Config Manager

1E released a new white paper written by Ian Godfrey last week entitled Remote Management of BIOS Configuration, which is centered around configuring Wake-on-LAN but the concepts and tools can be used to manipulate other BIOS settings as well. 

This paper covers a number of different hardware vendors and how to remotely configure the BIOS, something that is not standard across the hardware vendors.  It includes links to different tools, ConfigMgr integration, scripts, tips, troubleshooting, and a very in depth explanation of WOL.  If you are having trouble getting some computers to wake up when they are sent a magic packet or you need to learn how to remote administer the BIOS without touching each computer this is a must read.

Regards,
Anthony

Anthony Clendenen | Solutions Engineer | 1E

Microsoft MVP System Center Configuration Manager

http://configmgr.com

© Anthony Clendenen

In my post regarding what’s new in NightWatchman 5.5 I talked about the new NightWatchman Console.  I want to cover the security aspect of the console in this post to show some of the flexibility of the console as well as explain how to set the proper security.

In the NightWatchman Console the last tab on the right is Security, this is to manage the security of the console specifically, not the NightWatchman clients, but which users and groups have what rights in the console.

If you click on the Security tab it shows you the Users and Groups section by default this includes the user or group you specified during the setup who was the Administrator.  This user or group has full rights in the console which is the Systems Administrator role.

If you now click on the Roles tab next to the Users and Groups tab in this section you get a view of the roles and their rights.  From this view you have the options to add a new role and set or modify the permissions of a role.  As you can see the Systems Administrator role cannot be modified so that you don’t lock yourself out of the console completely.

If we add a new role we can then modify the permissions that the users who are assigned that role get when then open the NightWatchman Console.  What I am going to do is add a role for the IT group that manages the retails department.  I want this group to only be able to view and modify the power scheme and shutdown schedules for their particular department, preventing them from making changes to the settings for all other groups.

I do this by first clicking the Add button while still in the Roles tab.  This opens a dialog box asking me for the name and a description of the role.

Notice that in the fields that are required to be filled out there is a stop symbol because I have not filled out the name filed.  This also occurs in other fields in the console, say for instance you try to put in an invalid time in the scheduled shutdown’s time field you will get the same results and won’t be able to save your changes until it is filled out correctly.

I have filled out the name field and description and then clicked OK to create a group called Retail Admins. And it now shows up in the list of Roles in the console.

When I highlight this role I can see that there are no rights assigned to this role, not even the ability to launch the console, this is of course by design. Keeping in mind what my goal is for this group, I am going to assign it the following rights:

It is important to understand the difference between View and View All when assigning roles rights.  Since my plan is to only allow this role to view their group of clients I selected View and not View All as this would allow them to see all the groups in the console.

Notice if you do not click the Apply button and navigate away your changes will be discarded.

Here is what my Roles tab now looks like with the Retail Admins group selected.

Next I need to assign this role to a user or group of users.  If I click on the Users and Groups tab at the top it switches me back to the users and groups view where I can add a new user or group.  You can do this by clicking on the Add button and it will open the AD users and groups dialog where you can input the name of the user or group.  I am going to use a single user in this example but I could have just as easily added a group.  Now that I have a new user listed to the right I see a list of all possible roles that I can assign that user to.  The roles the user has assigned to them is indicated by a stop symbol or a checkmark if they are assigned that role.  By default a new user or group is not assigned any roles.  I am going to assign the new user (Anthony) the role of Retail Admins and then the role has a checkmark next to it to indicate that it has been assigned that role. If I click on the details link next to the role it tells me exactly what rights that role has so that I don’t have to switch back to the roles tab to determine if it has the correct rights before I assign it to a user or group.

Next I need to assign my user to my group of clients.  To do this switch back to the NightWatchman Clients view by clicking on the tab in the top left corner of the console.

In this view you can see the NightWatchman clients in their groups, either by organizationally or by geographic locations since we are picking on the Accounting department we are interested in the organizational grouping.  If you don’t have a group you can create one from this view as well by just right clicking on the parent group and selecting Add Group.  Always keep in mind that the NightWatchman clients are assigned to the lowest tier in the grouping and there must be five levels starting from the highest level, in my example I am going to use the Auditors group and here is my hierarchy in the console.

If you right click on the Auditors group then select Properties from the context menu. When the properties window is displayed click on the Security tab and from the list of users and groups you will see that the users and groups that have the Systems Administrator role show up with the right already assigned to this group but any other group or user does not yet have rights.  To assign a user or group the ability to view this group simply click on them and they will then have a checkmark next to their name.

In this example I have added a group and a new user to demonstrate this and to show you can use groups as well.  Daniel has been assigned the Retail Admin rights but he doesn’t yet have those rights on this group.  Once I click on him he will then have the assigned rights we gave the Retail Admins group to this group of clients.  And that is all there is to it.  Once you click the OK button the user will have the rights to view this group, but this group only.  If you click on the Finance group or any group higher up in the hierarchy and the open the groups properties page on the security tab you will see that any user or group other than those assigned the Systems Administrator role do not have rights to view this group.  You could assign a user or group rights at this level and the lower tier groups under it would also inherit those rights.

As always if you have any questions or comments feel free to contact me.

Regards,
Anthony

Anthony Clendenen | Solutions Engineer | 1E

Microsoft MVP System Center Configuration Manager

http://configmgr.com

© Anthony Clendenen

Right before Christmas 1E released not only the free tool Service Window that I mentioned in my last post but also new versions of NightWatchman now version 5.5, 1E WakeUp version 5.5, Nomad Enterprise 3.2 and our first version of the NightWatchman console.  Over the last 18 months I had been working with AT&T® to prove out the 1E Power and Patch Management Pack, which is a combination of 1E WakeUp and NightWatchman.  July 31st the deal with AT&T closed and in late October we did a joint press release with AT&T about the savings.  In the end they are going to save about $1 million a month or $60 million dollars over 5 years, and those are pretty modest figures, and I know they are because I actually wrote the report for them based on the pilot data from their AFR server.  They are also going to save 135 million kWh’s of electricity each year while eliminating 124,000 tons of CO2 emissions.  It was a great project and now one of our consultants Richard Fellows has been working with them on the implementation across their 310,000 PC’s.  As is usually the case our customers dictate the new features included in our products and I all of the Solution Engineers at 1E are also now aligned with a single product so we are involved in the entire development cycle, at least as much as we can since we travel a fair amount of time.  But NightWatchman 5.5 is the product I typically spend the most time with also the reporting server as well AFR.

Here is a short list of the new features in version 5.5 of NightWatchman and I will explain most them in more depth below as well as how to configure and use them.

• Sleepless Client Detection – NightWatchman can now achieve even greater power savings by detecting PCs which do not go to sleep when they should. The Administrator is made aware of what is keeping the machine awake and given the opportunity to allow or disallow this from happening in future.
• NightWatchman Console – You can now manage your NightWatchman clients from a centralized secure administration console, providing the simplest mechanism and most control over your NightWatchman installation. Existing methods to manage NightWatchman clients (such as Microsoft Configuration Manager or Group Policy) still work and can be used with or without this new console.
• Maintenance Windows and Alarm Clock – You can now configure PCs to power up according to a schedule which suits both your users and administration needs. With Maintenance Windows your PCs will wake up and remain powered for a length of time before returning to a low power state when scheduled maintenance tasks are complete.
• Keep Active – Extend PC Power Management to PC users, allowing them to ensure their PC remains available to execute tasks while they’re away.
• Active Directory Import Tool – Simplifies and speeds up the task of mapping an existing directory of PCs to the NightWatchman configuration and reporting structure. This wizard based tool deals with conflict detection and resolution and the included import scripts can be modified to best suit your environment.

Keep Active

I will start with the Keep Active feature, it is probably the easiest of the new features to explain.  This is an option that allows the user to decide if they want to keep their PC from being put into a low power state.  This includes a scheduled shutdown as well as the power scheme settings so the computer will not go into any low power states during the Keep Active period.  This is not something you would like your employees to use every day because they could defeat the energy savings program for their computer.  There is going to be some changes in the next version of NightWatchman about how much control you turn back over to the employee.

Usage Scenarios

One example of how someone might use this feature is let’s say Paul Thomsen and I are working late in his office in Redmond and we want to run some automated tests on some of his lab computers but we also don’t want the machines to go into a low power state or shutdown at the scheduled time of 7 PM because we need these tests to complete while we are eating at Azteca we are not sure how long we are going to be over there so we set Keep Active on the lab computers to 2 hours.  That gives us a little time to walk over there eat and get back without our tests being interrupted by the computers going into a low power state from the power scheme settings or the scheduled shutdown time.

How to configure Keep Active

They do this simply by right clicking on the NightWatchman icon in the system tray and selecting “Keep Active”.

Then after they click Keep Active from the context menu it will open a dialog box with a drop down box allowing them to select the amount of time they want to set their computer to keep active. During the Keep Active period the NightWatchman tray icon also changes so the user can turn it back off if they want to.

Maintenance Windows and Alarm Clocks

Maintenance windows and alarm clocks have some similarity to them.  They are both a scheduled wakeup for the NightWatchman client but the alarm clock function is for end users and maintenance windows are for administrators.  The end result is the same for both however, to schedule the computer to come out of a low power state at a certain time on a specific day.

Usage Scenarios

For the Alarm Clock feature this can be used by the employee to schedule when their computer is going to be turned on in the morning so that all (startup) group policies have run or if there are things that happen to the computer that make the boot time in double digits.  Since you can configure the time and for each day if the employee only works 4 – 10’s, then they could schedule their computer to only come on 10 minutes before their start time on those four days of the week so it doesn’t come on the other three days of the week.

The Maintenance Window feature is for the IT staff to be able to schedule a computer or group of computer, to come out a low power state at a scheduled time and then after a your maintenance is completed return the computer back to the low power state it was in for the remainder of the night or weekend.  This is useful for things that you need to do outside of ConfigMgr, say anti-virus scans or updates.

How to Configure Alarm Clocks and Maintenance Windows

The Alarm Clock settings are configured in the NightWatchman console (which I cover below), the Maintenance Window settings are also configured in the NightWatchman console.

You can see this tab is displaying the Maintenance Window, one option is to turn the monitor on when the computer is brought out a low power state for the Maintenance Window.  Usually you would want the monitor to stay off assuming that you schedule your Maintenance Windows for off hours.  As you can see you can schedule or not schedule the Maintenance Window start time for each day separately, how long the computer will remain on, essentially setting the duration of the Maintenance Window.  And then at the end of the Maintenance Window what low power state do you want the computer to go into.  In this first version the low power options are standby and hibernate, off will be coming soon.

Now you can see that I have scheduled a window for Monday, Wednesday and Friday, they are for different durations and Friday I want the system to go back to hibernate.

NightWatchman Console

The NightWatchman console is a server side console to configure the NightWatchman clients.  You can group clients based on business unit and based on physical locations.  For example, what state they are in and what department they are in.  This helps with the reporting portion.  Also as I covered above the Alarm Clock and Maintenance Window settings are configured in the console.  But also the scheduled shutdown times and power scheme policies for the clients, which goes back to the grouping again. 

As you can see from these two images which are the power scheme settings (top) and power policies (bottom) there are a number of settings that you can configure along with each of these.  Traditionally this would have been done with ConfigMgr or group policy but with the NightWatchman console we add another option for administrators to configure the client settings.

Usage Scenarios

The NightWatchman console is targeted at customers who either do not have ConfigMgr or SMS but still need the Wake-on-LAN functionality of 1E WakeUp and for customers that have different groups that will manage NightWatchman and ConfigMgr. 

How To Configure The NightWatchman Console

Configuring the NightWatchman console is more about configuring the clients although there is a Security tab that will allow you to control which users and groups get to see or configure all the settings in the console.

Lets start with an overall of the console.

On the left of the console are the tabs NightWatchman Clients, Power Schemes, Power Policies, Power Consumption and Security. 

• NightWatchman Clients – This is where you can group clients, assign power schemes and power policies to your clients.  You can also see the tabs to display Location Groups and Organization Groups, these are the two types of groups I described above where you can assign clients based on their location and business unit.  Client default into the Unassigned Building for the location groups and into Unassigned Department for organization groups.
• Power Schemes – In this tab you can create, edit and delete power schemes.  Power scheme settings are the settings the control when the monitor goes into standby, the hard drive goes into standby, the computer goes into standby or hibernate and so on.  After you create the power schemes you then assign them to a group.  In this example I have a typical power scheme policy that I have named Accounting Department as it will be assigned to the Accounting departments computers but I could assign it to any other group as well that I wanted to use the same settings on.

• Power Policies – On the Power Policies tab you edit, create and delete policies that control when the group of clients will shutdown, what type of shutdown it is, when and how long the maintenance window is, if there is an alarm clock to wake the computers for the user, process exceptions and sleepless client detection settings amongst other settings.

The last two tabs are Power Consumption and Security.  The Power Consumption tab is used to configure what power figures are used by the different clients in the various states to ensure accurate power, carbon and costs are used in the reports.  This is a very important feature as the various hardware vendors and models use dramatically different amounts of power in all the different power states.  Not having this feature would be like assuming an 8 year old 21” CRT used the same amount of power as my daughters LCD on her Dell Mini.  And trying to figure power costs, consumption and CO2 emissions without these numbers is just a guess – at best.  On the Security tab you configure the security settings for the console, allowing users and groups different levels of rights on all the tabs and their settings.

I will save the last two new features for a future post, this one turned out to be much longer that I anticipated.

As always if you have any questions or comments let me know!

Regards,
Anthony

Anthony Clendenen | Solutions Engineer | 1E

Microsoft MVP System Center Configuration Manager

http://configmgr.com

© Anthony Clendenen

This is a 1E customer who not only uses our NightWatchman software to save electricity and subsequently reduce their own carbon footprint in doing so but they are also saw a return on investment of of less than three months on a project that also included our user self service product Shopping and services to design and implement SMS.  In the long run they are going to reduce the amount of carbon emitted into the environment by 1 metric tonne annually and their head count is only 4,500 employees.  Other benefits they will realize are faster and easier application delivery to the end users, and less IT staff costs by implementing SMS and Shopping, all along side NightWatchman.

I was not involved in this project personally, but I can tell you that with all of my customers who use NightWatchman they are not only saving millions of dollars on electricity each year and saving the planet at the same time but when they add our other software solutions like 1E WakeUp with our custom Wake-on-LAN solution and the much imitated Client Health patching of computers is much faster and reaching a patch level of 100% compliant is not only possible but now the expectation, add in our branch distribution software Nomad Enterprise and the fear of sending a package over a link and hoping it doesn’t saturate the pipe is gone, no longer can the Network admin’s point their finders at the SMS or ConfigMgr if their traffic shaping doesn’t quite work, Nomad has dynamic true bandwidth throttling built in that handles any change in network traffic, oh the stories I could tell.  And then when you add Shopping in and you never have to worry again about getting those frantic phone calls from your manager or director telling you to stop what you were working on “…because the department head of X is leaving for the airport in 45 minutes and has to have the latest version of Visio and PowerPoint installed on their laptop before they go, and I mean right now!  Create the package and ad thing you do. No, I have no idea what their computer name is why?  Oh, and make sure they have the right service pack and all the patches installed with those too!  We can’t have them getting infected.”  Because with Shopping that department head could sit in their chair open up their browser, select Visio and PowerPoint from the list of application on the Shopping portal and in just a few minutes it would all be installed while they were checking online to make sure they had the best seat for their return flight next week, all without ever contacting IT!

My customers scale, as far as client numbers, are almost always in excess of 100k so I get to design and test some very interesting solutions.  Hierarchies are very large and complicated, not to mention the sheer size of the IT operations and the risk associated with making changes to the computing environment and processes.  But when the design is complete, and we have checked every box indicating that all of the PoC tests are a success, and all requirements have been met, and I produce a report telling them how much they are going to reduce their carbon footprint and save on electricity, that they no longer have to worry about traffic shaping to make sure an SMS distribution doesn’t cause a network outage, that we meet and exceed application delivery to the end users where service level agreements are measured in seconds not days, and they are finally going to get the client fixed on all those computers where it hasn’t worked for no one knows how long, all they can do is smile in disbelief and ask me why they didn’t call sooner!  

So I can attest to this case study being factual even though I didn’t work on the project because I have seen it all with my own customers using the 1E products and services.

PeterboroughCaseStudy.pdf

Regards,
Anthony

Anthony Clendenen | Solutions Engineer | 1E

Microsoft MVP System Center Configuration Manager

http://configmgr.com

© Anthony Clendenen

This is from the 1E site, but down towards the bottom you can see the schedule for demos at the 1E stand.  I will be presenting at least a couple times.  Brian Tucker and Neil Kimberly will also be presenting at the stand on other topics.  If you think I know SMS/ConfigMgr then you haven’t spent much time talking to Brian and Neil these guys are AMZAZING!

1E MMS Focus

1E will be exhibiting as a Gold Sponsor at the Microsoft Management Summit at the Venetian Hotel, Las Vegas from April 28 to May 2, 2008.

With a focus on System Center Success and ‘green’ IT, we will be highlighting:

• Expertise in deploying System Center solutions
• Automation solutions that dramatically reduce cost and complexity
• PC power management
• Self-service provisioning with licence control
• Content distribution and OS migration/deployment for distributed environments
• Actual customer experiences with proven ROI

SPEAKER SLOT: Real-world System Center success including PC power management: Significantly lower your PC and server management costs

Speaker: Sumir Karayi, CEO 1E

Date/Time: Tuesday 29, 11.45 – 13.00

Location: F-Veronese 2402-2503

Sumir Karayi, CEO 1E, will be speaking following Bill Anderson’s “ConfigMgr – State of the Nation” session. Sumir will talk about System Center and PC power management customer success stories.

1E has been providing robust integrated Windows systems management solutions for over 10 years. Come and listen to Sumir talk about real-world experiences of System Center success and PC power management implementations in large, complex, distributed environments. In this session you will learn how to address universal time and cost-saving initiatives such as:

• PC power and patch management including client health and energy usage reporting
• Automated self-service application provisioning with license management and control
• Optimization of software and OS deployments to bandwidth-constrained complex branch environments

Visit the 1E Stand 311

MMS provides us with a great opportunity to see friends – old and new. Please drop by the 1E stand to say hello, collect ‘green’ giveaways, enter our competition to win a Nintendo Wii, and attend ‘live’ technical demo sessions.

‘Live’ Theatre Demonstrations and Presentations

Tuesday April 29

1:10 – 1:30 PM PC Power Management: Go Green Overview Presentation Simon Francis

2:00 – 2:20 PM Self-Service Provisioning and License Control Anthony Clendenen

3:30 – 3:50 PM Fully Automated OS Deployment/Migrations Neil Kimberley

Wednesday April 30

1:10 – 1:30 PM PC Power Management, WOL and Client Health Brian Tucker

2:00 – 2:20 PM Fully Automated OS Deployment/Migrations Neil Kimberley

3:00 – 3:20 PM Self-Service Provisioning and License Control Anthony Clendenen

3:30 – 3:50 PM Bandwidth Optimization for Complex/Branch Environments Brian Tucker

Thursday May 1

1:10 – 1:30 PM Bandwidth Optimization for Complex/Branch Environments Brian Tucker

2:00 – 2:20 PM PC Power Management & Energy Usage Reporting Brian Tucker

Regards,
Anthony

Anthony Clendenen | Solutions Engineer | 1E

http://configmgr.com

© Anthony Clendenen

I have read of reports where systems will not resume from hibernation but have not seen it replicated myself.  Well if you have seen this problem in your environment this patch, released on April 7th by Microsoft (KB 951126), may be just what the doctor ordered. 

Insomnia? Ambien…

I have also heard reports of a software vendor that claims to have a patch for a situation they refer to as insomnia.  They claim that a bug in the Windows operating system will actually prevent the system from going into hibernate and have a patch to fix it. 

In reality there is no bug and here is what happens.  In the power scheme settings there is a specified time for the system to go into a low power state after n minutes of idle time.  Idle time is when there are no keyboard inputs, mouse movements or changes in window focus, all actions typically performed by the user.  Once the computers idle timer expires the OS will go into a low power state but before that it will query running applications to see if they are busy doing anything and if any of them respond with a "Yes, I am still working!"  the idle timer gets reset and the system stays in its current power state.  The idle timer will reset to n minutes and when it expires it will check again. 

This process is actually handled by SetThreadExecutionState function, which allows application to respond to this request with various values to be able to complete their tasks.  So not only is this not a bug in the OS, if there is a bug it lies in the application that is incorrectly responding and keeping the OS from going into a low power state or it truly is working and needs the computer to stay up.  The whole idea is to keep applications from crashing, causing a BSOD or worse a RSOD and corrupting files.  And personally, the only patch I am going to install for my operating system is going to have to come from Microsoft, I will apply patches from vendors for their own software but if they issue a patch to fix another vendors software I would be a bit concerned to say the least.

More technical details of the function can be found here on msdn.

If you are coming to MMS see you in just a couple weeks!  You can find me hanging out at the booth or in sessions.  I will actually be putting on a couple demos during the week at our booth as well.

Regards,
Anthony

Anthony Clendenen | Solutions Engineer | 1E

http://configmgr.com

© Anthony Clendenen