Configuration Manager Compliance Settings – Turning Off Auto-Remediation

I’m often asked by both students and consulting clients about Configuration Baselines and Items in Configuration Manager 2012. These existed in Configuration Manager 2007 under the name Desired Configuration Management. Compliance Settings in 2012, which include Configuration Items and Baselines, is great feature and I find often under-appreciated.

The Client Agent in Configuration Manager 2012 includes a great new feature that performs a check to ensure that critical client components and prerequisites are installed and functioning. The reason this is nice should be obvious to any ConfigMgr administrators who have ever had to deal with a client computer with a corrupted WMI database. The client health task, which you will actually find as a scheduled task on Configuration Manager 2012 client computers, runs regularly, will identify and in many cases automatically repair a failed client, Prior to this feature, ConfigMgr administrators spent a lot of time searching for and manually repairing these failed clients.

There are times however when auto-remediation of the Configuration Manager client is not desirable. For instance on a Server. You may not want the CCMEval task to automatically make changes to Windows Management Instrumentation on a server as it might affect other services being hosted on that server. Fortunately it’s a relatively simple fix if you want to disable this auto-remediation. It’s also a great example of Compliance Settings in action.

Read more of this post

Microsoft Security Compliance Manager

The Microsoft Solution Accelerators team has a great product – the “Microsoft Security Compliance Manager”. One of the problems many of us face is evaluating which systems do, and which do not comply with our corporate expectations. For instance, which systems have invalid firewall configurations, which systems do not have a valid antivirus product installed, or which systems have administrator accounts with non-expiring passwords. Performing compliance audits of workstations or servers has been a bit challenging and Security Compliance Manager (SCM) can help.

Read more of this post

Desired Configuration Management in SCCM

Configuration Manager’s Desired Configuration Management (DCM) functionality can be a bit confusing at first look, but really it’s a simple and powerful feature. DCM allows you to define corporate system configuration expectations, and then have Configuration Manager Client test for compliance and report back to your Configuration Manager site.

Read more of this post