoot, i found the PSK in clear text, missing the last 5 characters. This was both good and bad…. bad as it was displayed in clear text, but good as it made the issue very clear.

From there, i simply updated the PSK on each individual AP, each with a 2.4 and 5.0GHz SSID, so 6 updates – and all was OK. Then disabled central management on the 2925.

If someone else is thinking of going for an all draytek solution for the same reasons…. my impression at the moment is – don’t do it.

I’ve emailed draytek support – and will update this post with their reply.

 

*** Update 07/01/2019 ***

I got a reply from Australian Draytek support – initially i got told “it works fine” – when i replied asking if a WPA2 key with certain characters in it, it does look like that a WPA2 key with “&” in it cannot be managed via the Vigor 2925 central management

Active Directory 2019 and Exchange 2019 – what’s new

Cross-post with http://www.hayesjupe.com/active-directory-2019-and-exchange-2019-whats-new/

 

The short answer is – not much.

Exchange 2019 was released a few weeks back, but was effectively un-usable, as Exchange 2019 requires Windows Server 2019…. and Windows server 2019 got pulled from release (like Windows 10 1809) due to some issues.

Windows Server 2019 was re-released a few days ago, which allowed nerds everywhere (including me) to put Server 2019 and Exchange 2019 into a test environment.

The most striking thing that is immediately noticeable is that everything looks the same…. The install process, the GUI, the management, all looks the same as it did in 2016. To me, this is a good thing – while Microsoft of the past seemed to believe that moving functions between areas was good – some consistency is nice to have too.

 

Active Directory

First appearances indicate there is nothing new in AD 2019, the installation process and management is exactly the same as 2016.

While installing, there is not even an option to set the forest and domain functional level to “2019” – only 2016.

A quick look at the schema version indicates it has increased and quick google finds this article

https://blogs.technet.microsoft.com/389thoughts/2018/08/21/whats-new-in-active-directory-2019-nothing/

So, while there is something new in the schema, its an incredibly small update….. and there are no new features or functionality of any type to focus on.

 

Exchange 2019

Exchange 2019 is a bit the same as AD, everything appears to be the same as Exchange 2016, from the install process to the management interface.

A google comes up with this

https://practical365.com/exchange-server/should-you-upgrade-to-exchange-server-2019/

So there are some changes and feature updates – but these updates may not have an impact/matter to your organization.

 

I found these two releases interesting overall as

  • AD is the core of many enterprise networks
  • Exchange is a core business application

To see a new release of both of these products with very minimal improvements I think demonstrates where all Microsoft’s development effort is going (which, to be fair, we already knew)

Cloud should stay up forever, right? Well, no.

Last month there was an outage in the Azure – South Central US region, which, by reports, seemed to have some knock on effects for other regions.

This was reported at:

In the discussions that followed with our customers, particularly with those currently considering their digital transformation strategies including moves to Office 365 and/or Azure, some expressed varying levels of concern. This prompted some very valuable debate around Adexis and what we feel are some important viewpoints when it comes to digital transformation. Here were some of our thoughts;

Outages happen

Even with the enterprise-grade resources of Microsoft (or Amazon), 100% uptime of any service over a long period of time is not realistic. Between hardware issues, software bugs, scheduled downtime and human error, something, at some point will go wrong – just like in your on-premise environment. With all the buzz around cloud, it can sometimes be easy to forget that this is essentially just an IT environment somewhere else maintained by someone else. Like any IT environment, it is still reliant on humans and physical hardware which will inevitably experience failures of service from time to time.

Control and visibility

When an outage happens on-premise, the local IT team are able to remediate and have as much information as it’s possible to have – and can provide their users with detailed information regarding the restoration of service. Everything is in the hands of the local IT team (or the company to which it has been outsourced).
When an outage happens with Azure, the amount of information the local IT team has is minimal in comparison. Microsoft’s communication during O365/Azure outages varies, however, ETA’s and other information is generally vague at best. All control is with Microsoft and all the local IT team can say to staff is “Microsoft are working on it”. While Microsoft may be able to resolve the situation faster than you could on site (or not), the lack of visibility and control can sometimes be daunting. It’s not all doom and gloom though. In situations where the issue would need to be escalated to Microsoft anyway (i.e. premier support), the criticality of an international user-base can often mean a greater focus from Microsoft and inherently a faster resolution than what would be achieved for your single company.

Site resilience

Azure has many features which enable site resilience to protect a single data centre failure – but sometimes these are not used. This could be down to flawed design of services or simple cost saving. When architecting your environment (or engaging the experts at Adexis to provide these specialist services), it’s important you carefully consider your DR and BCP plans and ensure you have the redundancy built into your environment that matches those requirements. This is not unique to either cloud or on-premise and always must be carefully considered.

Root cause

It’s not uncommon for on-premise service outages to be “fixed” by a reboot. Root cause analysis and effective problem management is something that while nice, not many IT teams have time to complete.
Microsoft have the resources to perform these functions to great depth and in-fact their brand depends on it. A complete root cause analysis feeds back into improvement of their overall operations, which leads to greater consumer confidence and therefore greater penetration into the market. They also literally have access to the source code for the operating systems and many apps, in addition to strong relationships with hardware vendors to be able to get patches/fixes in times that all of us can only dream of.
While Microsoft has been known to hold their cards close to their chest at times in terms of releasing the real root cause of outages, they are definitely invested in resolving those root causes behind the scenes and preventing further outages. This means that the environment remains far more up to date and typically, far more robust than an on-premise environment.

SLA

While Microsoft might suffer reputational damage as the result of an outage, do not expect any form of meaningful compensation
The finically backed SLA that salespeople spruik is a joke – http://www.microsoftvolumelicensing.com/DocumentSearch.aspx?Mode=3&DocumentTypeId=37
This is table for many services (but it does vary depending on specific services)

NameRelease DateVersionLink
Exchange Server 2013 CU817 March 201515.00.1076.009
Exchange Server 2013 CU79 December 201415.00.1044.025
Exchange Server 2013 CU626 August 201415.00.0995.029
Exchange Server 2013 CU527 May 201415.00.0913.022
Exchange Server 2013 SP125 February 201415.00.0847.032
Exchange Server 2013 CU325 November 201315.00.0775.038
Exchange Server 2013 CU29 July 201315.00.0712.024
Exchange Server 2013 CU12 April 201315.00.0620.029
Exchange Server 2013 RTM3 December 201215.00.0516.032
Exchange Server 2010 SP3 Update Rollup 9 17 March 201514.03.0235.001
Exchange Server 2010 SP3 Update Rollup 8 v2 12 December 201414.03.0224.002
Exchange Server 2010 SP3 Update Rollup 8 (recalled)9 December 201414.03.0224.001
Exchange Server 2010 SP3 Update Rollup 7 26 August 201414.03.0210.002
Exchange Server 2010 SP3 Update Rollup 6 27 May 201414.03.0195.001
Exchange Server 2010 SP3 Update Rollup 5 24 February 201414.03.0181.006
Exchange Server 2010 SP3 Update Rollup 4 9 December 201314.03.0174.001
Exchange Server 2010 SP3 Update Rollup 3 25 November 201314.03.0169.001
Exchange Server 2010 SP3 Update Rollup 2 8 August 201314.03.0158.001
Exchange Server 2010 SP3 Update Rollup 1 29 May 201314.03.0146.000
Exchange Server 2010 SP312 February 201314.03.0123.004
Exchange Server 2010 SP2 Update Rollup 8 9 December 201314.02.0390.003
Exchange Server 2010 SP2 Update Rollup 7 3 August 201314.02.0375.000
Exchange Server 2010 SP2 Update Rollup 6 12 February 201314.02.0342.003
Exchange Server 2010 SP2 Update Rollup 5 v2 10 December 201214.02.0328.010
Exchange Server 2010 SP2 Update Rollup 5 13 November 201214.03.0328.005
Exchange Server 2010 SP2 Update Rollup 4 v2 9 October 201214.02.0318.004
Exchange Server 2010 SP2 Update Rollup 4 13 August 201214.02.0318.002
Exchange Server 2010 SP2 Update Rollup 3 29 May 201214.02.0309.002
Exchange Server 2010 SP2 Update Rollup 2 16 April 201214.02.0298.004
Exchange Server 2010 SP2 Update Rollup 1 13 February 201214.02.0283.003
Exchange Server 2010 SP24 December 201114.2.247.5
Exchange Server 2010 SP1 Update Rollup 8 10 December 201214.01.0438.000
Exchange Server 2010 SP1 Update Rollup 7 v3 13 November 201214.01.0421.003
Exchange Server 2010 SP1 Update Rollup 7 v2 10 October 201214.01.0421.002
Exchange Server 2010 SP1 Update Rollup 7 8 August 201214.01.0421.000
Exchange Server 2010 SP1 Update Rollup 6 27 October 201114.01.0355.002
Exchange Server 2010 SP1 Update Rollup 5 23 August 201114.1.339.1
Exchange Server 2010 SP1 Update Rollup 4 27 July 201114.1.323.6
Exchange Server 2010 SP1 Update Rollup 3 6 April 201114.01.0289.007
Exchange Server 2010 SP1 Update Rollup 2 9 December 201014.01.0270.001http://support.microsoft.com/?kbid=2425179
Exchange Server 2010 SP1 Update Rollup 1 4 October 201014.1.255.2http://support.microsoft.com/?kbid=2407082
Exchange Server 2010 SP123 August 201014.01.0218.015http://technet.microsoft.com/en-us/library/ff728620(EXCHG.141).aspx
Exchange Server 2010 Update Rollup 5 13 December 201014.0.726.0http://support.microsoft.com/?kbid=2407113
Exchange Server 2010 Update Rollup 4 10 June 201014.0.702.1http://support.microsoft.com/?kbid=982639
Exchange Server 2010 Update Rollup 3 13 April 201014.0.694.0http://support.microsoft.com/?kbid=981401
Exchange Server 2010 Update Rollup 2 4 March 201014.0.689.0http://support.microsoft.com/?kbid=979611
Exchange Server 2010 Update Rollup 1 9 December 200914.0.682.1http://support.microsoft.com/?kbid=976573
Exchange Server 2010 RTM9 November 200914.00.0639.021http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=884b5e4c-912c-4335-8b35-432aba919535
Exchange Server 2007 SP3 Update Rollup 16 17 March 201508.03.0406.000
Exchange Server 2007 SP3 Update Rollup 15 9 December 201408.03.0389.002
Exchange Server 2007 SP3 Update Rollup 14 26 August 201408.03.0379.002
Exchange Server 2007 SP3 Update Rollup 13 24 February 201408.03.0348.002
Exchange Server 2007 SP3 Update Rollup 12 9 December 201308.03.0342.004
Exchange Server 2007 SP3 Update Rollup 11 13 August 201308.03.0327.001
Exchange Server 2007 SP3 Update Rollup 10 11 February 201308.03.0298.003
Exchange Server 2007 SP3 Update Rollup 9 10 December 201208.03.0297.002
Exchange Server 2007 SP3 Update Rollup 8-v3 13 November 201208.03.0279.006
Exchange Server 2007 SP3 Update Rollup 8-v2 9 October 201208.03.0279.005
Exchange Server 2007 SP3 Update Rollup 8 13 August 201208.03.0279.003
Exchange Server 2007 SP3 Update Rollup 7 16 April 201208.03.0264.000
Exchange Server 2007 SP3 Update Rollup 6 26 January 20128.03.0245.002
Exchange Server 2007 SP3 Update Rollup 5 21 September 20118.03.0213.001
Exchange Server 2007 SP3 Update Rollup 4 28 May 20118.03.0192.001
Exchange Server 2007 SP3 Update Rollup 3-v2 30 March 20118.03.0159.002
Exchange Server 2007 SP3 Update Rollup 2 10 December 20108.03.0137.003http://support.microsoft.com/?kbid=2407025
Exchange Server 2007 SP3 Update Rollup 1 9 September 20108.03.0106.002http://support.microsoft.com/?kbid=2279665
Exchange Server 2007 SP37 June 20108.03.0083.006http://technet.microsoft.com/en-us/library/ff607233(EXCHG.80).aspx
Exchange Server 2007 SP2 Update Rollup 5 7 December 20108.2.305.3http://support.microsoft.com/?kbid=2407132
Exchange Server 2007 SP2 Update Rollup 4 9 April 20108.2.254.0http://support.microsoft.com/?kbid=989381
Exchange Server 2007 SP2 Update Rollup 3 17 March 20108.2.247.2http://support.microsoft.com/?kbid=979784
Exchange Server 2007 SP2 Update Rollup 2 22 January 20108.2.234.1http://support.microsoft.com/?kbid=972076
Exchange Server 2007 SP2 Update Rollup 1 19 November 20098.2.217.3http://support.microsoft.com/?kbid=971534
Exchange Server 2007 SP224 August 20098.02.0176.002http://www.microsoft.com/downloads/details.aspx?FamilyID=ee7829a3-0ae8-44de-822c-908cd1034523&displaylang=en
Exchange Server 2007 SP1 Update Rollup 10 13 April 20108.1.436.0http://support.microsoft.com/?kbid=981407
Exchange Server 2007 SP1 Update Rollup 9 16 July 20098.1.393.1http://support.microsoft.com/?kbid=970162
Exchange Server 2007 SP1 Update Rollup 8 19 May 20098.1.375.2http://support.microsoft.com/?kbid=968012
Exchange Server 2007 SP1 Update Rollup 7 18 March 20098.1.359.2http://support.microsoft.com/?kbid=960384
Exchange Server 2007 SP1 Update Rollup 6 10 February 20098.1.340.1http://support.microsoft.com/?kbid=959241
Exchange Server 2007 SP1 Update Rollup 5 20 November 20088.1.336.1http://support.microsoft.com/?kbid=953467
Exchange Server 2007 SP1 Update Rollup 4 7 October 20088.1.311.3http://support.microsoft.com/?kbid=952580
Exchange Server 2007 SP1 Update Rollup 3 8 July 20088.1.291.2http://support.microsoft.com/?kbid=949870
Exchange Server 2007 SP1 Update Rollup 2 9 May 20088.1.278.2http://support.microsoft.com/?kbid=948016
Exchange Server 2007 SP1 Update Rollup 1 28 February 20088.1.263.1http://support.microsoft.com/?kbid=945684
Exchange Server 2007 SP129 November 20078.01.0240.006http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=5770bd59-376e-42ec-b940-be6225cd97ff
Exchange Server 2007 Update Rollup 7 8 July 20088.0.813.0http://support.microsoft.com/?kbid=953469
Exchange Server 2007 Update Rollup 6 21 February 20088.0.783.2http://support.microsoft.com/?kbid=942846
Exchange Server 2007 Update Rollup 5 25 October 20078.0.754.0http://support.microsoft.com/?kbid=941421
Exchange Server 2007 Update Rollup 4 23 August 20078.0.744.0http://support.microsoft.com/?kbid=940006
Exchange Server 2007 Update Rollup 3 28 June 20078.0.730.1http://support.microsoft.com/?kbid=935999
Exchange Server 2007 Update Rollup 2 8 May 20078.0.711.2http://support.microsoft.com/?kbid=935490
Exchange Server 2007 Update Rollup 1 17 April 20078.0.708.3http://support.microsoft.com/?kbid=930809
Exchange Server 2007 RTM8 March 20078.0.685.25http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=2600cab1-bf60-49bd-bef5-cb80083275ad
Exchange Server 2003 post-SP2 (KB956398)1 August 20086.5.7654.4http://support.microsoft.com/kb/956398
Exchange Server 2003 post-SP2 (KB951061)1 March 20086.5.7653.33http://support.microsoft.com/kb/951061
Exchange Server 2003 SP219 October 20056.5.7683http://support.microsoft.com/?kbid=906669
Exchange Server 2003 SP125 May 20046.5.7226http://www.microsoft.com/downloads/details.aspx?familyid=A49560AD-4C8B-4449-9947-B054D7F12CCE&displaylang=en
Exchange Server 2003 RTM28 September 20036.5.6944
Exchange Server 2000 post-SP31 August 20086.0.6620.7
Exchange Server 2000 post-SP31 March 20086.0.6620.5
Exchange Server 2000 post-SP31 August 20046.0.6603
Exchange Server 2000 post-SP31 April 20046.0.6556
Exchange Server 2000 post-SP31 September 20036.0.6487
Exchange Server 2000 SP318 July 20026.0.6249
Exchange Server 2000 SP229 November 20016.0.5762
Exchange Server 2000 SP121 June 20016.0.4712
Exchange Server 2000 RTM29 November 20006.0.4417
Exchange Server version 5.5 SP41 November 20005.5.2653
Exchange Server version 5.5 SP39 September 19995.5.2650
Exchange Server version 5.5 SP223 December 19985.5.2448
Exchange Server version 5.5 SP15 August 19985.5.2232
Exchange Server version 5.53 February 19985.5.1960
Exchange Server 5.0 SP219 February 19985.0.1460
Exchange Server 5.0 SP118 June 19975.0.1458
Exchange Server 5.0 RTM23 May 19975.0.1457
Exchange Server 4.0 SP55 May 19984.0.996
Exchange Server 4.0 SP428 March 19974.0.995
Exchange Server 4.0 SP329 October 19964.0.994
Exchange Server 4.0 SP219 July 19964.0.993
Exchange Server 4.0 SP11 May 19964.0.838
Exchange Server 4.0 RTM11 June 19964.0.837

A 31 day month has 44,640 minutes, 2,232 minutes is 5% of that. So the service would have to be down a whopping 37.2 hours to get back 100% of your fees for that month only, and the compensation is in the form of a service credit off next month’s bill.
How to claim this service credit is detailed on page 5 of the document and basically, the onus is on you to prove that there was an outage and submit the paperwork within 2 months. A separate claim must be created for each service. What this essentially means is it’s usually more effort than it’s worth to log the claim for the service credits.

In Summary

Outages for cloud services must be anticipated, just like outages to on-premise services. The attitude of “It’s in the cloud so it’s not our problem” is simply not realistic and likely to catch you out, unprepared.
If you have vital services that you are considering moving to Azure (or AWS, or anywhere else), rest assured it can be safe to do so, but make sure you allow for site resiliency in your design and costing.

Adexis is neither pro, nor anti cloud. Unlike many other vendors, we have no skin in the game, no incentive to push you in one direction or the other. We are completely independent and can provide you with unbiased specialist advice on what is best for your environment and your business, including the pros and cons of staying on-premise or moving to the cloud for each service.

Every environment is different when it comes to security requirements, IT skillset, hardware availability, CapEx vs OpEx spend and a range of other factors – and these all feed into what is the best solution for your business.

If you’d like to explore your IT strategy further, please be sure to give us a call.

Avoiding a Microsoft Teams Nightmare

Have you ever had the experience of providing users a document management system or Sharepoint site only to find that everyone uses it differently, creates folders all over the place in different ways, stores documents differently and after six months time it’s so hard to find anything that it defeats the purpose for which it was implemented in the first place? What a nightmare! You’re not alone.

With Microsoft Teams quickly becoming a preferred collaboration tool, you’d be forgiven for having fears of this nightmare becoming a reality all over again. The primary reason for that is there’s no technical ‘silver-bullet’ to prevent this from happening, it’s more of a governance discussion. Notwithstanding, there are some things you can do on a technical level that can help.

There are basically four levels of administration to be considered:

  • Global Settings – There are a number of features and functionality for Teams that can be turned on or off at a global level and these should be risk assessed for each environment. Ideally this should be done before the first Team site is even created.
  • Team creation – Microsoft Teams, while based off Office 365 Groups, will also provision a Sharepoint site for each Team. Therefore the decision as to who should be creating Teams is the same as for who should be creating Groups and Sites. One approach that we’ve found works well is to have these functions centrally managed with Teams created on request. There is of course an admin overhead to be considered however. See below;
  • Team Owners – These are the users that really run the individual Teams and will have the best insight as to the value of the Team and how it should be used. Trying to run this centrally is likely to lead to frustration all round so once created, administration should really be handed over to the Team owners. They can then add Team members, assign roles, create Channels and enable Apps etc as they see fit.
  • Team Users – Obvious statement but these are the ones who should be seeing value in Teams collaboration. Paradoxically one way to dilute that is by being in too many Teams. Users shouldn’t be confused about what spaces they should be collaborating in or where to store documents etc. To prevent this, ideally Teams should have clearly defined functions, whether that be organisational, operational or project based collaboration. Confusion arises where these functions overlap between Teams so clear delineation is important. This is another reason centrally managing Team creation can work well. In larger environments implementing practices like naming standards for Teams will also be of value.

Some of the central administration technical considerations are outlined here: https://docs.microsoft.com/en-us/microsoftteams/enable-features-office-365

Melissa Hubbard also provides some useful considerations in her blog post on the topic and while it’s a little while ago now, it’s still a great starter for some of the governance considerations:  https://melihubb.com/2017/07/25/microsoft-teams-governance-planning-guide

If Microsoft Teams is on your agenda for implementation, be sure to reach out to the Adexis team who can assist with design and implementation and help you to provide this wonderful platform to your users to enable communication and efficient collaboration, without the admin headaches.

Importing updates into WSUS on Server 2016 fails

I ran into a situation recentlly where i needed to import a specific update from the Windows update catalog into WSUS (and in turn into SCCM)

I opened WSUS, clicked on “import updates”, seletced my update and was presented with

“This update cannot be imported into Windows Server Update Services, because it is not compatible with your version of WSUS”

Strange…. WSUS on 2016 is extremely similar to WSUS on 2012 R2… so whats going on here ?

Long story short… there seems to be issue with the url passed by the WSUS console when you click “import updates” to the browser.

When you first click on “Import updates”, IE will open (or you will use IE because it makes importing updates into WSUS easier) to

http://catalog.update.microsoft.com/v7/site/Home.aspx?SKU=WSUS&Version=10.0.14393.2248&ServerName=<servername>&PortNumber=8530&Ssl=False&Protocol=1.20

Simply change the last part “1.20” to “1.80” – and importing updates will now work

i.e

http://catalog.update.microsoft.com/v7/site/Home.aspx?SKU=WSUS&Version=10.0.14393.2248&ServerName=<servername>&PortNumber=8530&Ssl=False&Protocol=1.80

Microsoft products – consolidated table of end of life dates

Microsoft product end of support dates are sometimes not easy to find and its not getting any better with the “current branch” releases and cloud solutions being governed by the Modern lifecycle policy.

The Modern lifecycle policy page further links to 3 product catagories, O365, Cloud platform and Dynamics. Unfortunately, its not clear (at least to me) how this helps with products such as SCCM current branch (be it 1606, 1702, 1706, 1710 or 1802) – however this information is available at another location

Likewise with the “traditional” products, most end of life information is available here – but to say that the information is difficult to search through is an understatement.

It also sometimes lacks detail, for example, there is no metion of the differing support for Windows 8.1 without update 1 and with update 1.

We have a number of clients that take the approach that while a server is running, to leave it there – and while I may personally not like this approach (i prefer to roll through the OS upgrades as they come out) – they have a valid approach and end of life information is important for them.

Keep in mind that everything listed below is end of extended support, not mainstream support – and i have taken some liberties (e.g. assumed that windows 8.1 is 8.1 with update 1)

Windows 10 dates have been sourced from the product lifecycle page, however this blog entry states than an additional 6 months has been granted to displayed Windows 10 versions.

If you find the below useful – cool. If i’ve got something wrong, or missed something that is key (in your opinion), please leave a comment.

 

VariableClassDescriptionSCCM 2007SCCM 2012
_SMSTSAdvertIDBuilt inStores the current running task sequence deployment unique ID. It uses the same format as a Configuration Manager software distribution deployment ID. If the task sequence is running from stand-alone media, this variable is undefined.YesYes
_TSAppInstallStatusBuilt inNoYes
_SMSTSBootImageIDBuilt inStores the Configuration Manager boot image package ID if a boot image package is associated with the current running task sequence. The variable will not be set if no Configuration Manager boot image package is associated.YesYes
_SMSTSBootUEFIBuilt inNoYes
_SMSTSClientGUIDBuilt inStores the value of Configuration Manager client GUID. This variable is not set if the task sequence is running from stand-alone media.YesYes
_SMSTSCurrentActionNameBuilt inSpecifies the name of the currently running task sequence step. This variable is set before the task sequence manager runs each individual step.YesYes
_SMSTSDownloadOnDemandBuilt inSet to true if the current task sequence is running in download-on-demand mode, which means the task sequence manager downloads content locally only when it must access the content.YesYes
_SMSTSInWinPEBuilt inThis variable is set to true when the current task sequence step is running in the Windows PE environment, and it is set to false if not. You can test this task sequence variable to determine the current operating system environment.YesYes
_SMSTSLastActionRetCodeBuilt inStores the return code that was returned by the last action that was run. This variable can be used as a condition to determine if the next step is run.YesYes
_SMSTSLastActionSucceededBuilt inThe variable is set to true if the last action succeeded and to false if the last action failed. If the last action was skipped because the step was disabled or the associated condition evaluated to false, this variable is not reset, which means it still holds the value for the previous action.YesYes
_SMSTSLaunchModeBuilt inSpecifies the task sequence launch method. The task sequence can have the following values:
SMS - specifies that the task sequence is started by using the Configuration Manager client.
UFD - specifies that the task sequence is started by using USB media and that the USB media was created in Windows XP/2003.
HD - specifies that the task sequence was started from a hard disk (prestaged media only).
PXE - specifies that the task sequence is started from PXE.
DVD - specifies that the task sequence is started by using a DVD.
CD - specifies that the task sequence is started by using a CD.
UFD+FORMAT - specifies that the task sequence is started by using USB media and that the USB media was created in Windows Vista or later.
YesYes
_SMSTSLogPathBuilt inStores the full path of the log directory. This can be used to determine where actions are logged. This value is not set when a hard drive is not available.YesYes
_SMSTSMachineNameBuilt inStores and specifies the computer name. Stores the name of the computer that the task sequence will use to log all status messages. To change the computer name in the new operating system, use the OSDComputerName variable.YesYes
_SMSTSMDataPathBuilt inSpecifies the path defined by the SMSTSLocalDataDrive variable. When you define SMSTSLocalDataDrive before the task sequence starts, such as by setting a collection variable, Configuration Manager then defines the _SMSTSMDataPath variable once the Task Sequence starts.NoYes
_SMSTSMediaTypeBuilt inSpecifies the type of media that is used to initiate the installation. Examples of types of media are Boot Media, Full Media, PXE, and Prestaged Media.YesYes
_SMSTSMPBuilt inStores the name or IP address of a Configuration Manager management point.YesYes
_SMSTSMPPortBuilt inStores the management point port number of a Configuration Manager management point.YesYes
_SMSTSOrgNameBuilt inStores the branding title name that is displayed in a task sequence progress user interface dialog box.YesYes
_SMSTSPackageIDBuilt inStores the current running task sequence ID. This ID uses the same format as a Configuration Manager software package ID.YesYes
_SMSTSPackageNameBuilt inStores the current running task sequence name specified by the Configuration Manager administrator when the task sequence is created.YesYes
_SMSTSRunFromDPBuilt inSet to true if the current task sequence is running in run-from-distribution-point mode, which means the task sequence manager obtains required package shares from distribution point.YesYes
_SMSTSSiteCodeBuilt inStores the site code of the Configuration Manager site.YesYes
_SMSTSTypeBuilt inSpecifies the type of the current running task sequence. It can have the following values:YesYes
_SMSTSTimezoneBuilt inThe _SMSTSTimezone variable stores the time zone information in the following format (without spaces):
Bias, StandardBias, DaylightBias, StandardDate.wYear, wMonth, wDayOfWeek, wDay, wHour, wMinute, wSecond, wMilliseconds, DaylightDate.wYear, wMonth, wDayOfWeek, wDay, wHour, wMinute, wSecond, wMilliseconds, StandardName, DaylightName
YesYes
_SMSTSUseCRLBuilt inSpecifies whether the task sequence uses the certificate revocation list when it uses a Secure Socket Layer (SSL) certificate to communicate with the management point.YesYes
_SMSTSUserStartedBuilt inSpecifies whether a task sequence is started by a user. This variable is set only if the task sequence is started from the Software Center. For example, if _SMSTSLaunchMode is set to SMS. The variable can have the following values:YesYes
_SMSTSUseSSLBuilt inSpecifies whether the task sequence uses SSL to communicate with the Configuration Manager management point. If your site is running in native mode, the value is set to true.YesYes
_SMSTSWTGBuilt inNoYes
SMSTSAssignmentsDownloadIntervalBuilt inNoYes
SMSTSAssignmentsDownloadRetryBuilt inNoYes
SMSTSAssignUsersModeBuilt inSpecifies how a task sequence associates users with the destination computer. Set the variable to one of the following values.NoYes
SMSTSDownloadProgramBuilt inNoYes
SMSTSDownloadRetryCountBuilt inNoYes
SMSTSDownloadRetryDelayBuilt inNoYes
SMSTSErrorDialogTimeoutBuilt inWhen an error occurs in a task sequence, a dialog box is displayed that is automatically dismissed after a number of seconds specified by this variable. By default, the dialog box is automatically dismissed after 900 seconds (15 minutes)..YesYes
TSErrorOnWarningBuilt inNoYes
SMSTSLanguageFolderBuilt inNoYes
SMSTSLocalDataDriveBuilt inSpecifies where temporary files are stored on the destination computer while the task sequence is running.YesYes
SMSTSMPListRequestTimeoutBuilt inNoYes
SMSTSPersistContentBuilt inNoYes
SMSTSPostActionBuilt inNoYes
SMSTSPreferredAdvertIDBuilt inForces a specific targeted deployment on the destination computer to be run. This can be set through a prestart command from media or PXE. If this variable is set, the task sequence overrides any required deployments.NoYes
OSDPreserveDriveLetterBuilt inNoYes
SMSTSRebootDelayBuilt inSpecifies how many seconds to wait before the computer restarts. The task sequence manager will display a notification dialog before reboot if this variable is not set to 0.YesYes
SMSTSRebootMessageBuilt inSpecifies the message to display in the shutdown dialog box when a restart is requested. If this variable is not set, a default message will appear.YesYes
SMSTSRebootRequestedBuilt inIndicates that a restart is requested after the current task sequence step is completed. If a restart is required, just set this variable to true, and the task sequence manager will restart the computer after this task sequence step. The task sequence step must set this task sequence variable if it requires the restart to complete the task sequence step. After the computer is restarted, the task sequence will continue to run from the next task sequence step.YesYes
SMSTSRetryRequestedBuilt inRequests a retry after the current task sequence step is completed. If this task sequence variable is set, the SMSTSRebootRequested must also be set to true. After the computer is restarted, the task sequence manager will rerun the same task sequence step.YesYes
SMSTSUDAUsersBuilt inSpecifies the primary user of the destination computer. Specify the users by using the following format. Separate multiple users by using a comma (,).NoYes
OSDDataImageIndexApply Data imageSpecifies the index value of the image that is applied to the destination computer.YesYes
OSDWipeDestinationPartitionApply Data imageSpecifies whether to delete the files located on the destination partition.YesYes
OSDApplyDriverBootCriticalContentUniqueIDApply Driver packageSpecifies the content ID of the mass storage device driver to install from the driver package. If this is not specified, no mass storage driver is installed.YesYes
OSDApplyDriverBootCriticalINFFileApply Driver packageSpecifies the INF file of the mass storage driver to install.YesYes
OSDApplyDriverBootCriticalHardwareComponentApply Driver packageSpecifies whether a mass storage device driver is installed, this must be “scsi”.YesYes
OSDApplyDriverBootCriticalIDApply Driver packageSpecifies the boot critical ID of the mass storage device driver to install. This ID is listed in the "scsi" section of the device driver’s txtsetup.oem file.YesYes
OSDAllowUnsignedDriverApply Driver packageSpecifies whether to configure Windows to allow the installation of unsigned device drivers. This task sequence variable is not used when deploying the Windows Vista and later operating system.YesYes
OSDAdapterApply Network SettingsThis task sequence variable is an array variable. Each element in the array represents the settings for a single network adapter on the computer. The settings defined for each adapter are accessed by combining the array variable name with the zero-based network adapter index and the property name.YesYes
OSDAdapterCountApply Network SettingsSpecifies the number of network adapters installed on the destination computer. When the OSDAdapterCount value is set, all the configuration options for each adapter must be set. For example, if you set the OSDAdapterTCPIPNetbiosOptions value for a specific adapter then all the values for that adapter must also be configured.YesYes
OSDDNSDomainApply Network SettingsSpecifies the primary DNS server that is used by the destination computer.YesYes
OSDDomainNameApply Network SettingsSpecifies the name of the Windows domain that the destination computer joins. The specified value must be a valid Active Directory Domain Services domain name.YesYes
OSDDomainOUNameApply Network SettingsSpecifies the RFC 1779 format name of the organizational unit (OU) that the destination computer joins. If specified, the value must contain the full path.YesYes
OSDEnableTCPIPFilteringApply Network SettingsSpecifies whether TCP/IP filtering is enabled.YesYes
OSDJoinAccountApply Network SettingsSpecifies the network account that is used to add the destination computer to a Windows domain.YesYes
OSDJoinPasswordApply Network SettingsSpecifies the network password that is used to add the destination computer to a Windows domain.YesYes
OSDNetworkJoinTypeApply Network SettingsSpecifies whether the destination computer joins a Windows domain or a workgroup.YesYes
OSDDNSSuffixSearchOrderApply Network SettingsSpecifies the DNS search order for the destination computer.YesYes
OSDWorkgroupNameApply Network SettingsSpecifies the name of the workgroup that the destination computer joins.YesYes
OSDConfigFileNameApply OS imageSpecifies the file name of the operating system deployment answer file associated with the operating system deployment package.YesYes
OSDImageIndexApply OS imageSpecifies the image index value of the WIM file that is applied to the destination computer.YesYes
OSDInstallEditionIndexApply OS imageSpecifies the version of Windows Vista or later operating system that is installed. If no version is specified, Windows setup will determine which version to install using the referenced product key.YesYes
OSDTargetSystemDriveApply OS imageSpecifies the drive letter of the partition that contains the operating system files.YesYes
OSDComputerNameApply Windows SettingsSpecifies the name of the destination computer.YesYes
OSDProductKeyApply Windows SettingsSpecifies the Windows product key.YesYes
OSDRegisteredUserNameApply Windows SettingsSpecifies the default registered user name in the new operating system.YesYes
OSDRegisteredOrgNameApply Windows SettingsSpecifies the default registered organization name in the new operating system.YesYes
OSDTimeZoneApply Windows SettingsSpecifies the default time zone setting that is used in the new operating system.YesYes
OSDServerLicenseModeApply Windows SettingsSpecifies the Windows Server license mode that is used.YesYes
OSDServerLicenseConnectionLimitApply Windows SettingsSpecifies the maximum number of connections allowed.YesYes
OSDRandomAdminPasswordApply Windows SettingsSpecifies a randomly generated password for the administrator account in the new operating system. If set to “true”, the local administrator account will be disabled on the target computer. If set to “false”, the local administrator account will be enabled on the target computer, and the local administrator account password will be assigned the value of the variable OSDLocalAdminPassword.YesYes
OSDLocalAdminPasswordApply Windows SettingsSpecifies the local administrator password. This value is ignored if the Randomly generate the local administrator password and disable the account on all supported platforms option is enabled.YesYes
OSDAutoApplyDriverCategoryListAuto Apply DriversA comma-delimited list of the driver catalog category unique IDs. If specified, the Auto Apply Driver task sequence action considers only those drivers that are in at least one of these categories when installing drivers. This value is optional, and it is not set by default. The available category IDs can be obtained by enumerating the list of SMS_CategoryInstance objects on the site.YesYes
OSDAllowUnsignedDriverAuto Apply DriversSpecifies whether Windows is configured to allow unsigned device drivers to be installed. This task sequence variable is not used when deploying Windows Vista and later operating systems.YesYes
OSDAutoApplyDriverBestMatchAuto Apply DriversSpecifies what the task sequence action does if there are multiple device drivers in the driver catalog that are compatible with a hardware device. If set to "true”, only the best device driver will be installed. If “false”, all compatible device drivers will be installed, and the operating system will choose the best driver to use.YesYes
OSDMigrateAdapterSettingsCapture Network SettingsSpecifies whether the network adapter settings (TCP/IP, DNS, and WINS) configuration information is captured.YesYes
OSDMigrateNetworkMembershipCapture Network SettingsSpecifies whether the workgroup or domain membership information is migrated as part of the operating system deployment.YesYes
OSDCaptureAccountCapture OS ImageSpecifies a Windows account name that has permissions to store the captured image on a network share.YesYes
OSDCaptureAccountPasswordCapture OS ImageSpecifies the password for the Windows account used to store the captured image on a network share.YesYes
OSDCaptureDestinationCapture OS ImageSpecifies the location where the captured operating system image is saved. The maximum directory name length is 255 characters.YesYes
OSDImageCreatorCapture OS ImageAn optional name of the user who created the image. This name is stored in the WIM file. The maximum length of the user name is 255 characters.YesYes
OSDImageDescriptionCapture OS ImageAn optional user-defined description of the captured operating system image. This description is stored in the WIM file. The maximum length of the description is 255 characters.YesYes
OSDImageVersionCapture OS ImageAn optional user-defined version number to assign to the captured operating system image. This version number is stored in the WIM file. This value can be any combination of letters with a maximum length of 32 characters.YesYes
OSDTargetSystemRootCapture OS ImageSpecifies the path to the Windows directory of the installed operating system on the reference computer. This operating system is verified as being a supported operating system for capture by Configuration Manager.YesYes
OSDStateStorePathCapture user stateThe UNC or local path name of the folder where the user state is saved. No default.YesYes
OSDMigrateAdditionalCaptureOptionsCapture user stateSpecifies user state migration tool (USMT) command line options that are used when capturing the user state, but not exposed in the Configuration Manager user interface. The additional options are specified in the form of a string that is appended to the automatically generated USMT command line.YesYes
OSDMigrateModeCapture user stateAllows you to customize the files that are captured by USMT. If this variable is set to “Simple,” then only the standard USMT configuration files are used. If this variable is set to “Advanced,” then the task sequence variable OSDMigrateConfigFiles specifies the configuration files that the USMT uses.YesYes
OSDMigrateConfigFilesCapture user stateSpecifies the configuration files used to control the capture of user profiles. This variable is used only if OSDMigrateMode is set to “Advanced”. This comma-delimited list value is set to perform customized user profile migration.YesYes
OSDMigrateContinueOnLockedFilesCapture user stateAllows the user state capture to proceed if some files cannot be captured.YesYes
OSDMigrateEnableVerboseLoggingCapture user stateEnables verbose logging for the USMT.YesYes
OSDMigrateSkipEncryptedFilesCapture user stateSpecifies whether encrypted files are captured.YesYes
_OSDMigrateUsmtPackageIDCapture user stateSpecifies the package ID of the Configuration Manager package that will contain the USMT files. This variable is required.YesYes
OSDMigrateComputerNameCapture Windows settingsSpecifies whether the computer name is migrated.YesYes
OSDComputerNameCapture Windows settingsSet to the NetBIOS name of the computer. The value is set only if the OSDMigrateComputerName variable is set to “true”.YesYes
OSDMigrateRegistrationInfoCapture Windows settingsSpecifies whether the computer user and organizational information is migrated.YesYes
OSDRegisteredOrgNameCapture Windows settingsSet to the registered organization name of the computer. The value is set only if the OSDMigrateRegistrationInfo variable is set to “true”.YesYes
OSDMigrateTimeZoneCapture Windows settingsSpecifies whether the computer time zone is migrated.YesYes
OSDTimeZoneCapture Windows settingsSet to the time zone of the computer. The value is set only if the OSDMigrateTimeZone variable is set to “true”.YesYes
SMSConnectNetworkFolderAccountConnect to networkSpecifies the administrator account that is used to connect to the network share.YesYes
SMSConnectNetworkFolderDriveLetterConnect to networkSpecifies the network drive letter to connect to. This value is optional; if it is not specified, then the network connection is not mapped to a drive letter.YesYes
SMSConnectNetworkFolderPasswordConnect to networkSpecifies the network password that is used to connect to the network share.YesYes
SMSConnectNetworkFolderPathConnect to networkSpecifies the network path for the connection.YesYes
OSDConvertDiskIndexConvert diskSpecifies the physical disk number that is converted.YesYes
OSDBitLockerRecoveryPasswordEnable bitlockerInstead of generating a random recovery password, the Enable BitLocker task sequence action uses the specified value as the recovery password. The value must be a valid numerical BitLocker recovery password.YesYes
OSDBitLockerStartupKeyEnable bitlockerInstead of generating a random startup key for the key management option “Startup Key on USB only,” the Enable BitLocker task sequence action uses the Trusted Platform Module (TPM) as the startup key. The value must be a valid, 256-bit Base64-encoded BitLocker startup key.YesYes
OSDDiskIndexFormat/PartitionSpecifies the physical disk number to be partitioned.YesYes
OSDDiskpartBiosCompatibilityModeFormat/PartitionSpecifies whether to disable cache alignment optimizations when partitioning the hard disk for compatibility with certain types of BIOS. This can be necessary when deploying Windows XP or Windows Server 2003 operating systems. For more information, see article 931760 and article 931761 in the Microsoft Knowledge Base.YesYes
OSDGPTBootDiskFormat/PartitionSpecifies whether to create an EFI partition on a GPT hard disk so that it can be used as the startup disk on EFI-based computers.YesYes
OSDPartitionsFormat/PartitionSpecifies an array of partition settings; see the SDK topic for accessing array variables in the task sequence environment.YesYes
OSDPartitionStyleFormat/PartitionSpecifies the partition style to use when partitioning the disk. "MBR" indicates the master boot record partition style, and "GPT" indicates the GUID Partition Table style.YesYes
SMSInstallUpdateTargetSoftware UpdatesSpecifies whether to install all updates or only mandatory updates.YesYes
OSDJoinAccountDomain JoinSpecifies the account that is used by the destination computer to join the Windows domain. This variable is required when joining a domain.YesYes
OSDJoinDomainNameDomain JoinSpecifies the name of a Windows domain the destination computer joins.NoYes
OSDJoinDomainOUNameDomain JoinSpecifies the RFC 1779 format name of the organizational unit (OU) that the destination computer joins. If specified, the value must contain the full path.NoYes
OSDJoinPasswordDomain JoinSpecifies the network password that is used by the destination computer to join the Windows domain. If the variable is not specified then a blank password is tried.YesYes
OSDJoinSkipRebootDomain JoinSpecifies whether to skip restarting after the destination computer joins the domain or workgroup.YesYes
OSDJoinTypeDomain JoinSpecifies whether the destination computer joins a Windows domain or a workgroup. To join the destination computer to a Windows domain specify "0". To join the destination computer to a workgroup specify "1".YesYes
OSDJoinWorkgroupNameDomain JoinSpecifies the name of a workgroup that the destination computer joins.YesYes
OSDBuildStorageDriverListPrepare captureSpecifies whether sysprep builds a mass storage device driver list. This setting applies to only Windows XP and Windows Server 2003. It will populate the [SysprepMassStorage] section of sysprep.inf with information on all the mass storage drivers that are supported by the image to be captured.YesYes
OSDKeepActivationPrepare captureSpecifies whether sysprep resets the product activation flag.YesYes
OSDTargetSystemRootPrepare captureSpecifies the path to the Windows directory of the installed operating system on the reference computer. This operating system is verified as being a supported operating system for capture by Configuration Manager.YesYes
OSDStateStorePathState StoreThe UNC or local pathname to the location from which the user state is restored. This value is used by both the Capture User State task sequence action and the Restore User State task sequence action.YesYes
OSDStateFallbackToNAAState StoreSpecifies whether the Network Access Account is used as a fallback when the computer account fails to connect to the state migration point.YesYes
OSDStateSMPRetryCountState StoreSpecifies the number of times that the task sequence step tries to find a state migration point before the step fails.YesYes
OSDStateSMPRetryTimeState StoreSpecifies the number of seconds that the task sequence step waits between retry attempts. The number of seconds can be a maximum of 30 characters.YesYes
OSDStateStorePathState StoreThe UNC path to the folder on the state migration point where the user state is stored.YesYes
SMSRebootMessageRestartSpecifies the message to be displayed to users before restarting the destination computer. If this variable is not set, the default message text is displayed.YesYes
SMSRebootTimeoutRestartSpecifies the number of seconds that the warning is displayed to the user before the computer restarts. Specify zero seconds to indicate that no reboot message is displayed.YesYes
OSDStateStorePathRestore user stateThe UNC or local pathname of the folder from which the user state is restored.YesYes
OSDMigrateContinueOnRestoreRestore user stateSpecifies that the user state restoration continues even if some files cannot be restored.YesYes
OSDMigrateEnableVerboseLoggingRestore user stateEnables verbose logging for the USMT tool.YesYes
OSDMigrateLocalAccountsRestore user stateSpecifies whether the local computer account is restored.YesYes
OSDMigrateLocalAccountPasswordRestore user stateIf the OSDMigrateLocalAccounts variable is “true,” this variable must contain the password that is assigned to all local accounts that are migrated. Because the same password is assigned to all migrated local accounts, it is considered a temporary password that will be changed later by some method other than Configuration Manager operating system deployment.YesYes
OSDMigrateAdditionalRestoreOptionsRestore user stateSpecifies additional user state migration tool (USMT) command line options that are used when restoring the user state. The additional options are specified in the form of a string that is appended to the automatically generated USMT command line.YesYes
_OSDMigrateUsmtRestorePackageIDRestore user stateSpecifies the package ID of the Configuration Manager package that contains the USMT files. This variable is required.YesYes
SMSTSDisableWow64RedirectionCommand lineBy default, when running on a 64-bit operating system, the program in the command line is located and run using the WOW64 file system redirector so that 32-bit versions of operating system programs and DLLs are found. Setting this variable to “true” disables the use of the WOW64 file system redirector so that native 64-bit versions of operating system programs and DLLs can be found. This variable has no effect when running on a 32-bit operating system.YesYes
WorkingDirectoryCommand lineSpecifies the starting directory for a command-line action.YesYes
SMSTSRunCommandLineUserNameCommand lineSpecifies the account by which the command line is run. The value is a string of the form username or domain\username.YesYes
SMSTSRunCommandLinePasswordCommand lineSpecifies the password for the account specified by the SMSTSRunCommandLineUserName variable.YesYes
SMSClientInstallPropertiesSetup SCCMSpecifies the client installation properties that are used when installing the Configuration Manager client.YesYes