April 17 2012

SCCM 2012 Active Directory Schema changes



----------------------------------------------------------------------------
I use a maximum of one Google Ad per post to help offset some of my blog hosting costs.

----------------------------------------------------------------------------

I’ve previously blogged about the AD schema changes made by SCCM 2007 (http://blog.danovich.com.au/2010/11/03/sccm-active-directory-schema-changes/).

Recently I prepared an environment for SCCM 2012 – the schema extension is exactly the same for SCCM 2012 so if you have already extended it for SCCM 2007, there’s no need to extend it for SCCM 2012.

As before, it creates 4 new classes and 18 associated attributes as follows:


attribute cn=MS-SMS-Site-Code
attribute cn=mS-SMS-Assignment-Site-Code.
attribute cn=MS-SMS-Site-Boundaries.
attribute cn=MS-SMS-Roaming-Boundaries.
attribute cn=MS-SMS-Default-MP.
attribute cn=mS-SMS-Device-Management-Point.
attribute cn=MS-SMS-MP-Name.
attribute cn=MS-SMS-MP-Address.
attribute cn=mS-SMS-Health-State.
attribute cn=mS-SMS-Source-Forest.
attribute cn=MS-SMS-Ranged-IP-Low.
attribute cn=MS-SMS-Ranged-IP-High.
attribute cn=mS-SMS-Version.
attribute cn=mS-SMS-Capabilities.
class cn=MS-SMS-Management-Point.
class cn=MS-SMS-Server-Locator-Point.
class cn=MS-SMS-Site.
class cn=MS-SMS-Roaming-Boundary-Range.

 
 



----------------------------------------------------------------------------
I use a maximum of one Google Ad per post to help offset some of my blog hosting costs.

----------------------------------------------------------------------------

November 3 2010

SCCM Active Directory Schema changes

You’ll often need to detail what changes are being made during an Active Directory Schema modification / update / upgrade / extension / whatever you want to call it.

The SCCM 2007 schema extension does not change any existing classes or attributes, it creates 4 new classes and 18 associated attributes as follows:

attribute cn=mS-SMS-Assignment-Site-Code.
attribute cn=MS-SMS-Site-Boundaries.
attribute cn=MS-SMS-Roaming-Boundaries.
attribute cn=MS-SMS-Default-MP.
attribute cn=mS-SMS-Device-Management-Point.
attribute cn=MS-SMS-MP-Name.
attribute cn=MS-SMS-MP-Address.
attribute cn=mS-SMS-Health-State.
attribute cn=mS-SMS-Source-Forest.
attribute cn=MS-SMS-Ranged-IP-Low.
attribute cn=MS-SMS-Ranged-IP-High.
attribute cn=mS-SMS-Version.
attribute cn=mS-SMS-Capabilities.
class cn=MS-SMS-Management-Point.
class cn=MS-SMS-Server-Locator-Point.
class cn=MS-SMS-Site.
class cn=MS-SMS-Roaming-Boundary-Range.

 
 

November 5 2009

Improving the SIDMap.wsf script for OCS attribute synchronization

Microsoft’s definition of SIDMap.wsf is : It uses the same disabled user account in the resource forest to enable users for Office Communications Server. To provide single sign-in, the primary user account must also be mapped to the disabled user account in the resource forest for Office Communications Server. This tool performs the mapping.

This script is part of the Office Communications Server 2007 Resource Kit and basically will syncronize the msExchMasterAccountSid attibute to the msRTCSIP-OriginatorSid attribute on the  SIP-enabled disabled user account.

I’ve made some improvements to the script to add a log file and also provide some feedback to the user so they know it has worked. I’ve create a batch file that can be put on a server and run by the support team. This is outlined in attribute_sync.bat below and then the modified SIDMap.wsf is included too.

attribute_sync.bat

REM **   This script copies the value in the msExchMasterAccountSid attibute to the msRTCSIP-OriginatorSid attribute
REM **   for every disabled user that is SIP enabled in the 'Testing' OU
REM **   www.danovich.com.au
for /f "tokens=1* delims= " %%a in ('date/t') do set dayname=%%a
for /f "tokens=1* delims= " %%a in ('date/t') do set mmddyyyy=%%a
for /f "tokens=1* delims=/" %%a in ('echo %mmddyyyy%') do set day=%%a
for /f "tokens=2* delims=/" %%a in ('echo %mmddyyyy%') do set month=%%a
for /f "tokens=3* delims=/" %%a in ('echo %mmddyyyy%') do set year=%%a
for /f "tokens=1* delims=:" %%a in ('echo %time%') do set hour=%%a
for /f "tokens=2* delims=:" %%a in ('echo %time%') do set mins=%%a
for /f "tokens=3* delims=:" %%a in ('echo %time%') do set sec=%%a
for /f "tokens=1* delims=." %%a in ('echo %sec%') do set secs=%%a
for /f "tokens=2* delims=." %%a in ('echo %sec%') do set mili=%%a
wscript //h:cscript //B
c:
cd "C:Program FilesMicrosoft Office Communications Server 2007 R2ResKitLcsSync"
SIDMap.wsf /OU:OU=OU=Testing,DC=danovich,DC=com /logfile:C:LogsOCS-%username%-%day%-%month%-%year%-%hour%.%mins%.%secs%.log

SIDMap.wsf

<?xml version="1.0" ?>
<package>
<job id="Main" prompt="no">
<?job debug="true" error="true" ?>
<runtime>
<named
name="OU"
helpstring="The Active Directory DN of the organizational unit to search under"
many="false"
type="string"
required="false"
/>
<named
name="query"
helpstring="Generates a list of disabled users that are mailbox and SIP enabled and associated with an external account"
type="simple"
required="false"
/>
<named
name="logfile"
helpstring="Text file used to log the output."
type="string"
required="false"
/>
</runtime>
<script id="VBScript_Block" language="VBScript">
<![CDATA[
' Initialize variables
Set WshShell = CreateObject("WScript.Shell")
const ForWriting = 2
intCount = 0
bQuery = False
On Error Resume Next 'Force continuation on errors when initializing globals
' Retrieve command-line arguments
' Check whether an OU is provided.
if WScript.Arguments.Named.Exists("OU") then
strNamingContext = "LDAP://" & WScript.Arguments.Named("OU")
else
Set objRootDSE = GetObject("LDAP://rootDSE")
strNamingContext = "LDAP://" & objRootDSE.Get("defaultNamingContext")
end if
' Check whether the user only wants to query the AD.
if WScript.Arguments.Named.Exists("query") then
' Query only all disabled users that are mailbox and SIP enabled.
' set.
bQuery = True
end if
' Check whether logging to a file is required.
if WScript.Arguments.Named.Exists("logfile") then
strLogFile = WScript.Arguments.Named("logfile")
Set fso = CreateObject("Scripting.FileSystemObject")
Set objLogFile = fso.OpenTextFile(strLogFile, ForWriting, True)
objLogFile.WriteLine("List of disabled users associated with an external account and SIP enabled:")
end if
Set objConnection = CreateObject("ADODB.Connection")
objConnection.Provider = "ADsDSOObject"
objConnection.Open
' Create connection to AD.
Set objCommand = CreateObject("ADODB.Command")
objCommand.ActiveConnection = objConnection
' Define AD query.
' Search for disabled user accounts that are SIP enabled and mailbox enabled.
objCommand.CommandText = _
"<" & strNamingContext & ">;" & _
"(&(objectCategory=person)(objectClass=user)(msRTCSIP-UserEnabled=TRUE)(msExchMasterAccountSid=*)(userAccountControl:1.2.840.113556.1.4.803:=2));" & _
"ADsPath,cn,msRTCSIP-PrimaryUserAddress,msExchMasterAccountSid,msRTCSIP-OriginatorSid;subtree"
' Disable caching to reduce memory consumption for very large result sets.
objCommand.Properties("Cache Results") = FALSE
' Define the maximum page size.
objCommand.Properties("Page Size") = 1000
' Execute query.
Set objRecordSet = objCommand.Execute
If Err.Number <> 0 Then
WScript.Echo("Failed to query Active Directory " & strNamingContext)
WshShell.Popup "Failed to query Active Directory", ," Attribute sync failed ",  16
WScript.Quit(Err.Number)
end if
While Not objRecordset.EOF
intCount = intCount + 1
if IsObject(objLogFile) then
objLogFile.WriteLine(objRecordset.Fields("cn").Value)
else
WScript.Echo(objRecordset.Fields("cn").Value)
end if
if bQuery = False then
' Set the msRTCSIP-OriginatorSid attribute.
Set objContact = GetObject(objRecordset.Fields("ADsPath"))
strExchSid = objRecordset.Fields("msExchMasterAccountSid").Value
objContact.Put "msRTCSIP-OriginatorSid", strExchSid
objContact.SetInfo
If Err.Number <> 0 Then
if IsObject(objLogFile) then
objLogFile.WriteLine("Failed to set msRTCSIP-OriginatorSid attribute " & _
Err.Number)
else
WScript.Echo("Failed to set msRTCSIP-OriginatorSid attribute " & _
Err.Number)
WshShell.Popup "Failed to set msRTCSIP-OriginatorSid attribute", ," Attribute sync failed ",  16
end if
end if
end if
WScript.Echo()
objRecordSet.MoveNext
Wend
WshShell.Popup "Attribute sync has been successful for " & intCount & " users in the following OU:" & vbCrLf & vbCrLf & strNamingContext & vbCrLf & vbCrLf & "Log file is located at " & strLogFile, ," Attribute sync successful ", 64
WScript.Echo "Attribute sync has been successful for " & intCount & " users in the " & strNamingContext & " OU "
if IsObject(objLogFile) then
objLogFile.WriteLine(vbNewLine & intCount & " disabled users.")
objLogFile.Close
end if
objConnection.Close
]]>
</script>
</job>
</package>