Windows Firewall Settings for Configuration Manager Clients

The following sections list the features of Configuration Manager 2007 which require exceptions to be made on the Windows Firewall and provide a procedure for configuring these exceptions.

Modifying the Ports and Programs Permitted by Windows Firewall

To modify the ports and programs permitted by Windows Firewall:

1. On the computer running Windows Firewall, open Control Panel.
2. Right-click Windows Firewall and click Open.
3. On the Exceptions tab of the Windows Firewall Settings dialog box, select enable any required exceptions in the list box, or Click Add Program or Add Port to create custom programs or ports

Programs and Ports Required by Configuration Manager 2007

The following Configuration Manager 2007 features require exceptions to be made on the Windows Firewall:

Queries

If you are running the Configuration Manager console on a computer running Windows Firewall, queries will fail the first time they are run.

After failing to run the first time, the operating system displays a dialog box asking if you want to unblock statview.exe. If you unblock statview.exe, future queries will run without errors. You can also manually add statview.exe to the list of programs and services on the Exceptions tab of the Windows Firewall prior to running a query.

Client Push Installation

In order to successfully use client push to install the Configuration Manager 2007 client, you must add the following as exceptions to the Windows Firewall:

·         File and Printer Sharing 

·         Windows Management Instrumentation (WMI) 

Client Installation using Group Policy

In order to successfully use Group Policy to install the Configuration Manager 2007 client, you must add File and Printer Sharing as an exception to the Windows Firewall.

Client Requests

In order for client computers to communicate with Configuration Manager 2007 site systems, you must add the following as exceptions to the Windows Firewall:

TCP Port 80 (for HTTP communication)

TCP Port 443 (for HTTPS communication)

Network Access Protection

In order for client computers to successfully communicate with the system health validator point, you need to allow the following ports:

·         UDP 67 and UDP 68 for DHCP

·         TCP 80/443 for IPsec

Remote Control

In order to use the remote tools features of Configuration Manager 2007, you need to allow the following ports:

·         TCP port 2701

·         TCP port 2702

·         TCP port 135

Remote Assistance and Remote Desktop

To enable Remote Assistance to be initiated from the SMS Administrator console, add both the custom program helpsvc.exe and the custom port TCP 135 to the list of permitted programs and services in Windows Firewall on the client computer. Also, Windows Firewall must be configured to permit Remote Assistance and Remote Desktop. If a user initiates a request for Remote Assistance from that computer, Windows Firewall will automatically be configured to permit Remote Assistance and Remote Desktop.

Windows Event Viewer, Windows Performance Monitor and Windows Diagnostics

To enable Windows event viewer, Windows performance monitor and Windows diagnostics to be accessed from the Configuration Manager console, you must enable File and Printer Sharing as an exception on the Windows Firewall.

Comparing SMS 2003 , SCCM 2007 and SCCM 2012

Features	SMS2003	SCCM2007	SCCM 2012
Hardware & Software Inventory	ü	ü	ü
Automatic Client Health Remediation			ü
Software Distribution	ü	ü	ü
Computer based targeting	ü	ü	ü
User based targeting		ü*P	ü
State-based Application Distribution			ü
Self-service portal			ü
App-V Package Deployment		ü	ü
Xen-App Package Deployment			ü
Uninstallation via Software Center			ü
User-Device Affinity			ü
Distribution Point Groups			ü
Boundary Groups			ü
Application Revision History			ü
Content Management			ü
Software Updates	ITMU	Via WSUS	Via WSUS
3rd party application		ü	ü
Automatic Software Updates Deployment Rules			ü
Automatic clean-up of Superseded and Expired Updates			ü
Software Metering	ü	ü	ü
Collection-based Policies			ü
Remote Administration	Remote Tools	Remote Tools & Remote Desktop	Remote Tools + Ctrl-Alt-Del
Reporting	Basic	Basic & SQL Reporting	SQL Reporting Services
Administrator Console	ü	ü	ü
User-friendly ribbon			ü
Status reporting		ü*P	ü
Agent Managed	ü	ü	ü
Integrate with Active Directory	ü	ü	ü
Automatic Boundary Discovery			ü
Forest Discovery			ü
Discovery of Computers	ü	ü	ü
Operating System Deployment		ü	ü
Offline Servicing of OS Image			ü
Task Sequence		ü	ü
Maintenance Windows		ü	ü
Desired Configuration Management		ü	ü
Automatic Remediation of Configuration Drift			ü
Internet Based Client Management		ü	ü
Integration with Windows Server 2008 Network Access Protection		ü	ü
Intel vPro Intergration		ü SP1	ü
Role-based Access Control			ü
Power Management		ü R3	ü
User Power Management Opt-out			ü
Windows Mobile Device Management		ü	ü
Non-Windows Mobile Device Management			ü

Note: *P = Partial

"Download update copy queue BITS" keeps on logging the messages in ccmexec.log while doing client push in SCCM 2007

For Windows XP Machines.

1.       Locate a Windows XP CD, and extract the file BITSAdmin.exe from the Support.cab file located in the Support\Tools folder on the CD.

2.       If you run the command "bitsadmin.exe /list /allusers" you'll see all the jobs that are in the BITS queue for processing.

3.       Simply running the command "bitsadmin.exe /reset /allusers" clears out this queue completely.

4.       Finally, reboot the computer and then try installing the SCCM agent software again.

Cross verify the settings at sccm server side

  

Why does the package go for Self Healing first time the user launches the Application?

If the package is containing some HKCU entries then the package will always go for self healing for the first time. This happens because the HKCU keys are only installed for the current user present while installing the package and not all the users as it is the property of the HKCU. So, if other user logs in then there is a mismatch between the current system state and the value specified in the MSI package (e.g., a key file is missing), then the related feature is re-installed. This is called the Self Healing.

Which one will execute first is Run or Active setup?

The answer is “Active setup”.

Because,  Activesetup is using to configure the userprofile settings if no entry points exists in the package and this will be running only once for a specific user.
Where as RUN key will execute everytime when user login the machine.

These settings are configured with different sequence , in order to speedup to get access to windows desktop\user level settings.