Yes. The Configuration Manager console is a 32-bit program that can run on a 32-bit version of Windows and on a 64-bit version of Windows.

In System Center 2012 Configuration Manager, all collections must be limited to the membership of another collection. When you create a collection, you must specify a limiting collection. A collection is always a subset of its limiting collection. For more information, see How to Create Collections in Configuration Manager.

Yes. System Center 2012 Configuration Manager includes two new collection rules, the Include Collections rule and the Exclude Collections rule that allow you to include or exclude the membership of specified collections. For more information, see How to Create Collections in Configuration Manager.

No. Collections configured by using query rules that use certain classes do not support incremental updates. For a list of these classes, see How to Create Collections in Configuration Manager.

The All Unknown Computers collection contains two objects that represent records in the Configuration Manager database so that you can deploy operating systems to computers that are not managed by Configuration Manager, and so are unknown to Configuration Manager. These computers can include the following:

• A computer where the Configuration Manager client is not installed
  
  
• A computer that is not imported into Configuration Manager
  
  
• A computer that is not discovered by Configuration Manager
  
  

For more information about how to deploy operating systems to unknown computers, see How to Manage Unknown Computer Deployments in Configuration Manager.

If you choose Install Client from the ribbon when the Collection ribbon tab is selected, the client installs to all computers in the collection rather than to just the selected computer. To install the client to just the selected computer, click the Home tab on the ribbon before you click Install Client from the ribbon, or use the right-click option.

For System Center 2012 Configuration Manager SP1 and System Center 2012 R2 Configuration Manager only:

Because an ID for each device type (for example Windows computers, Mac computers, or Linux computers) is stored in the Configuration Manager database, you can create a collection that contains a query rule to return only devices with a specified ID. For an example query to use, see the Example WQL Queries section in the How to Create Queries in Configuration Manager topic. For information about how to create collections, see How to Create Collections in Configuration Manager.

For System Center 2012 Configuration Manager SP1 and System Center 2012 R2 Configuration Manager only:

Create a collection with a query-based rule. Query the attribute class System Resource and the attribute Connected Standby Capable = Yes to return computers that are Always On Always Connected capable.

The Configuration Manager console uses HTTP to the Internet in two scenarios:

• When you use the geographical view from the Site Hierarchy node in the Monitoring workspace, which uses Internet Explorer to access Bing Maps.
  
  
• When you use the Configuration Manager help file and click a link to view or search for information on TechNet.
  
  

If you do not require these functions, your firewall can block HTTP connections from the console without additional loss of functionality to Configuration Manager.

For more information about the geographical view, see the About the Site Hierarchy Node section in the Monitor Configuration Manager Sites and Hierarchy topic.

By default, the Configuration Manager console limits search results to 1,000 items. You can change this value by using the Search tab. In the Options group. click Search Settings and then change the Search Results value in the Search Settings dialog box.

By default, the Configuration Manager console limits searches to the current folder. You can change this behavior by first clicking in the Search box in the results pane. Then, in the Search tab, in the Scope group. click All Subfolders. In the results pane, the search is extended to AND Path <Current Node + Subfolders>. Add criteria if required, and type your search text to search the current folder and its subfolders.

No. The Active Directory schema extensions for System Center 2012 Configuration Manager are unchanged from those used by Configuration Manager 2007. If you extended the schema for Configuration Manager 2007, you do not need to extend the schema again for System Center 2012 Configuration Manager or System Center 2012 Configuration Manager SP1.

See Install Sites and Create a Hierarchy for Configuration Manager.

No. Unless you were in a prerelease program that was supported by Microsoft (such as the Technology Adoption Program or the Community Evaluation Program) there is no supported upgrade path for prerelease versions of System Center 2012 Configuration Manager. For more information, see the Release Notes for System Center 2012 Configuration Manager.

No. SMS 2003 sites and SMS 2003 clients are not supported by System Center 2012 Configuration Manager. You have two choices to move these sites and clients to System Center 2012 Configuration Manager:

• Upgrade SMS 2003 sites and clients to Configuration Manager 2007 SP2, and then migrate them to System Center 2012 Configuration Manager.
  
  
• Uninstall SMS 2003 sites and clients and then install System Center 2012 Configuration Manager sites and clients.
  
  

For more information about supported upgrade paths, see the Supported Upgrade Paths section in the Supported Configurations for Configuration Manager topic.

For more information about migrating Configuration Manager 2007 to System Center 2012 Configuration Manager, see the Migrating Hierarchies in System Center 2012 Configuration Manager guide.

Yes. If the evaluation version is not a prerelease version of System Center 2012 Configuration Manager, you can upgrade it to the full version.

For more information, see the Upgrade an Evaluation Installation to a Full Installation section in the Install Sites and Create a Hierarchy for Configuration Manager topic.

System Center 2012 Configuration Manager introduces changes to both primary and secondary sites while the central administration site is new site type. The central administration site replaces the primary site referred to as a central site as the top-level site of a multi-primary site hierarchy. This site does not directly manage clients but does coordinate a shared database across your hierarchy, and it is designed to provide centralized reporting and configurations for your entire hierarchy.

In System Center 2012 Configuration Manager with no service pack, you cannot change the parent relationship of an active site. You can only add a site as a child of another site at the time you install the new site. Because the database is shared between all sites, joining a site that has already created default objects or that has custom configurations can result in conflicts with similar objects that already exist in the hierarchy.

However, in System Center 2012 Configuration Manager SP1, you can expand a stand-alone primary site into a hierarchy that includes a new central administration site. For more information, see the Planning to Expand a Stand-Alone Primary Site section in the Planning for Sites and Hierarchies in Configuration Manager topic.

With System Center 2012 Configuration Manager, primary sites have changed to support only secondary sites as child sites, and the new central administration site as a parent site. Unlike Configuration Manager 2007, primary sites no longer provide a security or configuration boundary. Because of this, you should only need to install additional primary sites to increase the maximum number of clients your hierarchy can support, or to provide a local point of contact for administration.

In System Center 2012 Configuration Manager, secondary sites require either SQL Server, or SQL Server Express to support database replication with their parent primary site. When you install a secondary site, Setup automatically installs SQL Server Express if a local instance of SQL Server is not already installed.

Database replication uses SQL Server to quickly transfer data for settings and configurations to other sites in the Configuration Manager hierarchy. Changes that are made at one site merge with the information stored in the database at other sites. Content for deployments, and other file-based data, still replicate by file-based replication between sites. Database replication configures automatically when you join a new site to an existing hierarchy.

See the Monitor Infrastructure for Configuration Manager section in the Monitor Configuration Manager Sites and Hierarchy topic. This section includes information about database replication and how to use the Replication Link Analyzer.

Active Directory Forest discovery is a new discovery method in System Center 2012 Configuration Manager that allows you to discover network locations from multiple Active Directory forests. This discovery method can also create boundaries in Configuration Manager for the discovered network locations and you can publish site data to another Active Directory forest to help support clients, sites, and site system servers in those locations.

Yes. System Center 2012 Configuration Manager applies a hierarchy-wide set of default client settings (formerly called client agent settings) that you can then modify on clients by using custom client settings that you assign to collections. This creates a flexible method of delivering customized client settings to any client in your hierarchy, regardless of the site it is assigned to, or where it is located on your network. For more information, see How to Configure Client Settings in Configuration Manager.

Configuration Manager supports site-to-site (intersite) communication when a two-way forest trust exists between the forests. Within a site, Configuration Manager supports placement of site system roles on computers in an untrusted forest. Configuration Manager also supports clients that are in a different forest from their site’s site server when the site system role that they connect to is in the same forest as the client. For more information, see the Planning for Communications Across Forests in Configuration Manager section in the Planning for Communications in Configuration Manager topic.

No. Because System Center 2012 Configuration Manager supports installing most site system roles in untrusted forests, there is no requirement to have a separate site for this scenario, unless you have exceeded the maximum number of supported clients for a site. For more information about communications across forests, see the Planning for Communications Across Forests in Configuration Manager section in the Planning for Communications in Configuration Manager topic. For more information about the number of computers that are supported, see the Site and Site System Role Scalability section in the Supported Configurations for Configuration Manager topic

Tip

The Application Catalog web service role and the enrollment point must be installed in the same forest as the site server. In this case, you can install the Application Catalog website point and the enrollment proxy point in the other forest, and these site system roles communicate with the site by using the Application Catalog web service role and the enrollment point, respectively. After these site system roles are installed in the other forest, they communicate with their counterpart role by using certificates (self-signed or PKI). For more information about how this communication is secured, see the “Cryptographic Controls for Server Communication” section in the Technical Reference for Cryptographic Controls Used in Configuration Manager topic.

System Center 2012 Configuration Manager clients can find available management points by using the management point that you specify during client deployment, Active Directory Domain Services, DNS, and WINS. Clients can connect to more than one management point in a site, always preferring communication that uses HTTPS, when this is possible because the client and management point uses PKI certificates.

There are some changes here since Configuration Manager 2007, which accommodate the change that clients can now communicate with more than one management point in site, and that you can have a mix of HTTPS and HTTP site system roles in the same site.

For more information, see the Planning for Service Location by Clients section in the Planning for Communications in Configuration Manager topic.

System Center 2012 Configuration Manager has replaced the native mode site configuration in Configuration Manager 2007 with individual site system role configurations that accept client communication over HTTPS or HTTP. Because you can have site system roles that support HTTPS and HTTP in the same site, you have more flexibility in how you introduce PKI to secure the intranet client endpoints within the hierarchy. Clients over the Internet and mobile devices must use HTTPS connections.

For more information, see the Planning a Transition Strategy for PKI Certificates and Internet-Based Client Management section in the Planning for Security in Configuration Manager topic.

Unlike Configuration Manager 2007, there are no design restrictions to support clients on the Internet, providing you meet the requirements in the Planning for Internet-Based Client Management section in the Planning for Communications in Configuration Manager topic. Because of the following improvements, you can more easily support clients on the Internet to fit your existing infrastructure:

• The whole site does not have to be using HTTPS client connections
  
  
• Support for installing most site system roles in another forest
  
  
• Support for multiple management points in a site
  
  

If you use multiple management points and dedicate one or more for client connections from the Internet, you might want to consider using database replicas for management points. For more information, see Configure Database Replicas for Management Points.

No. Although both configurations use the Internet, they are independent from each other. Clients on the intranet can use cloud-based distribution points and these clients do not require a PKI client certificate. However, you still require PKI certificates if you want to use cloud-based distribution points; one for the Windows Azure management certificate that you install on the site system server that hosts the cloud-based distribution points, and one for the cloud-based distribution point service certificate that you import when you configure the cloud-based distribution point.

For more information about the PKI certificate requirements for Internet-based client management and for cloud-based distribution points, see PKI Certificate Requirements for Configuration Manager.

For more information about cloud-based distribution points, see the Planning for Cloud-Based Distribution Points section in the Planning for Content Management in Configuration Manager topic.

Configuration Manager supports some site system roles only at specific sites in a hierarchy, and some site system roles have other limitations as to where and when you can install them. When Configuration Manager does not support the installation of a site system role, it is not listed in the wizard. For example, the Endpoint Protection point cannot be installed in a secondary site, or in a primary site if you have a central administration site. So if you have a central administration site, you will not see the Endpoint Protection point listed if you run the Add Site System Roles Wizard on a primary site.

Other examples include you cannot add a second management point to a secondary site, and you cannot add a management point or distribution point to a central administration site.

In addition, in Configuration Manager SP1, you do not see the Windows Intune connector listed as an available site system role until you have created the Windows Intune subscription. For more information about how to create the subscription, see How to Manage Mobile Devices by Using Configuration Manager and Windows Intune.

For more information about which site system roles can be installed where, see the Planning Where to Install Sites System Roles in the Hierarchy section in the Planning for Site Systems in Configuration Manager topic.

Use the following procedure to configure the Network Access Account:

How to configure the Network Access Account for a site

Configuration Manager offers a number of high availability solutions. For information, see Planning for High Availability with Configuration Manager.

The version of System Center 2012 Configuration Manager that you use to run migration determines the versions of Configuration Manager 2007 or System Center 2012 Configuration Manager that are supported for migration:

• When you use System Center 2012 Configuration Manager with no service pack, Configuration Manager 2007 sites with SP2 are supported for migration.
  
  
• When you use System Center 2012 Configuration Manager with SP1, Configuration Manager 2007 sites with SP2 and System Center 2012 Configuration Manager sites with SP1 are supported for migration.
  
  

Configuration Manager hierarchies that have data you want to migrate are called source hierarchies. The Configuration Manager hierarchy you re migrating data into, is called the destination hierarchy.

For more information about prerequisites for Migration, see Prerequisites for Migration in System Center 2012 Configuration Manager.

No. The new functionality in Configuration Manager SP1 supports migration from an existing Configuration Manager SP1 hierarchy to another Configuration Manager SP1 hierarchy, in addition to supporting migration from Configuration Manager 2007 SP2 to Configuration Manager SP1.

For more information about the new migration functionality, see Introduction to Migration in System Center 2012 Configuration Manager.

Several important changes introduced with System Center 2012 Configuration Manager prevent an in-place upgrade; however, System Center 2012 Configuration Manager does support migration from Configuration Manager 2007 with a side-by-side deployment. For example, System Center 2012 Configuration Manager is native 64 bit application with a database that is optimized for Unicode and that is shared between all sites. Additionally, site types and site relationships have changed. These changes, and others, mean that many existing hierarchy structures cannot be upgraded. For more information, see Migrating Hierarchies in System Center 2012 Configuration Manager.

Typically, you will migrate data from a Configuration Manager 2007 or System Center 2012 Configuration Manager hierarchy (the source hierarchy) over a period of time that you define. During the period of migration, you can continue to use your source hierarchy to manage clients that have not migrated to your new System Center 2012 Configuration Manager hierarchy (the destination hierarchy). Additionally if you update an object in the source hierarchy after you have migrated that object to your destination hierarchy, you can re-migrate that object again up until you decide to complete your migration.

When you migrate a Configuration Manager 2007 package to System Center 2012 Configuration Manager, it remains a package after migration. If you want to deploy the software and packages that migrate from your Configuration Manager 2007 hierarchy by using the new application model, you can use Microsoft System Center Configuration Manager Package Conversion Manager to convert them into System Center 2012 Configuration Manager applications. For more information, see Configuration Manager Package Conversion Manager.

This type of information is easily recreated by an active client when it sends data to its new site in the destination hierarchy. Typically, it is only the current information from each client that provides useful information. To retain access to historical inventory information you can keep a Configuration Manager 2007 or System Center 2012 Configuration Manager source site active until the historical data is no longer required.

When you assign a site in the destination hierarchy to own the content, you are selecting the site that maintains that content in the destination hierarchy. Because the site that owns the content is responsible for monitoring the source files for changes, plan to specify a site that is near to the source file location on the network.

When you migrate content between a source and destination hierarchy, you are really migrating the metadata about that content. The content itself might remain hosted on a shared distribution point during migration, or on a distribution point that you will upgrade or reassign to the destination hierarchy.

Shared distribution points are distribution points at sites in the source hierarchy that can be used by clients in the destination herarchy during the migration period. A distribution point can be shared only when the source hierarchy that contains the distribution point remains the active source hierarchy and distribution point sharing is enabled for the source site that contains the distribution point. Sharing distribution points ends when you complete migration from the source hierarchy.

System Center 2012 Configuration Manager can upgrade supported distribution points from Configuration Manager 2007 source hierarchies, and reassign supported distribution points from System Center 2012 Configuration Manager source hierarchies. When you upgrade or reassign a shared distribution point, the distribution point site system role and the distribution point computer are removed from the source hierarchy, and installed as a distribution point at a site you select in the destination hierarchy. This process allows you to maintain your existing distribution points with minimal effort or disruption to your network. For more information, see Planning a Content Deployment Migration Strategy in System Center 2012 Configuration Manager.

You can also use the prestage option for System Center 2012 Configuration Manager distribution points to reduce the transfer of large files across low-bandwidth network connections. For more information, see the Prestaging Content section in the Introduction to Content Management in Configuration Manager topic.

You can perform an in-place upgrade of a Configuration Manager 2007 distribution point that preserves all content during the upgrade. This includes an upgrade of a distribution point on a server share, a branch distributing point, or standard distribution point.

You can perform an in-place upgrade of a Configuration Manager 2007 secondary site to a System Center 2012 Configuration Manager distribution point. During the upgrade, all migrated content is preserved.

During the upgrade to a System Center 2012 Configuration Manager distribution point, all migrated content is copied and then converted to the single instance store. When you migrate to a hierarchy that runs System Center 2012 Configuration Manager with no service pack, the original Configuration Manager 2007 content remains on the server until it is manually removed. However, when you migrate to a hierarchy that runs System Center 2012 Configuration Manager SP1, the original Configuration Manager 2007 content is removed after the copy of the content is converted.

You can migrate data from more than one source hierarchy, and the source hierarchies do not need to be the same version as each other. This means you can migrate from one or more Configuration Manager 2007 hierarches, one or more System Center 2012 Configuration Manager hierarchies, and from one or more hierarchies that each run a different version of Configuration Manager. However, you can only migrate from one hierarchy at a time.

You can migrate the hierarchies in any order. However, you cannot migrate data from multiple hierarchies that use the same site code. If you try to migrate data from a site that uses the same site code as a migrated site, or that uses the same site code as a site in your destination hierarchy, this corrupts the data in the System Center 2012 Configuration Manager database.

System Center 2012 Configuration Manager supports migrating a Configuration Manager 2007 environment that is at a minimum of Service Pack 2. For more information, see Prerequisites for Migration in System Center 2012 Configuration Manager.

The list of objects you can migrate depends on the version of your source hierarchy. You can migrate most objects from Configuration Manager 2007 to System Center 2012 Configuration Manager, including the following:

• Advertisements
  
  
• Boundaries
  
  
• Collections
  
  
• Configuration baselines and configuration items
  
  
• Operating system deployment boot images, driver packages, drivers, images, and packages
  
  
• Software distribution packages
  
  
• Software metering rules
  
  
• Software update deployment packages and templates
  
  
• Software update deployments
  
  
• Software update lists
  
  
• Task sequences
  
  
• Virtual application packages
  
  

When you migrate between System Center 2012 Configuration Manager hierarchies, the list is similar, and includes objects that are only available in System Center 2012 Configuration Manager, such as Applications.

For more information, see Objects That Can Migrate by Migration Job Type

Yes. When a collection migrates, Configuration Manager also migrates collection settings, which includes maintenance windows and collection variables. However, collection settings for AMT provisioning do not migrate.

No. Clients that you upgrade from Configuration Manager 2007 will not rerun advertisements that you migrate. System Center 2012 Configuration Manager retains the Configuration Manager 2007 Package ID for packages you migrate and clients that upgrade retain their advertisement history.

Because role-based administration is integrated into the configuration of the hierarchy and management functions, there is no separate documentation section for role-based administration. Instead, information is integrated throughout the documentation library. For example, information about planning and configuring role-based administration is in the Planning for Security in Configuration Manager topic and the Configuring Security for Configuration Manager topic in the Site Administration for System Center 2012 Configuration Manager guide and the Security and Privacy for System Center 2012 Configuration Manager guide.

The Configuration Manager console lists the description of each role-based security role that is installed with Configuration Manager, and the minimum permissions and suitable security roles for each management function is included as a prerequisite in the relevant topic. For example, Prerequisites for Application Management in Configuration Manager in the Deploying Software and Operating Systems in System Center 2012 Configuration Manager guide list the minimum security permissions to manage and to deploy applications, and the security roles that meet these requirements.

If you install System Center 2012 Configuration Manager, there is no additional configuration because the Active Directory user account used to install Configuration Manager is automatically assigned to the Full Administrator security role, assigned to All Scopes, and has access to the All Systems and All Users and User Groups collections. However, if you want to provide full administrative permissions for other Active Directory users to access System Center 2012 Configuration Manager, create new administrative users in Configuration Manager using their Windows accounts and then assign them to the Full Administrator security role.

Unlike Configuration Manager 2007, sites no longer provide a security boundary. Instead, use role-based administration security roles to configure the permissions different administrative users have, and security scopes and collections to define the set of objects they can view and manage. These settings can be configured at a central administration site or any primary site and are enforced at all sites throughout the hierarchy.

As a best practice, specify a security group rather than user accounts when you configure administrative users for role-based administration.

Role-based administration does not support an explicit deny action on security roles, security scopes, or collections assigned to an administrative user. Instead, configure security roles, security scopes, and collections to grant permissions to administrative users. If users do not have permissions to objects by use of these role-based administration elements, they might have only partial access to some objects, for example they might be able to view, but not modify specific objects. However, you can use collection membership to exclude collections from a collection that is assigned to an administrative user.

Run the report Security for a specific or multiple Configuration Manager objects to find the object types that can be assigned to security roles. Additionally you can view the list of objects for a security role by viewing the security roles Properties and selecting the Permissions tab.

No, although you can configure role-based administration and security scopes so that administrative users can distribute content to selected distribution points only, Configuration Manager always displays all distribution points in the Monitoring workspace.

Yes. System Center 2012 Configuration Manager supports the same client installation methods that Configuration Manager 2007 supports: client push, software update-based, group policy, manual, logon script, and image-based. For more information, see How to Install Clients on Windows-Based Computers in Configuration Manager.

To install a Configuration Manager client by using the Client Push Installation Wizard, the administrative user must have at least the Modify resource permission.

When you create a package and program to upgrade Configuration Manager clients, this installation method is designed to upgrade existing System Center 2012 Configuration Manager clients. You can control which distribution points hosts the package and the client computers that install the package. This installation method supports only System Center 2012 Configuration Manager clients and cannot upgrade Configuration Manager 2007 clients.

In comparison, the automatic client upgrade method automatically creates the client upgrade package and program and this installation method can be used with Configuration Manager 2007 clients as well as System Center 2012 Configuration Manager clients. The package is automatically distributed to all distribution points in the hierarchy and the deployment is sent to all clients in the hierarchy for evaluation. This installation method supports System Center 2012 Configuration Manager clients and Configuration Manager 2007 clients that are assigned to a System Center 2012 Configuration Manager site. Because you cannot restrict which distribution points are sent the upgrade package or which clients are sent the deployment, use automatic client upgrade with caution and do not use it as your main method to deploy the client software.

For more information, see How to Upgrade Configuration Manager Clients by Using a Package and Program and How to Automatically Upgrade the Configuration Manager Client for the Hierarchy in the How to Install Clients on Windows-Based Computers in Configuration Manager topic.

The term “device” in System Center 2012 Configuration Manager applies to a computer or a mobile device such as a Windows Mobile Phone.

For information about supporting clients for a virtual desktop infrastructure (VDI), see the Considerations for Managing the Configuration Manager Client in a Virtual Desktop Infrastructure (VDI) section in the Introduction to Client Deployment in Configuration Manager topic.

A client’s assigned site is the primary site that creates the client policy to manage the device. Clients are always assigned to primary sites, even if they roam into another primary site or reside within the boundaries of a secondary site. The client’s installed site refers to the site that sent the client the client installation files to run CCMSetup.exe. For example, if you used the Client Push Installation Wizard, you can specify Install the client software from a specified site and select any site in the hierarchy. The resident site refers to the site that owns the boundaries that the client currently resides in. For example, this might be a secondary site of the client’s primary site. Or, it might be another primary site if the client is roaming and temporarily connected to a network that belongs to another site in the hierarchy.

Yes, client status is new in System Center 2012 Configuration Manager and allows you to monitor the activity of clients and check and remediate various problems that can occur.

Review the checks that client health makes in the section Monitoring the Status of Client Computers in Configuration Manager in the topic Introduction to Client Deployment in Configuration Manager. You can use compliance settings in Configuration Manager to check for additional items that you consider required for the health of your clients. For example, you might check for specific registry key entries, files, and permissions.

Configuration Manager contains many improvements since Configuration Manager 2007 to help you manage clients when they are on the Internet:

• Configuration Manager supports a gradual transition to using PKI certificates, and not all clients and site systems have to use PKI certificates before you can manage clients on the Internet. For more information, see Planning a Transition Strategy for PKI Certificates and Internet-Based Client Management.
  
  
• The certificate selection process that Configuration Manager uses is improved by using a certificate issuers list. For more information, see Planning for the PKI Trusted Root Certificates and the Certificate Issuers List.
  
  
• Although deploying an operating system is still not supported over the Internet, you can deploy generic task sequences for clients that are on the Internet.
  
  
• If the Internet-based management point can authenticate the user, user polices are now supported when clients are on the Internet. This functionality supports user-centric management and user device affinity for when you deploy applications to users.
  
  
• Configuration Manager Internet-based clients on the Internet first try to download any required software updates from Microsoft Update, rather than from an Internet-based distribution point in their assigned site. Only if this fails, will they then try to download the required software updates from an Internet-based distribution point.
  
  

DirectAccess is a Windows solution for managing domain computers when they move from the intranet to the Internet. This solution requires the minimum operating systems of Windows Server 2008 R2 and Windows 7 on clients. Internet-based client management is specific to Configuration Manager, and it allows you to manage computers and mobile devices when they are on the Internet. The Configuration Manager clients can be on workgroup computers and never connect to the intranet, and they can also be mobile devices. The Configuration Manager solution works for all operating system versions that are supported by Configuration Manager.

Unless you are using Windows Server 2012 with only Windows 8 clients for DirectAccess, both solutions require PKI certificates on clients and servers. However, DirectAccess requires a Microsoft enterprise certification authority, whereas Configuration Manager can use any PKI certificate that meets the requirements documented in PKI Certificate Requirements for Configuration Manager.

Not all Configuration Manager features are supported for Internet-based client management. For more information, see the Planning for Internet-Based Client Management section in the Planning for Communications in Configuration Manager topic. In comparison, because a client that connects over DirectAccess behaves as if it is on the intranet, all features, with the exception of deploying an operating system, are supported by Configuration Manager.

Warning
Some Configuration Manager communications are server-initiated, such as client push installation and remote control. For these connections to succeed over DirectAccess, the initiating computer on the intranet and all intervening network devices must support IPv6.

For support information about how Configuration Manager supports DirectAccess, see the DirectAccess Feature Support section in the Supported Configurations for Configuration Manager topic.

Tip
Do not configure a Configuration Manager client for both intranet and Internet-based client management and DirectAccess. If DirectAccess allows access to intranet management points when computers are on the Internet, the client will never connect to the Internet-based site system roles.

Probably. You can reduce the disk space required to install the Configuration Manager client by using customized settings, such as excluding installation files that the client does not require and specifying the client cache to be smaller than the default size. For more information, see the Computer Client Hardware Requirements section in the Supported Configurations for Configuration Manager topic.

You can manage Intel vPro computers by using out of band management in System Center 2012 Configuration Manager. For more information, see Out of Band Management in Configuration Manager in the Assets and Compliance in System Center 2012 Configuration Manager guide.

AMT-based computers that were provisioned with Configuration Manager 2007 must have their provisioning data removed before you migrate them to System Center 2012 Configuration Manager, and then provisioned again by System Center 2012 Configuration Manager. Because of functional changes between the versions, the security group, OU, and web server certificate template have different requirements:

• If you used a security group in Configuration Manager 2007 for 802.1X authentication, you can continue to use this group if it is a universal security group. If it is not a universal group, you must convert it or create a new universal security group for System Center 2012 Configuration Manager. The security permissions of Read Members and Write Members for the site server computer account remain the same.
  
  
• The OU can be used without modification. However, System Center 2012 Configuration Manager no longer requires Full Control to this object and all child objects. You can reduce these permissions to Create Computer Objects and Delete Computer Objects on this object only.
  
  
• The web server certificate template from Configuration Manager 2007 cannot be used in System Center 2012 Configuration Manager without modification. This certificate template no longer uses Supply in the request and the site server computer account no longer requires Read and Enroll permissions.
  
  

For more information about the security group and OU, see Step 1 in How to Provision and Configure AMT-Based Computers in Configuration Manager.

For more information about the certificate requirements, see PKI Certificate Requirements for Configuration Manager and the example deployment, Deploying the Certificates for AMT.

Yes, you are limited to three certificate templates per hierarchy and each of these certificate templates are restricted to the three key usages that the Network Device Enrollment Service supports: signing, encryption, and both signing and encryption. So, for example, you couldn’t use two certificate templates that supported both signing and encryption.

Although different servers running the Network Device Enrollment Service can be configured to use different certificate templates, Configuration Manager cannot support this configuration because you cannot assign clients to specific servers. If you have multiple certificate registration point site system servers in the hierarchy that communicate with multiple servers running the Network Device Enrollment Service, Configuration Manager non-deterministically assigns clients to the available servers to automatically load balance the requests.

For more information about the certificate templates that Configuration Manager uses to deploy certificate profiles, see the SCEP certificate information procedure in Step 3: Provide Information about the Certificate Profile from the How to Create Certificate Profiles in Configuration Manager topic.

Yes, although you do not need Windows Server 2012 R2 for the certificate registration point, you do need this operating system version (or later) to install the Configuration Manager Policy Module on the server that runs the Network Device Enrollment Service.

Before this version of the operating system, the Network Device Enrollment Service was designed for secured intranet environments only, to accept interactive computer certificate requests for network equipment such as routers. Changes in Windows Server 2012 R2 now accommodate user certificates as well as computer certificates, and the new support for a policy module makes this solution scalable for an enterprise environment. In addition, the increased security now supports running this service in a perimeter network (also known as a DMZ), which is important for devices that you manage on the Internet, such as iOS and Android devices.

For more information about the changes to the Network Device Enrollment Service in Windows Server 2012 R2, see What's New in Certificate Services in Windows Server 2012 R2.

There is no report in System Center 2012 Configuration Manager that displays which collections of computers have a power plan applied. However, in the Device Collections list, you can select the Power Configurations column to display whether a collection has a power plan applied.

Yes. Wake-up proxy in Configuration Manager SP1 has its own client service named ConfigMgr Wake-up Proxy that runs separately from the SMS Agent Host (CCMExec.exe). This service is installed when a client is configured for wake-up proxy and then new client checks make sure that this wake-up proxy service is running and that the startup type is automatic.

If you have enabled the wake-up proxy client setting on Configuration Manager SP1 clients, and then disable it, the ConfigMgr Wake-up Proxy service is removed from clients.

A manager computer for the sleeping computer’s subnet responds to the first connection attempt and wakes up the sleeping computer, which then contacts the network switch. After the computer is awake and the network switch is updated, subsequent connection attempts will successfully connect to the destination computer. Most TCP connections automatically retry and you will not see that the first connection (and possibly additional connections) time out. For Remote Desktop connections, however, you are more likely to see an initial failed connection and must manually retry. For computers that must come out of hibernation, you will probably experience a longer delay than for computers that are in other sleep states.

To better support virtual desktop infrastructure (VDI) environments and large-scale client deployments, System Center 2012 Configuration Manager has a randomization delay for scheduled activities. This means that for scheduled activities, clients are unlikely to run the action at the exact time that you configure. In Configuration Manager SP1 only, you can use client settings to enable or disable the randomization delay for required software updates and required applications. By default, this setting is disabled.

For more information, see the Considerations for Managing the Configuration Manager Client in a Virtual Desktop Infrastructure (VDI) section in the Introduction to Client Deployment in Configuration Manager topic.

For System Center 2012 Configuration Manager SP1 and System Center 2012 R2 Configuration Manager only:

Because the management of computers that run the Mac OS X operating system is similar to managing Windows-based computers in System Center 2012 Configuration Manager, there is no separate documentation section for Mac computers. Instead, information is integrated throughout the documentation library. For example, information about how to install the client on Mac computers is in the Deploying Clients for System Center 2012 Configuration Manager guide, and information about how to deploy software to Mac computers is in the Deploying Software and Operating Systems in System Center 2012 Configuration Manager guide.

Some of the main topics that contain information about the Configuration Manager client for Mac computers include the following:

For System Center 2012 Configuration Manager SP1 and System Center 2012 R2 Configuration Manager only:

Because the management of computers that run Linux and UNIX is similar to managing Windows-based computers in System Center 2012 Configuration Manager, there is no separate documentation section for Linux and UNIX. Instead, information is integrated throughout the documentation library. For example, information about how to install the client on computers that run Linux or UNIX is in the Deploying Clients for System Center 2012 Configuration Manager guide, and information about how to deploy software to computers that run Linux and UNIX computers is in the Deploying Software and Operating Systems in System Center 2012 Configuration Manager guide.

Some of the main topics that contain information about the Configuration Manager client for Linux and UNIX include the following:

A good place to begin is with How to Manage Mobile Devices by Using Configuration Manager and Windows Intune.

Some of the main topics that contain information about mobile devices include the following:

If you have mobile device legacy clients in your System Center 2012 Configuration Manager hierarchy, the installation and configuration for these mobile devices is the same as in Configuration Manager 2007. For more information, see Mobile Device Management in Configuration Manager in the Configuration Manager 2007 documentation library.

No. In this dual management scenario, Configuration Manager sends the wipe command in the client policy and by using the Exchange Server connector, and then monitors the wipe status for the mobile device. As soon as Configuration Manager receives a wipe confirmation from the mobile device, it cancels the second and pending wipe command so that the mobile device is not wiped twice.

Yes, if you only want to find mobile devices and retrieve inventory data from them as a read-only mode of operation, you can do this by granting a subset of the cmdlets that the account uses to connect to the Exchange Client Access server. The required cmdlets for a read-only mode of operation are as follows:

• Get-ActiveSyncDevice
  
  
• Get-ActiveSyncDeviceStatistics
  
  
• Get-ActiveSyncOrganizationSettings
  
  
• Get-ActiveSyncMailboxPolicy
  
  
• Get-ExchangeServer
  
  
• Get-Recipient
  
  
• Set-ADServerSettings
  
  

Warning
When the Exchange Server connector operates with these limited permissions, you cannot create access rules, or wipe mobile devices, and mobile devices will not be configured with the settings that you define. In addition, Configuration Manager will generate alerts and status messages to notify you that it could not complete operations that are related to the Exchange Server connector.

Yes. You must specify a Windows Intune organizational account before you can install the Windows Intune connector in Configuration Manager SP1.

Yes. You require specific application certificates before users can install applications on Windows RT, Windows Phone 8, and iOS. You do not require certificates to make applications available to mobile devices that run Android.

For more information about these certificates, see How to Manage Mobile Devices by Using Configuration Manager and Windows Intune.

No. Although the Windows Intune connector uses PKI certificates, Windows Intune automatically requests and installs these certificates for you.

For more information about these certificates, see PKI Certificate Requirements for Configuration Manager.

No. Windows RT and Windows Phone 8 includes a management client that Configuration Manager uses, and Configuration Manager manages mobile devices that run iOS by directly calling APIs.

No. Without the Windows Intune connector, you can manage these devices by collecting hardware inventory, configure settings such as passwords and roaming, and remotely wipe the device. However, if you want to make company apps available to Android devices, you must install the Windows Intune connector.

No. Mobile devices that are enrolled by Configuration Manager support only required apps, so users cannot choose company apps to install. Users who have mobile devices that are enrolled by Windows Intune install company apps from the company portal. However, if these apps require approval, users must first request approval from the Application Catalog.

By default, remote control is disabled on client computers. Enable remote control as a default client setting for the hierarchy, or by using custom client settings that you apply to selected collections.

TCP 2701 is the only port that System Center 2012 Configuration Manager uses for remote control. When you enable remote control as a client setting, you can select one of three firewall profiles that automatically configure this port on Configuration Manager clients: Domain, Private, or Public.

The Permitted Viewers List grants an administrative user the Remote Control permission for a computer, and the role-based administration security role of Remote Tools Operator grants an administrative user the ability to connect a Configuration Manager console to a site so that audit messages are sent when they manage computers by using remote control.

Yes. In the Configuration Manager remote control window, click Action, and then click Send Ctrl+Alt+Del.

You can find this out by using the remote control reports: Remote Control – All computers remote controlled by a specific user and Remote Control – All remote control information. For more information, see How to Audit Remote Control Usage in Configuration Manager.

The remote control settings for System Center 2012 Configuration Manager clients are now in Software Center, on the Options tab.

No, site servers do not compress the content that it distributes to distribution points that are enabled for bandwidth control. Whereas site-to-site transfers potentially resend files that might already be present, only to be discarded by the destination site server, a site server sends only the files that a distribution point requires. With a lower volume of data to transfer, the disadvantages of high CPU processing to compress and decompress the data usually outweigh the advantages of compressing the data.

System Center 2012 Configuration Manager applications contain the administrative details and Application Catalog information necessary to deploy a software package or software update to a computer or mobile device.

A deployment type is contained within an application and specifies the installation files and method that Configuration Manager will use to install the software. The deployment type contains rules and settings that control if and how the software is installed on client computers.

The deployment purpose defines what the deployment should do and represents the administrator’s intent. For example, an administrative user might require the installation of software on client computers or might just make the software available for users to install themselves. A global condition can be set to check regularly that required applications are installed and to reinstall them if they have been removed.

Global conditions are conditions used by requirement rules. Requirement rules set a value for a deployment type for a global condition. For example, “operating system =” is a global condition; a requirement rule is “operating system = Win7.”

To make a deployment optional, configure the deployment purpose as Available in the applications deployment type. Available applications display in the Application Catalog where users can install them.

Yes. Users can browse a list of available software in the Application Catalog. Users can then request an application which, if approved, will be installed on their computer. To make a deployment optional, configure the deployment purpose as Available in the applications deployment type.

Some scenarios, such as the deployment of a script that runs on a client computer but that does not install software, are more suited to using a package and program rather than an application.

Yes. You can configure multiple deployment types for an application. Rules that specify which deployment type is run allows you to specify how the application is made available to the user.

Yes. Configuration Manager collects usage statistics from client devices that can be used to automatically define user device affinities or to help you manually create affinities.

No. you must create a new deployment that can include extra options that include scheduling and user experience.

In this case, the following rules apply:

• If both deployments have a purpose of Available, the user deployment will be installed.
  
  
• If both deployments have a purpose of Required, the deployment with the earliest deadline will be installed.
  
  
• If one deployment has a purpose of Available and the other deployment has a purpose of Required, the deployment with the purpose of Required will be installed.
  
  

Note
A deployment to a user that is scheduled to be installed out of business hours is treated as a required deployment.

Yes. You can see migrated packages and programs in the Packages node in the Software Library workspace. You can also use the Import Package from Definition Wizard to import Configuration Manager 2007 package definition files into your site.

Yes. In System Center 2012 Configuration Manager, the term software includes software updates, applications, scripts, task sequences, device drivers, configuration items, and configuration baselines.

Depending on the deployment purpose you have specified in the deployment type of an application, System Center 2012 Configuration Manager periodically checks that the state of the application is the same as its purpose. For example, if an application’s deployment type is specified as Required, Configuration Manager reinstalls the application if it has been removed. Only one deployment type can be created per application and collection pair.

No, you can continue to deploy packages and programs that have been migrated from your Configuration Manager 2007 site. However, packages and programs cannot use some of the new features of System Center 2012 Configuration Manager such as requirement rules, dependencies and supersedence.

Deployments to users or devices are summarized based on the worst result. For example, if a deployment is successful on one device and the application requirements were not met on another device then the deployment for the user is summarized as Requirements Not Met. If none of the user’s devices has received the application, the deployment is summarized as Unknown.

If you don’t require HTTPS connections (for example, users will not connect from the Internet), you can use the following the quick guide instructions:

1. Make sure that you have all the prerequisites for the Application Catalog site roles. For more information, see Prerequisites for Application Management in Configuration Manager.
   
   
2. Install the following Application Catalog site system roles and select the default options:
   
   
   • Application Catalog web service point
     
     
   • Application Catalog website point
     
     
3. Configure the following Computer Agent device client settings by editing the default client settings, or by creating and assigning custom client settings:
   
   
   • Default Application Catalog website point: Automatically detect
     
     
   • Add default Application Catalog website to Internet Explorer trusted site zone: True
     
     
   • Install Permissions: All users
     
     

For full instructions, see Configuring the Application Catalog and Software Center in Configuration Manager.

You can use a task sequence to deploy applications. However, when you configure an application deployment rather than use a task sequence, you benefit from the following:

• You have a richer monitoring and compliance experience.
  
  
• You can supersede a previous version of the application and can uninstall or upgrade the previous version.
  
  
• You can deploy applications to users.
  
  

For more information about how to deploy applications, see Introduction to Application Management in Configuration Manager.

Although you can configure the application deployment summarization interval, by default, the following values apply:

• Deployments that were modified in the last 30 days – 1 hour
  
  
• Deployments that were modified in the last 31 to 90 days – 1 day
  
  
• Deployments that were modified over 90 days ago – 1 week
  
  

You can modify the application deployment summarization intervals from the Status Summarizers dialog box. Click Status Summarizers from the Sites node in the Administration workspace to open this dialog box.

In most cases, a deployment with an action of Uninstall will always uninstall a deployment type if it is detected unless the client type is different. For example, if you deploy a mobile device application with an action of Uninstall to a desktop computer, the deployment will fail with a status of Requirements not met as it is impossible to enforce this uninstall.

Although you cannot deploy a simulated and a standard deployment of an application to the same collection, you can target a computer with both if you deploy them to different collections and the computer is a member of both collections. In this scenario, for both deployments, the computer reports the results of the standard deployment. This explains how you might see deployment states for a simulated deployment that you would usually only see for a standard deployment, such as In Progress and Error.

You can install applications only when the write filter on the Windows Embedded device is disabled. If you try to install an application on a Windows Embedded device that has write filters enabled, you see an error message that you have insufficient permissions to install the application and the installation fails.

In Configuration Manager 2007, you had to use collections to identify which devices should install software, such as applications, task sequences, and software updates.  In System Center 2012 Configuration Manager, you must continue to use collections for task sequences, but for applications, you can now use requirement rules as a method to control which devices install the software. For example, you could deploy an application to the All Desktop and Server Clients collection, but include a requirement rule that specifies that the application should be installed only on computers that run Windows 8.  Software updates already have this requirements capability built in, so you do not need to configure this yourself.

Although defining the requirements within the application deployment usually requires more work initially, it has longer term benefits because it reduces the administrative overhead of maintaining, using, and searching many collections. Additionally, requirements are evaluated by the client at deployment time, whereas query-based collections are evaluated periodically and often depend on the results of hardware inventory collection that might run only once a week. Another consideration when you have many collections with complex query rules is that the collection evaluation can result in noticeable CPU processing on the site server.

In summary, we recommend that for most application deployments, you use requirement rules instead of collections. Continue to use collections for task sequences, package and programs, testing purposes, and one-off application deployments.

No. Software update groups are new in System Center 2012 Configuration Manager and replace update lists that were used in Configuration Manager 2007.

Software update groups provide a more effective method for you to organize software updates in your environment. You can manually add software updates to a software update group or software updates can be automatically added to a new or existing software update group by using an automatic deployment rule. You can also deploy a software update group manually or automatically by using an automatic deployment rule. After you deploy a software update group, you can add new software updates to the group and they will automatically be deployed.

Yes. You can create automatic deployment rules to automatically approve and deploy software updates that meet specified search criteria.

In Configuration Manager 2007, superseded software updates are automatically expired during full software updates synchronization. In System Center 2012 Configuration Manager, you can choose to automatically expire superseded software updates during software updates synchronization just as it is in Configuration Manager 2007. Or, you can specify a number of months before a superseded software update is expired. This allows you to deploy a superseded software update for the period of time while you validate and approve the superseding software update in your environment.

System Center 2012 Configuration Manager might automatically remove expired and superseded software updates. Consider the following scenarios:

• Expired software updates that are not associated with a deployment are automatically removed up every 7 days by a site maintenance task.
  
  
• Expired software updates that are associated with a deployment are not automatically removed by the site maintenance task.
  
  
• Superseded software updates that you have configured not to expire for a specified period of time are not removed or deleted by the site maintenance task.
  
  

You can remove expired software updates from all software update groups and software update deployments so that they are automatically removed. To do this, search for expired software updates, select the returned results, choose edit membership, and remove the expired software updates from any software update group for which they are members.

The software update group icons are different in the following scenarios:

• When a software update group contains at least one expired software update, the icon for that software update group contains a black X.
  
  
• When a software update group contains no expired software updates, but at least one superseded software update, the icon for that software update group contains a yellow star.
  
  
• When a software update group has no expired or superseded software updates, the icon for that software update group contains a green arrow.
  
  

The compliance percentage (Compliance %) is calculated by taking the number of users or devices with a deployment state of Success added to the number of devices with a deployment state of Requirements Not Met and then dividing this total by the number of users or devices that the deployment was sent to.

The following reasons might cause the numbers shown in Completions Statistics and the View Status pane to differ:

• The completion statistics are summarized and the View Status pane displays live data – Select the deployment in the Deployments node of the Monitoring workspace and then, in the Home tab, in the Deployment group, click Run Summarization. Refresh the display in the Configuration Manager console and after summarization completes, the updated completion statistics will display in the Configuration Manager console.
  
  
• An application contains multiple deployment types. The completion statistics display one status for the application; the View Status pane displays status for each deployment type in the application.
  
  
• The client encountered an error. It was able to report status for the application, but not for the deployment types contained in the application. You can use the report Application Infrastructure Errors to troubleshoot this scenario.
  
  

When a pull-distribution point downloads content from a source distribution point, that access is counted as a client access for the purpose of this report.

The report does not track the value of bytes sent over multicast.

Yes. You can use media such as a CD, DVD set, or a USB flash drive to capture an operating system image and to deploy an operating system. Deployment media includes bootable media, prestaged media, and stand-alone media. For more information, see Planning for Media Operating System Deployments in Configuration Manager.

Yes. When you deploy an operating system you can add steps to your task sequence that capture and restore the user state. The captured data can be stored on a state migration point or on the computer where the operating system is deployed. For more information, see How to Manage the User State in Configuration Manager.

Yes. These types of computers are referred to as unknown computers. For more information about how to deploy operating systems to unknown computers, see How to Manage Unknown Computer Deployments in Configuration Manager.

Yes. Use multicast to simultaneously send data to multiple Configuration Manager clients rather than sending a copy of the data to each client over a separate connection. For more information, see Planning a Multicast Strategy in Configuration Manager.

Endpoint Protection is fully integrated with System Center 2012 Configuration Manager and no longer requires a separate installation. In addition, there are a number of new features and enhancements in Endpoint Protection. For more information, see the Endpoint Protection section in the What’s New in System Center 2012 Configuration Manager topic.

Yes, you can deploy Endpoint Protection definitions by using Configuration Manager software updates. For more information, see Step 3: Configure Configuration Manager Software Updates to Deliver Definition Updates to Client Computers in the How to Configure Endpoint Protection in Configuration Manager topic.

Yes, System Center 2012 Endpoint Protection uses Configuration Manager alerts to more quickly notify you when malware is detected on client computers.

For a list of the antimalware solutions that Configuration Manager can automatically uninstall when you install the Endpoint Protection client, see the Endpoint Protection section in the About Client Settings in Configuration Manager topic. For more information about how to configure Endpoint Protection to uninstall these antimalware solutions, see How to Configure Endpoint Protection in Configuration Manager.