The WinOps Blog

Primary Site server prerequisites

Once your hardware is carefully planned, we can now prepare our environment and server before SCCM Installation.

Active directory schema extension

You need to extend the Active Directory Schema only if you didn’t have a previous installation of SCCM in your domain. If you have SCCM 2007 already installed and planing a migration, skip this step.

• Logon to a server with an account that is a member of Schema Admins security group
• From SCCM ISO run .\SMSSETUP\BIN\X64\extadsch.exe

• Check schema extension result, open Extadsch.log located in the root of the system drive

Create the System Management Container

Configuration Manager does not automatically create the System Management container in Active Directory Domain Services when the schema is extended. The container must be created one time for each domain that includes a Configuration Manager primary site server or secondary site server that publishes site information to Active Directory Domain Services

• Start ADSIEdit, go to the System container and create a new Object

• Select Container

• Enter System Management

Set security permission

• Open properties of the container System Management created previously

• In the Security tab, add the site server computer account and Grant the Full Control permissions

• Click Advanced, select the site server’s computer account, and then click Edit
• In the Applies to list, select This object and all descendant objects
• Click OK and close the ADSIEdit console

SCCM Accounts

Create the necessary accounts and group created before installation. You can use different name but i’ll refer to these names throughout the guide.

• SQL server services account – SCCM-SQLService
• SCCM Network Access Account – SCCM-NAA
• Domain user account for use SCCM client push install  – SCCM-ClientPush
• Domain user account for use with reporting services User – SCCM-SQLReporting
• Domain account used to join machine to the domain during OSD – SCCM-DomainJoin
• Domain group containing all SCCM Admins Group – SCCM-Admins
• Domain group containing all SCCM servers in the hierarchy Group – SCCM-SiteServers

Network Configuration

• Make sure that the server has a fix IP and that internet connection is up

Firewall Configuration

• Make sure the firewall service is ON

Run this script in an elevated command prompt order to open the necessary ports needed for SCCM.

** If you are using custom ports, change the values before running the script. **

@echo ========= SQL Server Ports ===================
@echo Enabling SQLServer default instance port 1433
netsh advfirewall firewall add rule name="SQL Server" dir=in action=allow protocol=TCP localport=1433
@echo Enabling Dedicated Admin Connection port 1434
netsh advfirewall firewall add rule name="SQL Admin Connection" dir=in action=allow protocol=TCP localport=1434
@echo Enabling conventional SQL Server Service Broker port 4022
netsh advfirewall firewall add rule name="SQL Service Broker" dir=in action=allow protocol=TCP localport=4022
@echo Enabling Transact-SQL Debugger/RPC port 135
netsh advfirewall firewall add rule name="SQL Debugger/RPC" dir=in action=allow protocol=TCP localport=135
@echo ========= Analysis Services Ports ==============
@echo Enabling SSAS Default Instance port 2383
netsh advfirewall firewall add rule name="Analysis Services" dir=in action=allow protocol=TCP localport=2383
@echo Enabling SQL Server Browser Service port 2382
netsh advfirewall firewall add rule name="SQL Browser" dir=in action=allow protocol=TCP localport=2382
@echo ========= Misc Applications ==============
@echo Enabling HTTP port 80
netsh advfirewall firewall add rule name="HTTP" dir=in action=allow protocol=TCP localport=80
@echo Enabling SSL port 443
netsh advfirewall firewall add rule name="SSL" dir=in action=allow protocol=TCP localport=443
@echo Enabling port for SQL Server Browser Service's 'Browse' Button
netsh advfirewall firewall add rule name="SQL Browser" dir=in action=allow protocol=TCP localport=1434
@echo Allowing Ping command
netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow

No_sms_on_drive.sms

Place a file name no_sms_on_drive.sms on the root drive of each drive you don’t want SCCM to put content on.

Windows Server Features

On the Primary site server, the following components must be installed before SCCM installation. We’ll install all these components using a PowerShell script.

• .Net Framework 3.51 SP1
• .Net Framework 4
• IIS
• Remote Differential Compression
• BITS Server Extension
• WSUS 3.0 SP2
• Report Viewer
• ADK for Windows 8.1

Roles and features

On the Site Sever computer, open a PowerShell command prompt as an administrator and type the following commands. This will install the required features without having to use the Windows 2012 GUI.

Get-Module servermanager
Install-WindowsFeature Web-Windows-Auth
Install-WindowsFeature Web-ISAPI-Ext
Install-WindowsFeature Web-Metabase
Install-WindowsFeature Web-WMI
Install-WindowsFeature BITS
Install-WindowsFeature RDC
Install-WindowsFeature NET-Framework-Features -source \\yournetwork\yourshare\sxs
Install-WindowsFeature Web-Asp-Net
Install-WindowsFeature Web-Asp-Net45
Install-WindowsFeature NET-HTTP-Activation
Install-WindowsFeature NET-Non-HTTP-Activ

Ensure that all component are showing as SUCCESS as an EXIT Code. It’s normal to have Windows Update warnings at this point.

Report Viewer

Download and install – here

ADK for Windows 8.1

Download and install – here

• Select the default path

• Do not join CEIP

• Accept the License Agreement

• Install the following components
  • Deployment Tools
  • Windows Pre-installation Environment
  • User state Migration tool

Active Directory

• Add the computer account of all your site servers in the SCCM-SiteServers AD group
• Ensure that the group has Full Control on the SYSTEM Container in Active Directory

Local Admin accounts

Add both SCCM computer account and the SCCM Admin account to the local administrator group on the site server.

• SCCM-Admins
• SCCM-SiteServers

SCCM 2007 Client

If applicable, uninstall SCCM 2007 client and FEP if present on the server before the installation. If the client is present, the 2012 SCCM Management Point installation will fail.

Windows Updates

Run windows update and patch your server to the highest level