Do SCCM clients need to be domain joined for Windows Patch Deployments

Hi,
We have SCCM 2012 R2 deployed in an environment with both workgroup and domain joined machines. Currently only the domained joined machines have the SCCM client installed. We were thinking of bringing patching into SCCM rather than WSUS but were wondering
if we install the SCCM client on workgroup machines do they need to be domain mebers to work or do they just need to be able to resolve the SCCM server?BAsically, I'm looking for confimation that we can patch non-domain joined machines via SCCM.
Thanks,
Simon

Here's a nice blog post that adds some gotcha and additional detail:
http://blogs.technet.com/b/configurationmgr/archive/2014/07/01/managing-workgroup-clients-in-system-center-2012-configuration-manager.aspx
Ultimately, ConfigMgr doesn't care if systems are domain joined or not but there are some nuances and caveats that must be accounted for.
Jason | http://blog.configmgrftw.com | @jasonsandys

Similar Messages

Hello everyone! I'm having a trouble... I need to download Adobe Illustrator for windows 8, but i'm not able for doing that. Can you help me Please?

Hello everyone! I'm having a trouble... I need to download Adobe Illustrator for windows 8, but i'm not able for doing that. Can you help me Please?

Downloadable installation files available:
Suites and Programs: CC 2014 | CC | CS6 | CS5.5 | CS5 | CS4, CS4 Web Standard | CS3
Acrobat: XI, X | 9,8 | 9 standard
Premiere Elements: 13 | 12 | 11, 10 | 9, 8, 7 win | 8 mac | 7 mac
Photoshop Elements: 13 |12 | 11, 10 | 9,8,7 win | 8 mac | 7 mac
Lightroom: 5.7.1| 5 | 4 | 3
Captivate: 8 | 7 | 6 | 5.5, 5 | 1
Contribute: CS5 | CS4, CS3 | 3,2
FrameMaker: 12, 11, 10, 9, 8, 7.2
Download and installation help for Adobe links
Download and installation help for Prodesigntools links are listed on most linked pages. They are critical; especially steps 1, 2 and 3. If you click a link that does not have those steps listed, open a second window using the Lightroom 3 link to see those 'Important Instructions'.

Failed to Configured Domain Services for Windows

Hi!
I am installing OES 2 SP3 with DSfW Pattern as a "New Domain Controller in an Existing Domain Services for Windows Domain" with Replication Configuration and Schema Partition.
During the "Perform eDirectory Configuration" at last task "Configure Domain Services for Windows " at 93% we encountered an error: "Failed to configure Domain Services for Windows".
Here's details of error ;
command : perl /opt/novell/xad/sbin/ndsdcinit.pl retry full-replica -d 'vec.apd.com.ph' -l 'ou=OESSystemObjects,dc=vec,dc=apd,dc=com,dc=ph'
-g 'ou=OESSystemObjects,dc=vec,dc=apd,dc=com,dc=ph' -f 'apd.com.ph' -p 'apd.com.ph' -o 192.168.81.92 -t
Could not create gss directory /etc/opt/novell/xad/gss at /opt/novell/xad/sbin/ndsdcinit.pl line 463, line 652
LDAP Based utility [ndsConfigServerContext.sh] to retrieve server context for YaST
DomainName : vec.apd.com.ph
NdsAdminName : CN=Administrator,CN=Users,DC=vec,DC=apd,DC=com,DC= ph
ExistingServerIP : ANDROMEDA.vec.apd.com.ph
ExistingServerPort : 0
Add_DC : true
Returning server context->ou=OESSystemObjects.dc=vec.dc=apd.dc=com.dc=ph
LDAP Based utility [ndsConfigServerContext.sh] to retrieve server context for YaST
DomainName : vec.apd.com.ph
NdsAdminName : CN=Administrator,CN=Users,DC=vec,DC=apd,DC=com,DC= ph
ExistingServerIP : ANDROMEDA.vec.apd.com.ph
ExistingServerPort : 0
Add_DC : true
Returning server context->ou=OESSystemObjects.dc=vec.dc=apd.dc=com.dc=ph
SASL/GSS-SPNEGO authentication started
SASL SSF: 56
SASL installing layers
Failed to fetch dNIPDNSZones from DNS_LOCATOR_OBJECT at /opt/novell/xad/lib64/perl/Install/adc_install.pm line 503
at /opt/novell/xad/lib64/perl/Logger.pm line 119
Logger::_err('Failed to fetch dNIPDNSZones from DNS_LOCATOR_OBJECT at /opt/...') called at /opt/novell/xad/lib64/perl/Logger.pm line 202
Logger::Log(0, 'Failed to fetch dNIPDNSZones from DNS_LOCATOR_OBJECT at /opt/...') at /opt/novell/xad/lib64/perl/Install/adc_install.pm line 532
adc_install::decide_domain_zones() called at /opt/novell/xad/lib64/perl/install/adc_install.pm line 150
adc_install::stage_domain('adc_install=HASH (0X8b9370)') called at /opt/novell/xad/sbin/ndsdcinit.pl line 1383
main::main(62, 'apd.com.ph', 'vvec.apd.com.ph', 'TRUE','ou=OESSystemObjects,dc=vec,dc=apd,dc=com,d c=ph','ADM_PASSWD_DOMAIN','ou=OESSystemObjects,dc= vec,dc=apd,dc=com,dc=ph','replops::DESTROY',
'APD.COM.PH',...) called at /opt/novell/xad/sbin/ndsdcinit.pl line 1301
main::main() called at /opt/novell/xad/sbin/ndsdcinit.pl line 1425
ENV PATH = /opt/novell/xad/sbin:/opt/novell/xad/bin:/opt/novell/xad/share/dcinit:/opt/novell/eDirectory/bin:
LIB=lib64
LD LIBRARY PATH =
/opt/novell/xad/lib64:/opt/novell/xad/lib64/nds-
modules:/opt/novell/eDirectory/lib64:/opt/novell/eDirectory/lib64/nds-modules
SASL PATH = /opt/novell/xad/lib64/sasl2
DCINIT CONFIG: /etc/opt/novell/xad/xad.ini
DOMAIN NAME: vec.apd.com.ph
PARENT NAME: apd.com.ph
FOREST NAME: apd.com.ph
NETBIOS NAME: VEC
Any ideas on this error ?
Regards. Thanks.
denzmo

Thanks for the reply.
I have some followup questions
2. Can you explain the DNS setting in your setup ?
Tree ---> Power--> apd.com.ph -- dlpc.apd.com.ph
-- vec.apd.com.ph -- Andromeda.vec.apd.com.ph (DNS)
-- Pictor.vec.apd.com.ph ( additional domain server ) -> "Failed to configure in DSFW"
1. apd.com.ph, dlpc.apd.com.ph, vec.apd.com.ph are DSfW domains or just DNS domains ?
2. Andromeda.vec.apd.com.ph (DNS) - is this the DC of a DSfW domain ?
3. You are adding the Additional domain controller to the vec.apd.com.ph domain right ?
The
# LDAPCONF=/etc/opt/novell/xad/openldap/ldap.conf /usr/bin/ldapsearch -Y EXTERNAL -s sub -b dc=ph "(objectclass=dniplocator)" dn
Heres the result ;
a.) running the command in the DNS server (child domain) ANDROMEDA;
SASL /EXTERNAL authentication started
SASL username: gidNumber=0+uidNumber=0, cn=peercred,cn=external,cn=auth
SASL SSF: 0
# extended LDIF
# LDAPv3
# base <dc=ph(objectclass=dniplocator) [email protected]> with scope subtree
# filter: (objectclass=*)
# requesting:ALL
# search result
search : 2
result : 32 No such object
text : NDS error : no such entry (-601)
# numResponses :1
This is strange. This ldapsearch is failing to find the locator object in the tree under dc=ph.
- Can you try this same command from your FRD DC too and find the result ?
- Is your server non-name mapped or your adding a DSfW server into an existing eDirectory tree (name mapped) ?
- If it is later can you try the same search with '-b' parameter replaced with container to which FRD is mapped to into the eDirectory Tree.
- Can you tell in your setup where are the locator object present for your first DSfW server which is acting as DNS server ?
- While installing this ADC server, you have given the remote dns server as 192.168.81.92. In the YaST DNS screen did you do retrieve (by clicking 'retrieve' button on the screen ) or you entered those inputs manually ?
- Another follow up question. The locator context provided to the ndsdcinit command in your first post, is 'ou=OESSystemObjects,dc=vec,dc=apd,dc=com,dc=ph'. Can you confirm your locator
context is correct ?
[/QUOTE]
b.) running the command in the ADC PICTOR;
SASL /EXTERNAL authentication started
ldap_sasl_interactive_bind_s: invalid credentials (49)
[/QUOTE]
This is expected as the server is not completely configured.
Please get it touch with our NTS for passing on more information about this setup.

SCCM Client PC's failing to download/install Windows Updates

Hi,
Last month I noticed that our client PC's, shortly after they had built (using SCCM Task Sequence) were downloading and installing Windows Updates using the usual Windows Update process. What I mean is, I had Software Centre showing Updates as installing,
but also had the Windows Update agent installing various updates. It was also showing in the start menu (Yellow icon saying Shut down and install updates). Now my understanding is, that that shouldn't of been happening, and only SCCM/Software Centre should
be showing Windows Updates as installing.
I noticed that we had some GPO's set for Windows Updates, which I have disabled, as I believed these were not necessary. Also, I like to control my Updates via SCCM Software Update groups after testing them, and not just allow clients to grab any updates
that are required and approved.
My problem now is, none of the clients are getting/installing any updates. I'm getting the following errors in the WUAHandler.log:
Unable to read existing WUA resultant policy. Error = 0x80070002.
WUAHandler
09/04/2015 19:03:29
8732 (0x221C)
Group policy settings were overwritten by a higher authority (Domain Controller) to: Server and Policy NOT CONFIGURED
WUAHandler
09/04/2015 19:03:29
8732 (0x221C)
Failed to Add Update Source for WUAgent of type (2) and id ({FC358571-80C5-4EAA-8A33-F79AD4C14785}). Error = 0x87d00692.
WUAHandler
09/04/2015 19:03:29
8732 (0x221C)
So, I've checked in:
HKLM\Software\Policies\Microsoft\Windowa\WindowsUpdate\ & HKLM\Software\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate
and neither have a WSUS server set. I'm assuming this is correct?
RSOP shows all policies in \\Computer Configuration\Administrative Templates\Windows Components\Windows Update as
DISABLED
GPEDIT shows \\Computer Configuration\Administrative Templates\Windows Components\Windows Update\Specify intranet Microsoft update service location as
Enabled and as our server (https://XXX.XXX:8531) - I'm assuming this is what SCCM client sets as if I changed this setting and then restart the setting comes back. If it was a Group Policy conflict then I
would expect to see it in RSOP.
Does anyone have any suggestions? I'm puzzled as to what to look at next. Is my first assumption of having 0 group policies configured for WSUS correct? Am I also correct in assuming Windows Updates shouldn't show in Control panel, or at the Start > Shutdown
prompt, and only show in Software Centre?
Thanks, and sorry for the long winded post!

Hey Jason,
Thanks for replying and explaining the WUA stuff. That made sense to be but my mind was being clouded by the issue all of the PC's/Clients onsite were, and are still getting. I cleared out the Group Policy cache as detailed on the link.
- Cleared C:\Program Data\Microsoft\Group Policy\History\*.*
- Ran a gpupdate /force
- Restarted PC
Issue still remains. Here is the output from the WUAHandler.log
CWuaHandler::SetCategoriesForStateReportingExclusion called with E0789628-CE08-4437-BE74-2495B842F43B;E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3; for leaves and E0789628-CE08-4437-BE74-2495B842F43B,A38C835C-2950-4E87-86CC-6911A52C34A3;
for bundles
WUAHandler 13/04/2015 16:14:34 2508 (0x09CC)
Its a WSUS Update Source type ({FC358571-80C5-4EAA-8A33-F79AD4C14785}), adding it. WUAHandler 13/04/2015 16:15:02 2488 (0x09B8)
Unable to read existing resultant WUA policy. Error = 0x80070002. WUAHandler 13/04/2015 16:15:02 2488 (0x09B8)
Enabling WUA Managed server policy to use server: https://(Name.domain of our SCCM SUP):8531 WUAHandler 13/04/2015 16:15:02 2488
(0x09B8)
Waiting for 2 mins for Group Policy to notify of WUA policy change... WUAHandler 13/04/2015 16:15:02 2488 (0x09B8)
Unable to read existing WUA resultant policy. Error = 0x80070002. WUAHandler 13/04/2015 16:15:11 2488 (0x09B8)
Group policy settings were overwritten by a higher authority (Domain Controller) to: Server and Policy NOT CONFIGURED WUAHandler 13/04/2015 16:15:11 2488 (0x09B8)
Failed to Add Update Source for WUAgent of type (2) and id ({FC358571-80C5-4EAA-8A33-F79AD4C14785}). Error = 0x87d00692. WUAHandler 13/04/2015 16:15:11 2488 (0x09B8)

Windows 7 clients need to update printer driver for no reason

I have a problem with my Windows 7 clients in domain. We have 2012 print server and multiple printers installed on it. I installed a brand new Canon IR printer with a new driver from Canon webpage. After I did that, almost all Windows 7 clients got a warning
that they need to update driver for printing. Those clients are NOT using the printer I installed, but the other ones (who worked fine until my installation). Is it possible that installing new printer cause other compatible printers to update themselfs???
Can I avoid it in the future?

Hi IvanSa83,
The main issue is that installing a new printer will affect other printers, right?
Here is a similar symptom and the environment is Windows 7 ,Windows 2003 Server. The OP in this case has resolved this issue by modifying the Group policy called “Point and Print Settings Restrictions”. This policy will influence Windows Vista and the later
version.
As the link posted by OP said: When an administrator updates a printer driver on a shared print server, the Point and Print feature automatically updates printer drivers from the print server to a client computer. Some printers may share driver files
across several printer models or across a family of printers. An update to one of these shared driver files will cause client computers to update the drivers for any device that depends on the updated files.
Here is the case link :
Windows 7 client "Driver update required" status when other printers installed / updated on Win Server 2003
https://social.technet.microsoft.com/Forums/en-US/3c8d8c6f-b216-464d-92b7-ef94838ae36b/windows-7-client-driver-update-required-status-when-other-printers-installed-updated-on-win?forum=winserverprint
Here is the group policy path: Computer Configuration \Administrator Templates\Printers
Best regards

Windows 7 domain joined getting Windows 10 upgrade!!

I was building a reference image the other day for Windows 7 (we still want to use Windows 7 for "legacy" P4 machines) and it had activated itself via our KMS server and for some reason it would still show the Windows 10 Upgrade notification even though the upgrade doesn't (apparently) support KMS so it does seem there are some glitches with the update.
Also, I could understand not using WSUS in that case if its only a small collection of computers and it seems they do most work inside the XenApp server which I would hope. Although, it does sound like you have a server over there so it might be worth implementing if you ever make the move to Windows 10 as they are creating some sort of new solution that I believe is called "Windows Update for Business."

Hi,
We have several computers that are not using WSUS and are Domain Joined that are trying to upgrade to Windows 10 automatically. Luckily they are failing but it has downloaded Windows 10 into the $Windows.~BT folder.
I checked the GWX event logs and says they are Domain Joined and I know they are not suppose to get Windows 10.
I think it is to do with KB2952664 as the computers that got the Windows 10 upgrade seem to have not restarted since this re-released patch was out.
Has anyone else had this happen? I've tried search with no joy.
Even though it is failing to preform the Upgrade now we are worried that Microsoft will make a change or something will happen and the upgrade will complete...
Aaron
This topic first appeared in the Spiceworks Community

IPrint client 5.92 Hangs on install for Windows 8.1

We are trying to implement windows 8.1 into our tablet environment. while setting up printing to the client devices i'm running into deployment issues with the iPrint client 5.90 and 5.92, both seem to hang on the spooler update portion of the install, and are unable to recover. I have had one finish with an error stating that the spooler service did not respond in a timely manner to the startup command. however even after manually starting the spooler service the client was not installed. Any Help or hints would be most appreciated.

Simon Flood Wrote in message:
> as some server side
> fixes are also required for OES servers.
Those server-side fixes for OES11 SP1 to support Windows 8.1 (and
OS X Mavericks) are now available via the patch channel and to
download[1] .
Note iPrint Client for Windows 5.94[2] and for Mac 5.74[3] are now
also available for download.
HTH.
[1] http://download.novell.com/Download?...d=tcwN_L2cVfs~
[2] http://download.novell.com/Download?...d=Tp8Zo0xBq9o~
[3] http://download.novell.com/Download?...d=qns75-pFv7s~
Simon
Novell Knowledge Partner
----Android NewsGroup Reader----
http://www.piaohong.tk/newsgroup

Do I need to partition storage space for windows 7 software?

I'm still debating if I should sell my Alienware and buy a MB Pro Ret and my main questions is concerning storage space.
I know that MBP can't compare to an Alienware gaming system but I hardly have time for that stuff anymore. I might play Skyrim every now and then, but that is the only game I care for really. I mainly want to have a light weight reliable laptop.
So... because I have so much software for my windows system now, I was looking into transferring that to the MBP. Lightroom 4, AutoCAD, Word and Exel, Photoshop... ext. ext. Which brings me to question:
Can I partition 50GB for the OS only and install all the software I have on that drive even if it wont fit on the Windows 7 partition?
In other words
Do I have to calculate how much space all my programs will take up for Windows 7 and partition that amount or do I only need enough space for the OS?
I have never owned a Mac and am not familiar with the OS, I was debating if I should partition 500Gigs and slowly transition from Windows to iOS and maybe one day get rid of the Windows partition and just have the iOS on there.
I don't know... that's why I am here... Apple has a great community so let the advising commence... haha.
Thanks for the help.
Dallo
Forgot to mention: If I do get a MBPR it will be the 2.6GHz, 16GB Ram and 512GB Flash

It's recommended to create the partition with enough space for your programs, but if you create a very small partition, install Paragon Camptune X or WinClone to resize the Windows partition

Oracle client version 9.2.0.3 for windows 2000

Where can you find oracle client for 9.2.0.3 for windows 2000? Please advice.
Thank you,
Shawn

Shawn,
Instant Client was released in 10gR1 (10.1.0.2). Thus, it is not available for 9.2.0.3.

Need PSE 5 or 6 for Windows

I am really hoping someone can help me here...I need a copy of PSE 5 or 6 for Windows.
I am currently running Photoshop Starter Album 3.2 and just bought Lightroom 2.0. To get my catalog from the former to the latter, I need PSE 5 or 6. Lightroom apparently doesn't support a conversion from PSE 7. ACK. Do you know of anywhere online that still has a copy of these older versions? I'm on hold with Adobe customer support right now, but I thought I'd throw out a plea to the forums too.
Thanks!

If you live in the US, you can get Photoshop Elements 6 with the purchase of a Wacom tablet on all but the least expensive Bamboo model.
Link to the cheapest model "Bamboo Fun" that includes Photoshop Elements 6 with Americas selected as region:
http://www.wacom.com/bambootablet/bamboofun.php
It's listed under the tab at the bottom of the page that says "What's Inside".
Note: If you are in Europe, Photoshop Elements isn't included. If from somewhere else, check your region to see if it is included in the bundle.

I need to install creative suites for windows on my mac

is there a driver or something i can download to transfer my creative suite 5 premium for windows on my mac??

you'll need to cross-grade your suite: http://helpx.adobe.com/x-productkb/policy-pricing/order-product-platform-language-swap.htm l

Offline domain join for MDT 2012 media based deployments at offsite

Hi,
How do we bring device into domain in media based deployments for offsite (device doesn't have access to the domain network) devices?
I am planning to run media based TS, shutdown the device (using shutdown command line in TS), adding step for 'recover from domain' after shutown step.
TS is working fine but it loose the continuity and gives an message that there already been deployment running on this device, do you want to continue(yes\No). If I click on NO, it proceed further with 'recover from domain'. Is there any step that I can
run before shutdown that can store the current status for TS and continue clean once system boot onsite ?
Regards,

The simple answer is: two Task Sequences.
The first would be to put the WIM on the machine, do any config you need and install any applications that can be installed sans network. This would be an Offline Media Task Sequence that you would run with the USB stick and no network connection.
This Task Sequence wouldn't join the domain, but would be configured to join a Workgroup. Name it like MDT-ConfigImage or something so you can easily spot devices on your network that haven't yet run TS#2.
The second would a Task Sequence to just run the join domain command, maybe run Windows Update (now that it's presumably connected to a WSUS server) and install any apps that require a connection to the network (hopefully none). This Task Sequence
would be pretty simple and could be launched via LiteTouch.vbs directly or configured to be booted from, then have the TS boot the full OS already installed (from Task Sequence #1) and "complete the configuration."
Keeping it as two has the added ability to quickly modify and update TS#2 without needing to regenerate your Offline Media for TS#1 and provide to whoever is doing that imaging. This is effectively what happens with some of the vendors (like Dell)
when they image your machine with your image in their config center and then they send you the box and you "finish it" on network (while it can join domain, etc.).
David Coulter | http://DCtheGeek.blogspot.com |
@DCtheGeek

Pushed my site live, need to modify domain records for Gmail

Was able to push my site live and now the site domains in site settings has all the correct settings for
www.mydomain,com going to start page, mydomain.worldsecuresystems.com going to start page, mydomain.com forwarding to www.mydomain.com, and mydomain.businesscatalyst.com going to start page.
Somewhere in the process of connecting the domain name with the test site, i said that Gmail would be used. in the mx records listed in Site Domains in my BC dashboard show the 5 standard google servers (aspmx.l.google.com, alt2.aspmx.l.google.com, etc)
I added a CNAME record for mail.mydomain.com to point to ghs.googlehosted.com
now, when i browse to www.mydomain.com or mydomain.com i do see the site that i'm publishing through muse, that i pushed live.
when i go to mail.mydomain.com i get a google 'can't find' error. i'm thinking i just need to be patient, even thought the basic site stuff seems to direct correctly. if a BC person is looking at this, have i set this up correctly and just need to wait for it to catch?

I have checked the sites under your account and the mail domain seems to be working well for all of them.
Thanks,
Vinayak

I need to create a default profile that would install a home page and bookmarks for newly created users. It needs to be the same for Windows 7 and Ubuntu 12.04.

Running a mix of Windows 7 Professional (64-bit) and Ubuntu 12.04 (32-bit). When a new user is created and logs in on either platform, I need that user to get a profile with a standard, predefined home page and set of bookmarks.

Use a .cfg lock file and the Client Customisation Kit addon.
* See instructions in http://kb.mozillazine.org/Locking_preferences
* And use https://addons.mozilla.org/en-US/firefox/addon/cck/
Does that help ?

Need Volume Control API's for windows phone 8.1

Hi,
I'm developing a windows phone 8.1 app in which volume need to control. To do this I'm not getting API's to perform this operation, so can any one help to develop this app. if not please post some suggestions why this is not possible.
Thanks in advance.
Regards,
Naresh Kumar

Hi NareshKumar,
Volume control always needed by play some media stuff, could you please tell us why and where do you need the volume control.
Basically as I know if we play the sound by MediaElement, it has a
Volume property, or what kind of media play control are you using?
Indeed, there is no API that can directly control the system volume, only user can manage that.
--James
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Do SCCM clients need to be domain joined for Windows Patch Deployments

Similar Messages

Maybe you are looking for