Systems

Microsoft Endpoint Configuration Manager (MECM)

Intended Audience

University of Illinois IT Pros leveraging MECM, hosted by Technology Services' Endpoint Services team

General Information

Distribution points configured for PXE that reside on a network outside of the endpoints they support will need IP helpers configured on those additional networks. We recommend contacting net-trouble@illinois.edu to get those set up. Please provide them the network names that will be used for PXE imaging and the IP address of the distribution point.

Contact the EPS MECM team and they'll help you get a distribution point set up. Follow these steps to configure a new distribution point:

• Install Windows Server 2022 with Desktop Experience
  
  
• For a VM, install the respective VM tools
  
  
• Join the server to the appropriate Active Directory domain
  
  
• Reference the table above and add the appropriate primary site computer object to the local Administrators group (open lusrmgr.msc)
  
  
• Configure the Windows Firewall as per the documentation sources linked below:
  
  • https://learn.microsoft.com/en-us/mem/configmgr/core/servers/deploy/configure/install-and-configure-distribution-points#bkmk_firewall
  • https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/ports#BKMK_PortsClient-DP
  • https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/ports#BKMK_PortsClient-DP3
  • https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/ports#BKMK_PortsSite-DP
  • https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/ports#installation-requirements-for-site-systems-that-support-internet-based-clients
  • If multicast will be used: https://learn.microsoft.com/en-us/mem/configmgr/core/plan-design/hierarchy/ports#BKMK_PortsClient-DP2
    
    
• Open Server Manager, add the "Remote Differential Compression" feature to the server; reboot if needed.
  
  
• The following IIS options can be configured by MECM automatically, or they can be manually installed:
  • Open Server Manager, enable the Web Server (IIS) role. In addition to the default selections, select the following role options:
    • Common HTTP features
      • Default Document
      • Directory Browsing
      • HTTP Errors
      • Static Content
      • HTTP Redirection
    • Health and Diagnostics
      • HTTP Logging
      • Logging Tools
      • Request Monitor
      • Tracing
    • Performance
      • Static Content Compression
    • Security
      • Request Filtering
      • Windows Authentication
    • Application Development
      • ISAPI Extensions
    • Management Tools
      • IIS Management Console
      • IIS 6 Management Compatibility
        • IIS 6 Metabase Compatibility
        • IIS 6 WMI Compatibility
      • IIS Management Scripts and Tools
      • Management Service
        • This will prompt an installation for .NET 4.8 Framework Feature - ASP.NET 4.8
• If using PXE, decide between the Configuration Manager PXE responder or WDS. Refer to the WDS notes under the Maintenance section below. If using WDS, enable the WDS role
  • Select both Deployment and Transport options
    
    
• Install the latest ODBC driver from this link: https://learn.microsoft.com/en-us/sql/connect/odbc/download-odbc-driver-for-sql-server
  
  • Click here for more information on this requirement
    
    
• Create a file named "no_sms_on_drive.sms" at the root of every volume that MECM should not use to store content (such as the OS drive)
  
  
• Modify the following TFTP registry values to increase PXE boot performance
  • https://learn.microsoft.com/en-us/mem/configmgr/osd/get-started/prepare-site-system-roles-for-operating-system-deployments#modify-the-ramdisk-tftp-window-size
    • Recommended value is 16
  • https://learn.microsoft.com/en-us/mem/configmgr/osd/get-started/prepare-site-system-roles-for-operating-system-deployments#modify-the-ramdisk-tftp-block-size
    
    • Recommended value is 16384
  • Read this article for more details: https://ccmexec.com/2016/09/tweaking-pxe-boot-times-in-configuration-manager-1606/
    
    
• Contact EPS to add the server as a distribution point for your unit

Maintenance

• WDS is sensitive to network changes at the physical or virtual layers. Listed below are a few examples of proactively managing network-related updates.
  • Stop the WDS service before a network driver update
  • For a VM: Stop the WDS service or power off the VM prior to a VM tools update
  • For a VM: Power off the VM prior to hypervisor upgrades
    
    
• Remove the IIS logs older than a week at [OS drive, e.g. C]:\inetpub\logs\LogFiles\W3SVC1
  • Additional guidance is available at https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage
    
    
• If necessary, remove HTTPERR logs at [OS drive, e.g. C]:\Windows\System32\LogFiles\HTTPERR

Contact the EPS team