배포 지점의 Protocol

소프트웨어 배포 옵션이 다음과 같은 경우 클라이언트는 배포 지점과 SMB 통신을 한다.

- 'Run program from distribution point' 옵션에서 HTTPS 통신이 실패한 경우
   (Mixed 모드에서 HTTP 통신이 실패한 경우도 동일)
- 배포 지점이 'Allow clients to transfer content from this distribution point using BITS, HTTP, and HTTPS (required for device clients and Internet-based clients)' 옵션이 설정되어 있지 않은 경우

branch distribution points는 사이트 모드에 관계없이 SMB 통신을 한다.



Server Locator Point

다음의 경우 Server Locator Point가 필요없다.
- AD 스키마 확장을 했으며 모든 사이트(하위 포함)의 AD Domain Service에 Publish한 경우
- WORKGROUP 클라이언트나 다른 포리스트의 클라이언트를 관리하지 않는 경우
- 모든 사이트가 인터넷 기반의 클라이언트를 관리하게끔 설정된 경우

다음의 경우 Server Locator Point가 필요하다.
- AD 스키마 확장을 하지 않았거나 모든 사이트(하위 포함)의 AD Domain Service에 Publish하지 않은 경우
- WORKGROUP 클라이언트나 다른 포리스트의 클라이언트를 관리해야 하는 경우

즉, WORKGROUP 클라이언트를 관리하기 위해서는 Server Locator Point가 필요하다~!

OS 배포에 지원되는 운영체제
사전 요구 사항 중에 SCCM Agent를 설치하는 과정이 있으므로 SCCM Agent의 요구 사항과 같겠다.


레퍼런스 이미지 만들기

사전 작업
1. SCCM 관리 콘솔에서 Computer Management > Operating System Deployment > Boot Images > Boot Image (x86 또는 x64) 노드로 이동
2. Boot Image (x86 또는 x64) 속성의 Windows PE 탭에서 'Enable command support (testing only)' 체크
    필요에 따라 설치 시 배경화면을 지정할 수 있다. 회사 로고를 넣는다던지..
3. 각 부트 이미지에 대한 배포 지점을 설정한다.
4. Operating System Deployment > Task Sequences 우클릭 > New > Create Task Sequence Media
5. Capture Media 선택 > Next
6. CD/DVD set 선택, 저장 위치 지정 > Next
7. Boot Image, 배포 지점 선택 > Next > Finish

이미지 생성
1. 레퍼런스 대상 머신 요구 사항
     - 반드시 WORKGROUP 상태여야 한다.
     - Configurations Manager Agent가 설치되어 있어야 한다. (Assign 되어 있을 필요는 없다.) 
     - Windows XP의 경우 C 드라이브의 루트 디렉토리에 sysprep 폴더를 생성하고 파일들이 있어야한다.
2. 레퍼런스 이미지를 저장할 공유 폴더를 생성하고 Everyone Full Access 권한(공유/NTFS)을 준다.
3. 대상 머신에 위에서 생성한 'Task Sequence Media'를 삽입한다.
4. 마법사의 지시에 따라 진행한다. (이미지가 저장될 위치 지정 등)
5. 진행을 완료하면 자동으로 재부팅이 되면서 이미지 생성이 시작된다.



레퍼런스 이미지를 이용한 운영체제 배포

사전 작업
1. State Migration Point를 설치하고 구성한다.
2. Computer Management > Operating System Deployment > Operating System Image > 우클릭 > Add Operating System Image
3. 위 과정에서 생성된 WIM 파일의 위치를 지정하고 마법사에 따라 진행한 후 배포 지점을 설정한다.
4. Computer Management > Software Distribution > Packages에서 SMS Client와 USMT Package를 생성한다.
   (사전에 USMT를 설치해 두어야한다.)
5.  Computer Management > Operating System Deployment > Drivers에서 필요한 드라이버를 추가할 수 있다.

운영체제 배포 Task Sequence 생성
1. Operating System Deployment > Task Sequences > 우클릭 > New > Task Sequence
2. 'Install an existing image package' 선택 > Next
3. Boot Image 선택, Task Sequence 이름 입력 > Next
4. 도메인 가입 여부, 사용자 설정 저장 여부, 추가 프로그램 설치 여부 설정

PXE Service Point 설치 및 구성(PXE Booting을 이용한 배포 시)

PXE 클라이언트를 위한 설정
1. 추가될 머신에 대한 Collection 생성
2. 위에서 생성한 Task Sequence Advertising
     - Make this task sequence available to boot media and PXE 체크
     - Ignore maintenance windows when running program 체크
     - allow system restart outside maintenance windows 체크
     - Priority 설정 : High, Program rerun behavior 설정 : Always rerun program
     - Distribution Points 탭의 Access contents directly.... 선택
     - Interaction 탭의 Show the task sequence progress 체크
3. Operating System Deployment > Computer Association > 우클릭 > Import Computer Information 클릭
4. 배포 대상 서버 정보(MAC Address 등) 입력 후 위에서 생성한 Collection에 할당

또는, 부팅 미디어를 생성해 시디나 USB 부팅 미디어로 만들어 배포도 가능하다.

-       SCCM 설치 중 오류 발생 (Database Monitor)

-       설치 완료 후 Site database로 접근이 되지 않으며 Connecting 창만 유지됨

-       SQL Server의 이벤트 로그에 ANONYMOUS 계정(SCCM 서버 IP)의 인증 실패가 계속해서 기록된다.

SQL Server의 서비스 계정이 Domain 계정이거나 Cluster 구성이 되어 있는 경우 발생한다.

서비스 계정이 Local System인 경우 AD에 자동으로 SPN이 등록되나 Domain 계정인 경우 수동으로 등록해야 한다.

1.     setspn -A MSSQLSvc/<FQDN> <SQL_Service_Account>

2.     setspn -A MSSQLSvc/<FQDN>:1433 <SQL_Service_Account>

3.     setspn –L <SQL_Service_Account>

4.     SQL 서비스 계정의 위임 설정

다음 쿼리를 이용해 현재 접속한 세션의 인증 유형을 확인할 수 있다.

select session_id,auth_scheme,client_net_address from sys.dm_exec_connections

1. Site Server < -- > Site Server

2. Primary Site Server -- > Domain Controller

3. Site Server < -- > Software Update Point

(See note 6, Communication between the site server and site systems)

4. Software Update Point -- > Internet

5. Site Server < -- > State Migration Point

(See note 6, Communication between the site server and site systems)

6. Client -- > Software Update Point

7. Client -- > State Migration Point

8. Client -- > PXE Service Point

9. Site Server < -- > PXE Service Point

(See note 6, Communication between the site server and site systems)

10. Site Server < -- > System Health Validator

(See note 6, Communication between the site server and site systems)

11. Client -- > System Health Validator

The client requires the ports established by the Windows Network Access Protection client, which is dependent upon the enforcement client being used. For example, DHCP enforcement will use ports UDP 67 and 68. IPSec enforcement will use ports TCP 80 or 443 to the Health Registration Authority, port UDP 500 for IPsec negotiation and the additional ports needed for the IPsec filters. For more information, see the Windows Network Access Protection documentation. For help with configuring firewalls for IPsec, see http://go.microsoft.com/fwlink/?LinkId=109499.

12. Site Server < -- > Fallback Status Point

(See note 6, Communication between the site server and site systems)

13. Client -- > Fallback Status Point

14. Site Server -- > Distribution Point

15. Client -- > Distribution Point

16. Client -- > Branch Distribution Point

17. Client -- > Management Point

18. Client -- > Server Locator Point

19. Branch Distribution Point -- > Distribution Point

20. Site Server -- > Provider

21. Server Locator Point -- > Microsoft SQL Server

22. Management Point -- > Microsoft SQL Server

23. Provider -- > SQL Server

24. Reporting Point -- > SQL Server / Reporting Services Point -- > SQL Server

The reporting point and the Reporting Services point use the same ports. The Reporting Services point is applicable to Configuration Manager 2007 R2 only.

25. Configuration Manager Console -- > Reporting Point

26. Configuration Manager Console -- > Provider

27. Configuration Manager Console -- > Internet

28. Primary Site Server -- > Microsoft SQL Server

29. Management Point -- > Domain Controller

30. Site Server -- > Reporting Point / Site Server -- > Reporting Services Point

The reporting point and the Reporting Services point use the same ports. The Reporting Services point is in Configuration Manager 2007 R2 only.

31. Site Server -- > Server Locator Point

(See note 6, Communication between the site server and site systems)

32. Configuration Manager Console -- > Site Server

33. Software Update Point -- > WSUS Synchronization Server

34. Configuration Manager Console -- > Client

35. Management Point < -- > Site Server

(See note 6, Communication between the site server and site systems)

36. Site Server -- > Client

37. Configuration Manager client -- > Global Catalog Domain Controller

A Configuration Manager client does not contact a global catalog server when it is a workgroup computer or when it is configured for Internet-only communication.

38. PXE Service Point -- > Microsoft SQL Server

39. Site Server < -- > Asset Intelligence Synchronization Point (Configuration Manager 2007 SP1)

40. Asset Intelligence Synchronization Point < -- > System Center Online (Configuration Manager 2007 SP1)

41. Multicast Distribution Point -- > Microsoft SQL Server(Configuration Manager 2007 R2)

42. Client status reporting host --> Client (Configuration Manager 2007 R2)

43. Client status reporting host --> Management Point (Configuration Manager 2007 R2)

44. Client status reporting host --> Microsoft SQL Server (Configuration Manager 2007 R2)

45. Site Server < -- > Reporting Services Point (Configuration Manager 2007 R2)

(See note 6, Communication between the site server and site systems)

46. Configuration Manager Console -- > Reporting Services Point (Configuration Manager 2007 R2)

47. Reporting Services Point -- > Microsoft SQL Server (Configuration Manager 2007 R2)

Notes

1 Proxy Server port    This port cannot be configured but can be routed through a configured proxy server.

2 Alternate Port Available    An alternate port can be defined within Configuration Manager for this value. If a custom port has been defined, substitute that custom port when defining the IP filter information for the IPsec policies.

3 RAS Sender    Configuration Manager 2007 can also use the RAS Sender with Point to Point Tunneling Protocol (PPTP) to send and receive Configuration Manager 2007 site, client, and administrative information through a firewall. Under these circumstances, the PPTP TCP 1723 port is used.

4 Windows Server Update Services    WSUS can be installed either on the default Web site (port 80) or a custom Web site (port 8530).

After installation, the port can be changed.

If the HTTP port is 80, the HTTPS port must be 443.

If the HTTP port is anything else, the HTTPS port must be 1 higher—for example 8530 and 8531.

5 Trivial FTP (TFTP) Daemon    The Trivial FTP (TFTP) Daemon system service does not require a user name or password and is an integral part of the Windows Deployment Services (WDS). The Trivial FTP Daemon service implements support for the TFTP protocol defined by the following RFCs:

• • RFC 350—TFTP
• • RFC 2347—Option extension
• • RFC 2348—Block size option
• • RFC 2349—Time-out interval, and transfer size options

Trivial File Transfer Protocol is designed to support diskless boot environments. TFTP Daemons listen on UDP port 69 but respond from a dynamically allocated high port. Therefore, enabling this port will allow the TFTP service to receive incoming TFTP requests but will not allow the selected server to respond to those requests. Allowing the selected server to respond to inbound TFTP requests cannot be accomplished unless the TFTP server is configured to respond from port 69.

6 Communication between the site server and site systems    By default, communication between the site server and site systems is bi-directional. The site server initiates communication to configure the site system, and then most site systems connect back to the site server to send back status information. Reporting points and distribution points do not send back status information. If you select Allow only site server initiated data transfers from this site system on the site system properties, the site system will never initiate communication back to the site server.

7 Ports used by distribution points for application virtualization streaming    A distribution point enabled to support application virtualization can be configured to use either HTTP or HTTPS. This feature is available in Configuration Manager 2007 R2 only.

Configuration Manager Remote Control Ports

When you use NetBIOS over TCP/IP for Configuration Manager 2007 Remote Control, the ports described in the following table are used.

AMT Out of Band Management Ports (Configuration Manager 2007 SP1)

When you use the out of band management feature in Configuration Manager 2007 SP1, the following ports are used.

A. Site Server <--> Out of Band Service Point

B. AMT Management Controller --> Out of Band Service Point

C. Out of Band Service Point --> AMT Management Controller

D. Out of Band Management Console --> AMT Management Controller

Ports Used by Windows Servers 

The following table lists some of the key ports that Windows Server uses and their respective functions. For a more complete list of Windows Server services and network ports requirements, see http://go.microsoft.com/fwlink/?LinkID=123652.

Connecting with Microsoft SQL Server

If you use the TCP/IP Net-Library, enable port 1433 on the firewall. Use the Hosts file or an advanced connection string for host name resolution.

If you use named pipes over TCP/IP, enable port 139 for NetBIOS functions. NetBIOS should be used only for troubleshooting Kerberos issues.

By default, SQL Server uses TCP (not UDP) port 1433 to listen on TCP/IP. To change the port, run SQL Server Setup on the server, and then click Change Network Support. If SQL Server uses port 1433, the client Net-Library works. If SQL Server uses a custom port number, the client must specify that port in the Data Source Name (DSN).

Microsoft does not recommend that you enable UDP ports 137 and 138 for NetBIOS name resolution by using B-node broadcasts. Instead, you can use a WINS server or an LMHOSTS file for name resolution.

Installation Requirements for Internet-Based Site Systems

The Internet-based management point, software update point, and fallback status point use the following ports for installation and repair:

• Site server --> site system: RPC endpoint mapper using UDP and TCP port 135.
• Site server --> site system: RPC dynamic TCP ports.
• Site server < --> site system: Server message blocks (SMB) using TCP port 445.

Distribution points do not install until the first package is targeted to them. Package installations on distribution points require the following RPC ports:

• Site server --> distribution point: RPC endpoint mapper using UDP and TCP port 135.
• Site server --> distribution point: RPC dynamic TCP ports.

 http://technet.microsoft.com/en-us/library/bb632618.aspx