If you extend the Active Directory schema for Configuration Manager 2012, you can publish Configuration Manager 2012 sites to Active Directory Domain Services so that Active Directory computers can securely retrieve Configuration Manager 2012 site information from a trusted source. Although publishing site information to Active Directory Domain Services is not required for basic Configuration Manager functionality, this configuration increases the security of your Configuration Manager 2012 hierarchy and reduces administrative overhead.

You can extend the Active Directory schema before or after you install Configuration Manager 2012. Before you can publish site information, you must also create an Active Directory container named System Management in each domain that contains a Configuration Manager 2012 site. You must also configure the Active Directory permissions so that the site can publish its information to this Active Directory container. As with all schema extensions, you extend the schema for Configuration Manager 2012 one time only per forest.

Configuration Manager uses site system roles to support management operations at each site. When you install a Configuration Manager site, some site system roles are automatically installed and assigned to the server on which Configuration Manager Setup has run successfully. One of these site system roles is the site server, which you cannot transfer to another server or remove without uninstalling the site. You can use other servers to run additional site system roles or to transfer some site system roles from the site server by installing and configuring Configuration Manager site system servers.

Each site system role supports different management functions. The site system roles that provide basic management functionality are described in the following table.

When companies first deploy Configuration Manager in a production environment, they often run multiple site system roles on the site server and have additional site system servers for distribution points. Then they install additional site system servers and add new site system roles, according to their business requirements and network infrastructure.

The additional site system roles that you might need for specific functionality are listed in the following table.

In addition to the collections for devices, there are also user collections that contain users from Active Directory Domain Services. User collections allow you to install software on all computers that the user logs into, or you can configure user device affinity so that the software installs on only the main devices that the user uses. These main devices are called primary devices and a user can have one or more primary devices.

Users can manage their software and request new applications by using the client application, named Software Center. This application installs when the Configuration Manager 2012 client installs and allows users to browse the Application Catalog to find and request applications. Users can also specify their primary devices from the Application Catalog, if you allow this configuration. Other methods of configuring the user device affinity information include importing the information from a file and using tracking data.

When you first install Configuration Manager 2012, all clients in the hierarchy are configured with default client settings, which you can modify. These client settings include configuration options such as how often devices communicate with the site, whether the client is enabled for software updates and other management operations, and whether users can enroll their mobile devices to be managed by Configuration Manager. If you need different client settings for groups of users or devices, you can create custom client settings and then assign them to collections. Users or devices that are in the collection will be configured with the custom settings. You can create multiple custom client settings and they are applied in the order that you specify. If there is a conflict between settings on a device or user, similar to Group Policy behavior, the final configuration for the device or user will be the last custom setting that is applied.

The Configuration Manager 2012 client software provides full management capability for users and devices but there are also two scenarios in which you can manage devices independently from the client software: out of band management, which uses Intel Active Management Technology (AMT), and mobile devices that are connected to an Exchange Server computer.

Configuration Manager uses the client software to provision and configure computers for AMT, but when you perform AMT management operations, the client software is not used. Instead, Configuration Manager connects directly to the AMT management controller. This means that you continue to have some management control over computers that are not started or are not responding at the operating system level. For example, you could restart these computers, re-image them, or run diagnostic utilities to help troubleshoot them.

When you cannot install the Configuration Manager client software on mobile devices, you can still manage them by using the Exchange Server connector. The connector allows you to configure the settings in the Exchange Default ActiveSync mailbox policy. Any settings that are defined in this policy can be configured by Configuration Manager, and this connector also supports remote wipe. Any mobile device that you manage by using the Exchange Server connector displays in the All Mobile Devices collection, even though the device does not have the Configuration Manager 2012 client installed on it. Because the client is not installed, you cannot deploy software to these devices.

When you install the Configuration Manager client, this installs the Configuration Manager client application in Control Panel. Unlike Software Center, this application is not intended to be used by end users, but rather by the help desk. Some configuration options require local administrative permissions. You can use this application to perform the following tasks on an individual client:

• View properties about the client, such as the build number, its assigned site, which management point it is communicating with, and whether it is using a PKI certificate or a self-signed certificate.
  
  
• Confirm that the client has successfully downloaded client policy after it is installed for the first time and that client settings are enabled or disabled as expected, according to the client settings that are configured in the Configuration Manager console.
  
  
• Initiate client actions, such as download the client policy if there has been a recent change of configuration in the Configuration Manager console and you do not want to wait until the next schedule time.
  
  
• Manually assign a client to a Configuration Manager site or try to find a site, and specify the DNS suffix for management points that publish to DNS.
  
  
• Configure the client cache that temporarily stores files, and delete files in the cache if you need more disk space to install software.
  
  
• Configure settings for Internet-based client management.
  
  
• View configuration baselines that have been deployed to the client, initiate compliance evaluation, and view compliance reports.
  
  

Configuration Manager 2012 uses role-based administration to secure objects such as collections, deployments, and sites. This administration model centrally defines and manages hierarchy-wide security access settings for all sites and site settings. Security roles group typical administrative tasks that are assigned to administrative users, and security scopes group the permissions that are applied to site objects, such as deployments. The combination of security roles, security scopes, and collections define what objects an administrative user can view and manage. Configuration Manager 2012 installs some default security roles for typical management tasks, but you can create your own security roles to support your specific business requirements.

Client communication to site system roles is secured by using either self-signed certificates, or by using public key infrastructure (PKI) certificates. Mobile devices and clients that Configuration Manager detects to be on the Internet must use PKI certificates and the client endpoints are secured by using HTTPS. The site system roles that clients connect to can be configured for HTTPS or HTTP client communication. Client computers always communicate by using the most secure method available and only fall back to using the less secure communication method of HTTP on the intranet if you have site systems roles that are configured for HTTP communication and the client cannot establish a HTTPS connection.

Configuration Manager 2012 uses the Local System account for most site operations. However, some management tasks might require creating and maintaining additional accounts. Several default groups and SQL Server roles are created during Setup, but you might have to manually add computer or user accounts to these default groups and roles.

Although network management products offer many advantages because they can effectively manage large numbers of clients, you must also be aware of how this software might affect the privacy of users in your organization. Configuration Manager 2012 includes many tools to gather data and monitor devices, some of which could raise privacy concerns.

For example, when you install the Configuration Manager 2012 client, many management settings are enabled by default, which result in the client software sending information to the Configuration Manager site. Client information is stored in the Configuration Manager database and it is not sent to Microsoft. Before you implement Configuration Manager 2012, consider your privacy requirements.