Non Domain Servers and Workstations

Hi,
we are trying to deploy SCCM 2012 clients to non domain servers, and we are also in the process of trying to find out what the best way we can clean up machines from sccm that have not logged in 90days or more.
From my understanding if I turn on only discover machines that have logged on to the domain in a given period of time than that means if a server has not logged in will not be discovered which can be an issue when patching, and also what do I need to do
with the non domain servers with sccm client installed on the servers.
can you please help me with this that would be greatly appreciated
Thanks Tom

Hi,
This blog post does a good job explaining the steps to manage non-domain machines with ConfigMgr 2012:
http://blogs.technet.com/b/anilm/archive/2012/05/06/managing-workgroup-clients-in-configuration-manager-2012.aspx
This technet article also has more detailed information about client communication for workgroup computers:
http://technet.microsoft.com/en-us/library/gg712701.aspx#Plan_Com_X_Forest
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Similar Messages

SCCM 2012 Antivirus Exclusions for Servers and Workstations

Hii,
Just sharing the antivirus exclusions for Configuration Manager 2012 Servers and workstations as well.
Please share if anything is missing.
McAfee Exclusion's for Configuration Manager 2012:
1. C:\Windows\TEMP\BootImages
and subfolders.
2. Directories:
%allusersprofile%\NTUser.pol
%systemroot%\system32\GroupPolicy\registry.pol
%windir%\Security\database\*.chk
%windir%\Security\database\*.edb
%windir%\Security\database\*.jrs
%windir%\Security\database\*.log
%windir%\Security\database\*.sdb
%windir%\SoftwareDistribution\Datastore\Datastore.edb
%windir%\SoftwareDistribution\Datastore\Logs\edb.chk
%windir%\SoftwareDistribution\Datastore\Logs\edb*.log
%windir%\SoftwareDistribution\Datastore\Logs\Edbres00001.jrs
%windir%\SoftwareDistribution\Datastore\Logs\Edbres00002.jrs
%windir%\SoftwareDistribution\Datastore\Logs\Res1.log
%windir%\SoftwareDistribution\Datastore\Logs\Res2.log
%windir%\SoftwareDistribution\Datastore\Logs\tmp.edb
%programfiles%\Microsoft Configuration Manager\Inboxes\*.*
%programfiles(x86)%\Microsoft Configuration Manager\Inboxes\*.*
%systemroot%\system32\GroupPolicy\Machine\registry.pol"
%systemroot%\system32\GroupPolicy\User\registry.pol"
\SCCMContentLib
\SMSPKG
\SMSPKGC$
\SMSPKGSIG
\SMSSIG$
\Program Files\SMS_CCM\ServiceData
\Program Files\SMS_CCM\Logs
\Program Files\Microsoft Configuration Manager\Logs
\Program Files\Microsoft Configuration Manager\Install.map
\ConfigurationManager DB
\SMSPKGSIG
\SCCMContentLib
\Sources
\SCCMImages
\DatabaseBackup
\SMSPKGE$
\SMSPKGSIG
\SMSSIG$
3. Processes that will be excluded:
Configuration Manager 2012 processes that will be excluded are:
Smsexec.exe
Ccmexec.exe
CmRcService.exe
Sitecomp.exe
Smswriter.exe
Smssqlbbkup.exe
4. SQL Server Exclusion's:
SQL Server 2012 Processes exclude from virus scanning
%ProgramFiles%\Microsoft SQL Server\MSSQL11. <InstanceName>\MSSQL\Binn\SQLServr.exe
%ProgramFiles%\Microsoft SQL Server\MSRS11. <InstanceName>\Reporting Services\ReportServer\Bin\ReportingServicesService.exe
%ProgramFiles%\Microsoft SQL Server\MSAS11. <InstanceName>\OLAP\Bin\MSMDSrv.exe
SQL Server data files
*.mdf
*.ldf
*.ndf
SQL Server backup files
     These files frequently have one of the following file-name extensions:
*.bak
*.trn
Full-Text catalog files
%Program Files%\Microsoft SQL Server\MSSQL11.MSSQLSERVER\MSSQL\FTData
Analysis Services backup files
     C:\Program Files\Microsoft SQL Server\MSSQL.X\OLAP\Backup
     C:\Program Files\Microsoft SQL Server\MSSQL.X\OLAP\Log
5. IIS Exclusions:
* .ida
%systemroot%\IIS Temporary Compressed Files
%SystemDrive%\inetpub\temp\IIS Temporary Compressed Files
6. WSUS Exclusions:
*.cab
\WSUS\WSUSContent
\WSUS\UpdateServicesDBFiles
\SoftwareDistribution\Datastore
\SoftwareDistribution\Download
Reference Links:
https://community.mcafee.com/thread/59504
http://www.systemcenterblog.nl/2012/05/09/anti-virus-scan-exclusions-for-configuration-manager-2012/
http://social.technet.microsoft.com/wiki/contents/articles/953.microsoft-anti-virus-exclusion-list.aspx
http://support.microsoft.com/kb/309422
http://support.microsoft.com/kb/821749
http://support.microsoft.com/kb/817442
http://support.microsoft.com/kb/900638/en-us
http://technet.microsoft.com/en-us/library/dd939908(WS.10).aspx#av
McAfee Exclusions for workstations:
Turn off scanning of Windows Update or Automatic Update related files
Turn off scanning of the Windows Update or Automatic Update database file (Datastore.edb). This file is located in the following folder:
%windir%\SoftwareDistribution\Datastore
Turn off scanning of the log files that are located in the following folder:
%windir%\SoftwareDistribution\Datastore\Logs
Specifically, exclude the following files:
Res*.log
Edb*.jrs
Edb.chk
Tmp.edb
Turn off scanning of Windows Security files
Add the following files in the %windir%\Security\Database path of the exclusions list:
*.edb
*.sdb
*.log
*.chk
*.jrs
Turn off scanning of Group Policy related files
Group Policy user registry information. These files are located in the following folder:
%allusersprofile%\
Specifically, exclude the following file:
NTUser.pol
Group Policy client settings file. This file is located in the following folder:
%Systemroot%\System32\GroupPolicy\
Specifically, exclude the following file: Registry.pol
For the configuration manager clients the following exclusion will be added:
%windir%ccmcache
\SoftwareDistribution\Datastore
\SoftwareDistribution\Download
Reference Links:
http://support.microsoft.com/kb/822158/en-us
Regards, Syed Fahad Ali

Thanks for sharing this.. Many people will find this useful.
http://www.enhansoft.com/

DPM 2012 R2 CU 4 - issue w/ system state backup completing on non domain servers with T2embed.dll

I am really new to DPM and just took over a system that has servers being backed up that are not part of the domain. The volumes backup fine and system state will not complete. In looking at the protection group server the WindowsImageBackup folder is created
and the backup starts however it will fail and DPM server will say Replica is inconsistent. Back on the protected server in the backup event log, it fails w/ error code 2155347997. In the backup error log file in C:\windows\logs\windowsserverbackup.
It says "Error in backup of C:\windows\system32\t2embed.dll during read. Error [0x80070005] Access is denied.
We have about 4 other servers that are not domain joined and they are getting similar errors w/ t2embed.dll in that system32 directory or in the WinSXS folder. All servers are 2008 SP2 or 2008 R2 SP1.
Thank you in advance for you help

Hi,
DPM has no control over errors that Windows server backup receives, but check permissions and Remove the DENY permission for EVERYONE on the below files:
C:\Windows\system32\t2embed.dll
C:\Windows\winsxs\amd64_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_13e628b635935244\t2embed.dll
C:\Windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.1.7601.17514_none_b7c78d327d35e10e\t2embed.dll
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. Regards, Mike J. [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

How can someone add servers and computers to a separate domain in a separate forest without having permissions to the other forest?

Hello Community
    On an existing network I added separate domain in a separate forest using WS2012.
    Lets call it "MyDomain" and "MyForest" on WS2012.
    In MyDomain and MyForest I am the only domain administrator.
    The problem is if you go to "File Explorer" and click on "Network" in MyDomain in MyForest,
I see that other server administrators have added their servers and workstations to
MyDomain in MyForest but I never added them as users or administrators to my domain in my forest.
    So the question is how can a someone from a separate domain in
a separate forest add servers and computers to MyDomain in Myforest
when I haven't added them as user or administrators or given them
any permission in MyDomain in MyForest?
    Thank you
    Shabeaut

Using the network in file explorer, this shows machines that the computer has automatically detected using built in Microsoft processes. All this means is that you have other computers on the same physical network as yourself. These are no necessarily part
of your domain. If the machines are set to respond, then so long as they receive a discovery request from your PC they will respond and populate that list. This does not mean they are part of your domain, or that they have access to any of your computers (
apart from low level stuff like ping which does not rely on domain membership.)
Apart from a Domain Admin, the only other people who can make changes to your domain are whoever is an Enterprise Admins. Domain Admins have control over their domains but Enterprise Admin have full permissions to the entire Active Directory infrastructure,
no matter which forest or domain it is.

Non-domain machines cannot launch RemoteAPP

Hi.
I have Server 1 with RDS WEB and RD Gateway Role. And I have Server 2 with RDS Host, License Manager, RemoteApp installed and they are in collection.
For test: I installed certificate of Enterprise CA on non-domain computer and now it connects successfully to RDS Web service (globalDNSname.mycompany.com). Non-Domain computers login to RDWeb well (certificate is good). But when I launch RemoteApp it asks
me credentials and write that logon is unsuccessfull.
It works with domain computers and asks no credentials. Certificate is isssued to globalDNSname.mycompany.com.
Could you help me?

Hi,
Can you open successful connection of RemoteApp on domain joined system?
The PC which is no-domain joined is on same LAN. Might possible that DNS or Hostname of server can’t resolve the name correctly from non-domain joined system. Please see whether you can directly ping or get successful connection to the server from non-domain
joined system.
Apart there are certain point list which need to make sure before successful connection. Check whether you have correctly configured RD CAP and RD RAP policy. When you create the RD RAP, add the user groups that you defined in the RD CAP. Also, create a new
RD Gateway-managed computer group that contains both the NetBIOS names and the fully qualified domain names (FQDNs) of the RD Session Host servers or the RD Session Host server farm that hosts the RemoteApp programs.
For more details you can check beneath article.
Checklist: Make RemoteApp Programs Available from the Internet
https://technet.microsoft.com/en-in/library/cc772415.aspx
Hope it helps!
Thanks.
Dharmesh Solanki
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Windows Domain Controller certificate for non domain clients

Hi,
Is it possible that we can export windows domain certificate and use it for non domain computers without joining domain, so that they can communicate each others without joining domain controller?
Regards

Hi,
Is it possible that we can export windows domain certificate and use it for non domain computers without joining domain, so that they can communicate each others without joining domain controller?
Not sure that what you want to achieve here.
However, yes, it is possible to export certificates (with private keys) from domain machines then import them to non-domain machines, and some certificates can even function well based on key usages. Please note that Domain Controller certificates are only
meaningful to Domain Controllers. Possession of domain certificates doesn’t indicate machines are part of domain.
Without joining a machine to a domain (or without a trust), the machine is always treated as untrusted by the domain members no matter what kind of certificates it holds.
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Office documents slow to open when on non-domain LAN.

Our notebooks are all connected to our domain. When you open an MS Office document (Word, Excel, etc..), while in our domain, they open fast. They open fine on network shares and on the desktop.
When you are out of our domain, and try to open documents on your desktop, they open fast.
When you are out of our domain and connect to a wireless network (at home for instance) and try to open documents from your desktop, it is very slow.
When you connect to our domain from that wireless using VPN, the documents on your desktop open fast again.
It is just slow when you are out of the domain (no VPN connection) and on a network.

I agree that the problem is due to non existent printers and perhaps network file shares. Our users have 5 network shares mounted and at least 3 networked printes connected.
The printers show up as offline when outside of the domain and the shares show up as disconnected. When our notebook users are outside of the office and not connected to a network, documents open fast. The slowdown comes when our users are on a non-domain
network and when they are not VPN'd into our domain. For some reason MS Word and Excell checks for access to every printer and maybe file share when a network connection is present.
One of the things that we’ve done in the past is to create a little batch script that disconnects the networked drives for everyone. We could add the disconnection of printers
too, but that’s going to be too cumbersome for most of our users, because they will have to disconnect the drives and printers when they are out of the domain and not VPN’d in. Connect drives and printers when they are out of the domain and VPn’s in. Connect
printers when they are back in the office (drives are automatically connected via login script).
Now as for your suggestions.
#2 - Setting the last printer used for each application to a local one means that they will have to remember to do that whenever they take documents outside of the office. That’s
not good. I’ll get a lot of complaints if they have to do this for Office apps only. They don’t need to do this for any other application. They just drop those files on their desktop and they’ll open regardless of the network or printer status. I'll try setting
the default printer to the XPS Document writer or another local printer and see it that helps.
#3 – Removing all the prefetch files from c:\windows\prefetch folder is not an option. This folder can be accessed only by administrators. My users are not administrators, so
that is not an option.
Ideally, what I would like to do is to stop MS Office apps from checking network access when it opens. It seems to be able to do that when there is no network connection. I think
it should only check network access when there is a link to a network location inside the document.
Wolfgang

Premiere and Photoshop CC Crashes at launch on a Domain Non-Domain Admin Computer

On Windows 7 Domain computer lab as a non domain admin but local admin, program launches and then closes with the error codes below. As domain admin account, it works fine. This is a K12 education institution, so giving student's domain admin status is unacceptable. Please advise, any help is greatly appreciated.
FYI, things i have tried:
Integrated graphics cards, I have uninstalled and re-installed drivers. No luck. I have also made the pslog.txt file and given appropriate permissions to all users.
Error Codes:
Windows Error Code - Application error
Faulting application name: Adobe Premiere Pro.exe, version: 8.0.1.21, time stamp: 0x53c7b17f
Faulting module name: dvaui.dll, version: 8.0.1.21, time stamp: 0x53c76970
Exception code: 0xc0000005
Fault offset: 0x00000000002f4e39
Faulting process id: 0xf28
Faulting application start time: 0x01d01a2c32635355
Faulting application path: C:\Program Files\Adobe\Adobe Premiere Pro CC 2014\Adobe Premiere Pro.exe
Faulting module path: C:\Program Files\Adobe\Adobe Premiere Pro CC 2014\dvaui.dll
Report Id: 924f6336-861f-11e4-821e-0024811149b1
Fault bucket 45383478, type 20
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Windows Information - Windows Error
Problem signature:
P1: Adobe Premiere Pro.exe
P2: 8.0.1.21
P3: 53c7b17f
P4: dvaui.dll
P5: 8.0.1.21
P6: 53c76970
P7: c0000005
P8: 00000000002f4e39
P9:
P10:
Attached files:
C:\Users\esdstudent\AppData\Local\Temp\WER9443.tmp.WERInternalMetadata.xml
These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Adobe Premiere P_ad637fa2c8bd70d3e74771b4be53569c25a980_00c3bab6
Analysis symbol:
Rechecking for solution: 0
Report Id: 924f6336-861f-11e4-821e-0024811149b1
Report Status: 0

I think you have answered your own question... you must have BOTH types of user accounts set to Administrator
This is an open forum with a mix of program users and Adobe staff, not Adobe support... you need Adobe support
Adobe contact information - http://helpx.adobe.com/contact.html may help
-Select your product and what you need help with
-Click on the blue box "Still need help? Contact us"

TFS non-domain and SCVMM on domain

Hello, Guys
I installed TFS 2013 on machine non-domain and I installed SCVMM on machine with domain controller and now I have a little problem.
The TFS is used for all my developer team and the QA team needs the lab management.
What the best way to solve this? Add TFS machine on domain controller? Is there way to connect TFS Lab (non-domain) to Lab machine on domain.
Kindly help
Thanks...

Hi Heloias,
Thanks for your post.
Yes, we suggest you add TFS Server in the same domain. Or create the shadow account in your TFS Server machine and Lab server machine, then use the shadow account to configure Lab environment in TFS Admin Console.
https://msdn.microsoft.com/en-us/library/dd936084.aspx
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Enable the UAC settings for Domain Controller / Member servers and for end user systems

Hi
We are working on hardening the security for all Domain Controllers / Member Servers and end users systems. As part of it we would like to know the best practice for UAC settings for each of these servers. There are 8 settings related to UAC and as of now
we configured just "User Account Control: Behavior of the elevation prompt for standard users" as disabled for the servers OU. Also not sure about other settings and how it affect the normal operations like installing Windows updates / applications
through SCCM or manually on servers or end user systems and other stuffs.
We are looking for experts opinion on this. Thanks in advance
LMS

Hi LMS,
Would you please let us know the current situation? Just check if Martin’s suggestion was helpful for you.
If any updates, please feel free to let us know.
Just additional. Please refer to the
User Account Control Grouping in the following article. It will provide some links about those different UAC settings. Please click those links and read related articles. In these articles, will provide
Security considerations that may help you to configure those settings.
Security Options
http://technet.microsoft.com/en-us/library/jj852268.aspx
Hope this helps.
Best regards,
Justin Gu

EAP-TLS and PEAP/MSCHAPv2 on non-domain equipment

I'm not entirely sure this is the correct forum so I apologize. I'm merely having trouble finding the Network Policy Services forum. In short, I could use some answers to the following questions:
Is it possible to do EAP-TLS Machine authentication with non-domain machines? Would this require 8.1's "Workplace Join" scenario?
Can I do EAP-TLS User Authentication on non-domain machines?
Is it possible to use a different RADIUS realm name than the internal domain structure? Something easier for the users to type and remember? Can I do that with NPS configured in Proxy mode?

Hi,
Based on my experience,
EAP-TLS is only available for members of a domain.
For non-domain member computers, the certificate must be manually imported into the certificate store or obtained by using the Web enrollment tool.
You can specify a realm name and user name syntax in the
Connection Manager profile so that the user only has to specify the user account name when typing their credentials during network connection attempts.
In addition, you can also deploy NPS as a
RADIUS proxy on your network.
More detailed information, please refer to the following links:
EAP
http://technet.microsoft.com/en-us/library/cc757996(v=WS.10).aspx
Certificates and NPS
http://technet.microsoft.com/en-us/library/cc772401(v=ws.10).aspx
Realm names
http://technet.microsoft.com/en-us/library/cc731342(v=WS.10).aspx
Planning NPS as a RADIUS proxy
http://technet.microsoft.com/en-us/library/dd197525(v=WS.10).aspx
Best regards,
Susie Long

Windows 2012 R2 ADRMS domain controller version and Non-domain-joined Mac Client with outlook 2011

Hi,
What is the AD version for Windows 2012R2 ADRMS? Is it possible to have Windows 2003 R2 DC with Windows 2012R2 ADRMS?
Any installation guide Non-domain-joined Mac Client with outlook 2011?
What is the SQL version for Windows 2012R2 ADRMS?
Please advise. Thanks.
Kelvin Teang

Hi Kelvin -
There is no RMS Client for Macs. That functionality is actually provided through the Office for Mac application (this is different compared to the PC). Domain-joined clients will autodiscover the RMS server and should be able to create and consume
protected content. Non-domain-joined clients cannot automatically discover their RMS server. In this scenario, prepare a protected document or email from a domain-joined machine and send it to your non-domain-joined users. They will open
the document or email up and the URLs contained in the publishing license of the document will direct them to the correct RMS server.
I hope that helps!
Micah LaNasa
Synergy Advisors
synergyadvisors.biz

Difference between 006 DNS Servers and 015 DNS Domain Name

hi,
what's difference between 006 DNS Servers and 015 DNS Domain Name?
please guide me.

Hi
Option 006 DNS servers = IP Address of your DNS Server, e.g, 10.10.10.1
Option 015 DNS Domain Name = test.local, your domain name.
Hope this helps. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Connecting to Wireless Network with domain name and proxy servers?

Hi,
I'm trying to connect to the wireless network at my college, however it's not as straight forward as usual... The network is hidden, although I know to 'Join other network' and type in the SSID of the network and then set the authentication method to WPA-Enterprise. However, this is where I run into a problem..
To connect, I need to 'configure encryption as AES', which I'm not sure how to do on OS X. Furthermore, after signing in with my college ID I am required to 'Use the domain name [domain name]' and 'configure your browser to use the college proxy servers [example.example.net] on port [123]
Any help on this would be greatly appreciated as it's important that I log on to the network for work etc.
Thanks very much for your time.

johnthompson1993 wrote:
Hi,
To connect, I need to 'configure encryption as AES', which I'm not sure how to do on OS X. Furthermore, after signing in with my college ID I am required to 'Use the domain name [domain name]' and 'configure your browser to use the college proxy servers [example.example.net] on port [123]
The encryption should be configured automatically. To use the proxy:
1. Open System Preferences
2. Click on Network
3. Select Airport from the list on the left
4. Click on Advanced, near the bottom right
5. One of the tabs will be called Proxy. Configure your settings there.

How can I override the DNS Servers and Domain Name used by my Airport Time Capsule?

The defaults picked up from my ISP's DHCP are to use the ISP's DNS servers and ISP's domain. I do not want this.
With my prior router I set the DNS servers to Google's Public DNS (8.8.8.8 and 8.8.4.4) and my domain to either "bannister.us" (which I own) or "bannister.home". I do not want simple names resolving to some ISP default. (Yes, I know exactly what this does.)
In the Apple AIrport Utility (version 6.3.2) the fields for DNS and Domain do not allow editing. (Why??)
Is there some way to override this?

Unfortunately not one that will work with the latest version TC.
The way around it is to use a different router.. It can be a very simple router.. I usually recommend units like the TP-Link WDR3600 as they take good third party firmware like gargoyle, openwrt, dd-wrt.. ie they have real controls and beyond that a proper Linux firmware with command line interface.
You can then change the TC over to static IP. It will not be the router.. but it will effectively become the local dhcp server.
I have adsl so I cannot reproduce your system.. I have a bridged modem.. a router.. AC66U.. and a TC.. but the TC is not in bridge.. it is in static IP mode.
Let me demonstrate.
By setting a range on the main router from 1-199 (leave a space.. ) so set the TC to 192.168.2.201 and then you can set DNS and domain as you like. Set the dhcp range (leave a space) you could use 203-253.. then I use the main router as 254.
It is brilliant.. all computers behind the TC receive the IP from the TC with whatever IP and dns (and domain although I haven't changed it).. Effectively the TC works as its own dhcp device.. but is merely a secondary dhcp server to the main unit.
(This gives me netflix which is why I do it.. from well outside the US).
It may be of use.
Why leave a space.. well it helps it to work.. I have not tested it but another person reported issues and found leaving a space .. ie last ip in the router.. 199, static ip 201.. first dhcp 203 (i used 205 to help me keep count!!). worked.. I have not tried to reproduce the problem.. so I reproduce the solution.. it might be like sheep jumping over the fence.. even if the fence was removed the sheep keep jumping over at the same place. Just say bahhh and do likewise.

Non Domain Servers and Workstations

Similar Messages

Maybe you are looking for