If you extend the Active Directory schema for System Center 2012 Configuration Manager, you can publish System Center 2012 Configuration Manager sites to Active Directory Domain Services so that Active Directory computers can securely retrieve System Center 2012 Configuration Manager site information from a trusted source. Although publishing site information to Active Directory Domain Services is not required for basic Configuration Manager functionality, this configuration improves the security of your System Center 2012 Configuration Manager hierarchy and reduces administrative overhead.

You can extend the Active Directory schema before or after you install System Center 2012 Configuration Manager. Before you can publish site information, you must also create an Active Directory container named System Management in each domain that contains a System Center 2012 Configuration Manager site. You must also configure the Active Directory permissions so that the site can publish its information to this Active Directory container. As with all schema extensions, you extend the schema for System Center 2012 Configuration Manager one time only per forest.

Configuration Manager uses site system roles to support management operations at each site. When you install a Configuration Manager site, some site system roles are automatically installed and assigned to the server on which Configuration Manager Setup has run successfully. One of these site system roles is the site server, which you cannot transfer to another server or remove without uninstalling the site. You can use other servers to run additional site system roles or to transfer some site system roles from the site server by installing and configuring Configuration Manager site system servers.

Each site system role supports different management functions. The site system roles that provide basic management functionality are described in the following table.

When companies first deploy Configuration Manager in a production environment, they typically run multiple site system roles on the site server and have additional site system servers for distribution points. Then they install additional site system servers and add new site system roles, according to their business requirements and network infrastructure.

The additional site system roles that you might need for specific functionality are listed in the following table.

The following diagram shows these basic and additional site system roles that you can add to the site server computer or distribute by installing additional site system servers.

In addition to the collections for devices, there are also user collections that contain users from Active Directory Domain Services. User collections let you install software on all computers that the user logs into, or you can configure user device affinity so that the software installs on only the main devices that the user uses. These main devices are called primary devices. A user can have one or more primary devices.

One of the ways in which users can control their software deployment experience is by using the new computer client interface, Software Center. Software Center is automatically installed on client computers and accessed from the users’ Start menu. This client interface lets users manage their own software, as well as perform the following:

• Install software
  
  
• Schedule software to automatically install outside working hours
  
  
• Configure when Configuration Manager can install software on their device
  
  
• Configure access settings for remote control, if remote control is enabled in Configuration Manager
  
  
• Configure options for power management if an administrative user has enabled this
  
  

A link in Software Center lets users connect to the Application Catalog, where they can browse for, install, and request software. In addition, the Application Catalog lets users configure some preference settings and wipe their mobile devices. Because Application Catalog is a website that is hosted in IIS, users can also access the Application Catalog directly from a browser, from the intranet, or from the Internet.

Users can also specify their primary devices from the Application Catalog, if you allow this configuration. Other methods of configuring the user device affinity information include importing the information from a file and automatic generation from usage data.

When you first install System Center 2012 Configuration Manager, all clients in the hierarchy are configured by using default client settings that you can change. These client settings include configuration options such as how frequently devices communicate with the site, whether the client is enabled for software updates and other management operations, and whether users can enroll their mobile devices to be managed by Configuration Manager. If you need different client settings for groups of users or devices, you can create custom client settings and then assign them to collections. Users or devices that are in the collection will be configured to have the custom settings. You can create multiple custom client settings and they are applied in the order that you specify. When you have multiple custom client settings, they are applied according to their order number. If there are any conflicts, the setting that has the lowest order number overrides the other settings.

The following diagram shows an example of how you could create and apply custom client settings.

The System Center 2012 Configuration Manager client software provides full management capability for users and devices. However, there are also two scenarios in which you can manage devices independently from the client software: out of band management, which uses Intel Active Management Technology (AMT), and mobile devices that are connected to an Exchange Server computer.

Configuration Manager uses the client software to provision and configure computers for AMT, but when you perform AMT management operations, the client software is not used. Instead, Configuration Manager connects directly to the AMT management controller. This means that you continue to have some management control over computers that are not started or are not responding at the operating system level. For example, you could restart these computers, re-image them, or run diagnostic utilities to help troubleshoot them.

When you cannot install the Configuration Manager client software on mobile devices, you can still manage them by using the Exchange Server connector. The connector lets you configure the settings in the Exchange Default ActiveSync mailbox policy. Any settings that are defined in this policy can be configured by Configuration Manager, and this connector also supports remote wipe and Exchange access rules for block and quarantine. Any mobile device that you manage by using the Exchange Server connector displays in the All Mobile Devices collection, even though the device does not have the System Center 2012 Configuration Manager client installed. Because the client is not installed, you cannot deploy software to these devices.

When you install the Configuration Manager client, this installs the Configuration Manager client application in Control Panel. Unlike Software Center, this application is designed for the help desk rather than for end users. Some configuration options require local administrative permissions and most options require technical knowledge about how Configuration Manager works. You can use this application to perform the following tasks on a client:

• View properties about the client, such as the build number, its assigned site, the management point it is communicating with, and whether the client is using a PKI certificate or a self-signed certificate.
  
  
• Confirm that the client has successfully downloaded client policy after the client is installed for the first time and that client settings are enabled or disabled as expected, according to the client settings that are configured in the Configuration Manager console.
  
  
• Start client actions, such as download the client policy if there was a recent change of configuration in the Configuration Manager console and you do not want to wait until the next schedule time.
  
  
• Manually assign a client to a Configuration Manager site or try to find a site, and specify the DNS suffix for management points that publish to DNS.
  
  
• Configure the client cache that temporarily stores files, and delete files in the cache if you require more disk space to install software.
  
  
• Configure settings for Internet-based client management.
  
  
• View configuration baselines that were deployed to the client, initiate compliance evaluation, and view compliance reports.
  
  

System Center 2012 Configuration Manager uses role-based administration to help secure objects such as collections, deployments, and sites. This administration model centrally defines and manages hierarchy-wide security access settings for all sites and site settings. Security roles are assigned to administrative users and group permissions to different Configuration Manager object types, such as the permissions to create or change client settings. Security scopes group specific instances of objects that an administrative user is responsible to manage, such as an application that installs Microsoft Office 2010. The combination of security roles, security scopes, and collections define what objects an administrative user can view and manage. System Center 2012 Configuration Manager installs some default security roles for typical management tasks. However, you can create your own security roles to support your specific business requirements.

Client communication to site system roles is secured by using either self-signed certificates, or by using public key infrastructure (PKI) certificates. Computer clients that Configuration Manager detects to be on the Internet and mobile device clients must use PKI certificates so that the client endpoints can be secured by using HTTPS. The site system roles that clients connect to can be configured for either HTTPS or HTTP client communication. Client computers always communicate by using the most secure method that is available and only fall back to using the less secure communication method of HTTP on the intranet if you have site systems roles that allow HTTP communication.

System Center 2012 Configuration Manager uses the Local System account for most site operations. However, some management tasks might require creating and maintaining additional accounts. Several default groups and SQL Server roles are created during Setup. However, you might have to manually add computer or user accounts to these default groups and roles.

Although enterprise management products offer many advantages because they can effectively manage lots of clients, you must also be aware of how this software might affect the privacy of users in your organization. System Center 2012 Configuration Manager includes many tools to collect data and monitor devices, some of which could raise privacy concerns.

For example, when you install the System Center 2012 Configuration Manager client, many management settings are enabled by default. This results in the client software sending information to the Configuration Manager site. Client information is stored in the Configuration Manager database and the information is not sent to Microsoft. Before you implement System Center 2012 Configuration Manager, consider your privacy requirements.