GAThrawn's questions

A pre-req for a particular application deployment is that we need a particular PKI certificate installed in the Windows Trusted Publishers cert store of the PCs before installing.

Is there any way to detect if a particular cert has already been installed? Ideally using a one-liner command or a short script (that could be used for pre-req detection, or as a dependency check in SCCM 2012)?

There seem to be lots of commands and scripts out there for listing all installed certs, or all installed certs expiring soon, but nothing that I can see for identifying if one particular cert is installed.

When installing an Application (as opposed to a Package/Program) during an OS deployment task sequence the only thing that seems to get written to the smsts.log if an install fails is that the application install failed, (normally with the seemingly unhelpful generic TS error code 0x80004005).

But in SCCM 2007 OSD, if you pressed F8 while the task sequence failed massage was onscreen, the smsts.log used to list the exact command line used to start an install, as well the return code and/or first few lines of any output from the installer as it exited.

It doesn't seem to do this in 2012. The closest equivalent to that in 2012 for Applications seems to be the AppEnforce.log, but none of the App*.log log files seem to exist during an OSD task sequence, they only appear later when task sequence has successfully completed (or if they do exist during the TS, I haven't managed to find them in the normal C:\_SMSTaskSequence\Logs or C:\Windows\CCM\Logs locations).

This is using SCCM 2012 SP1 installing a Windows 7 SP1 32-bit OS and related apps, if that makes any difference.

We will shortly be moving all our user accounts to a new domain, as part of this the user accounts will pick up new SMS ResourceIDs in SCCM.

What I need to do is to query SCCM for all collections that a user is a member of, so that I can duplicate those for the new user account, Direct Memberships (rather than query memberships) are what I'm interested in. It seems to be pretty easy to find all adverts to a user, but not to find their collections.

Ideally I'd like to be able to get this via a script so that I can then use a second script to add the new user account to the relevant collections (already able to add to collections via a script).

Currently running SCCM 2007 R2.

I have a self-signed .cer certificate that I need to deploy to roughly a 1000 machines, running a variety of Windows versions from Windows XP and Server 2003 up to Windows 7 and Server 2008 R2.

SCCM is our normal deployment method, and have tried deploying these a few different ways and am bumping against the fact that either not all the required tools are available on all OS's or I'm just getting error messages on the automatic deployment that I don't see running them manually.

The most cross-platform friendly method that I've found is to grab a copy of CertUtil.exe and certadm.dll from a copy of XP SP3 that has the admin tools installed and drop that in the same folder as the .cer file, then use the following command lines in a batch file:

certutil.exe -addstore TrustedPublisher cert.cer

certutil.exe -addstore root cert.cer

This works fine manually running the batch file, but comes back with a variety of errors running it automatically.

Is there a better way to do this cross Windows platforms?

I have a Windows Server 2008 SP2 64-bit server currently running the JBoss 4.2.1 web server, which is hosting an Adobe LiveCycle ES2 server, on port 8080.

Have been asked to setup IIS on that box to act as an intermediary between the Java based LiveCycle and a WCF service on a remote server.

As long as the two web servers are listening on separate ports (IIS on 80 and JBoss on 8080) is there any additional configuration likely to be needed to prevent the two clashing?

I have a Windows Server 2003 box already setup and working with IIS 6. IIS is set to serve a site out over both HTTP and HTTPS connections using default ports.

For various reasons I need to set Apache up on the same server and it needs to serve its pages to end-users as SSL encrypted HTTPS pages. Neither IIS or Apache are (or are ever likely to be) particularly high traffic or high usage.

The way I see it there are two possible ways this could be done.

• Either export the SSL cert from IIS,set it up in Apache and get Apache to server the HTTPS connections itself over a non-default port.

  Or use IIS to proxy Apache in some way over it's existing SSL security.

What is going to end up easiest to setup, configure, maintain and run? Which is going to work best? Has anyone done this sort of thing before? Any tips or things to look out for?

Currently looking at deployment options for Windows 7. One of the questions we're looking into is 32 bit vs 64 bit. I'm trying to run a SCCM report against our estate to identify which machines are 64-bit capable (whether or not they're currently running a 64-bit OS).

There seem to be a few resources out on the net for this (here, here and here) but none of them seem to work right on machines running 32-bit Windows XP. 32-bit XP machines seem to always report that they're running on 32-bit hardware.

The query I'm currently running is:

select sys.netbios_name0, sys.Operating_System_Name_and0 as OperatingSystem, 
case when pr.addresswidth0=64 then '64bit OS'
when pr.addresswidth0=32 then '32bit OS'
end as [Operating System Type],
case when pr.DataWidth0=64 then '64bit Processor'
when pr.DataWidth0=32 then '32bit Processor'
end as [Processor Type],
case when pr.addresswidth0=32 and pr.DataWidth0=64 then 'YES'
end as [32-bit OS on x64 processor]
from v_r_system sys
join v_gs_processor pr on sys.resourceid=pr.resourceid

I've also tried this, which reports all "Windows XP Professional" systems are on "X86-based PC", not x64 based even though a number of them definitely are:

select
    OS.Caption0,
    CS.SystemType0,
    Count(*)
from
    dbo.v_GS_COMPUTER_SYSTEM CS Left Outer Join dbo.v_GS_OPERATING_SYSTEM OS on CS.ResourceID = OS.ResourceId
Group by
    OS.Caption0,
    CS.SystemType0
Order by
    OS.Caption0,
    CS.SystemType0

For instance we have a set of Dell Latitude E4200 laptops. Some of these are running 32-bit Windows XP SP3, some of them are running 32-bit Windows 7, some are running 64-bit Windows 7. All the laptops are identical, having come from the same order. Out of these the Windows 7 (32 and 64-bit) report that the hardware is 64-bit capable, and the Windows XP machines report that they're only 32-bit capable.

Does anyone know if there's another value I can query to get the hardware's capabilities correctly on XP, or is there a hotfix that will get it reporting the correct info?

We're running an SCCM (MS System Centre Config Manager, successor to SMS) 2007 environment and delivering a number of applications to clients virtualized using App-V 4.5.1. The App-V apps are delivered by SCCM in Download-and-Execute, not streaming mode.

The SCCM environment was recently service packed to SCCM 2007 SP2 (amongst other things this gives Win7 support). We also pushed out the updated SCCM clients to our workstations. This seems to have broken file associations for virtual apps for a large number of our users. The users can still open their App-V apps by finding the specific app on their Start Menu and clicking it's icon, but double-clicking an associated file in Explorer, or opening an email attachment gives the "This action is only valid for installed applications" error.

There is a Technet blog entry from the App-V team talking about this issue "Upgrade to ConfigMgr 2007 SP2 may break App-V File Type Associations" but running the script there comes back saying "The User Interface option has been updated" but hasn't seemed to fix the problems for any of our users. Unfortunately the Technet blogs don't seem to have comments switched on so you can't see how this has worked out for other people.

Anyone else had this problem, have you found any other way to fix it?

What I need to do is add a few lines to an existing batch file so that it acts differently depending on the machine name.

We have a standardised naming scheme where the first three letters of the machine name indicate the machine type and location. For three of these machine prefixes I want to run a command, for the rest I don't.

What I've got so far is that a command like this will find the characters in the machine name and either return the name, or return nothing depending on whether it matches:

echo %COMPUTERNAME% | FIND /I "UKD"

And using a loop like this will do the same thing but for multiple names:

FOR %%A IN (UKD UKL USD) DO echo %COMPUTERNAME% | FIND /C /I "%%A"

What I haven't figured out is how to use the output from either of those in a IF statement or something similar. Can anyone help me out?