Managing iTunes with Group Policy

iTunes is one of those apps that is becoming a bit difficult to avoid in the workplace. With the growth of iPads in the enterprise, employees are starting to ask for iTunes on their workstations. Getting the software on a workstation is easy enough, but how do you manage it?

Luckily Apple have a support document at http://support.apple.com/kb/HT2102 which details what registry settings to change. You'll probably want to skip to the "Preconfiguring Parental Controls" section, as the top half suggests you should create a unique entry in HKLM for every user that will ever log in to that machine. Thankfully it's a lot more straightforward than that.

By default iTunes will have created the following key on install (on a 32-bit machine remove the Wow6432Node part)-

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apple Computer, Inc.\iTunes

Create keys named Parental Controls and Default so you get this path-

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apple Computer, Inc.\iTunes\Parental Controls\Default

In the Default key create a DWORD value (choose 32-bit if you're on a 64-bit machine) named AdminFlags. To test it works, let's try and disable Ping and the iTunes Store. From the table at the article above we can see the flags we want are-

kParentalFlags_DisableMusicStore 0x00000004
kParentlFlags_DisablePing 0x00800000

The AdminFlags value is a bitmask of these flags, so we just add these values together. This gives us a value of 0x00800004. But if you set AdminFlags to that value nothing will happen. Apple state that "these flags are only respected in AdminFlags when kParentalFlags_Locked is set." From the table at apple-

kParentalFlags_Locked 0x00000001

So, for any of these values to take effect we need to add 1. This gives us 0x00800005 or the decimal value 8388613. Set this value and lets see what happens.

So here is iTunes before setting the value...

...and here is iTunes after we set the value...

For people working in education this is a useful flag - 0x01940005 or 26476549 in decimal. This prevents the welcome screen from loading and allows access to iTunes-U while blocking access to the rest of the iTunes store.

Using Orca to fix "the operating system is not adequate" MSI failures

Packaging up an MSI install for Windows 7 x64 I got this message-

"The operating system is not adequate for running [app]". Obviously Windows 7 x64 is adequate, but how do we get round this problem?

The simplest of all options is to right click the MSI and on the Compatibility tab tick the box "Run this program in compatibility mode for: Previous version of Windows". However, knowing that this is probably just a spurious error, I wanted to patch the MSI so that I don't need to worry about this condition in the future.

Launching Orca I can see straight away there is a LaunchCondition set that will probably be causing the issue-

(Version9X = 400) OR (Version9X = 410 And Not WindowsBuild = 2222) OR (Version9X = 410 And WindowsBuild = 2222) OR (Version9X = 490) OR (VersionNT = 400) OR (VersionNT = 500) OR (VersionNT = 501)

I could just remove the condition and save the modified MSI, but I always prefer to leave the MSI intact and create a transform file. So, from the Transform menu choose New Transform. The title bar will change to say "[app].msi (transformed by Untitled)".

Right click the row we want to delete and choose "Drop Row"

A green line should now appear through the row. From the Transform menu choose Generate Transform and save the mst file in the same folder as your MSI. I called mine platformfix.mst.

Now try installing the app. To check the transform is working, run the MSI without the transform, then with the transform. This command should return the original error-

msiexec /i Plastics.msi

Whereas this should bypass the version check-

msiexec /i Plastics.msi TRANSFORMS=platformfix.mst

Configuration Manager 2012 released

Microsoft quietly RTM'd SCCM 2012 over the weekend. At the moment it only looks like it's available for Volume Licensing customers. Presumably the official release date will be April 17th 2012, the morning Brad Anderson does the Keynote at MMS 2012.

If you're having trouble finding it in the download center, that's probably because it is not listed under Configuration Manager. Searching for Configuration manager will only find SCCM 2007. SCCM 2012 can be found listed under the System Center 2012 Standard and System Center 2012 Datacenter suites.

Thankfully the suites are logically split into collections of ISO files. The Standard Configuration Manager and Endpoint protection ISO is 1.67GB in size.

If you've installed Configuration Manager before you'll recognise the installer. Let the migration begin!

Configuration Manager 2012 Licensing

I went to the System Center 2012 Preview Roadshow in Edinburgh yesterday. Sadly, this wasn't one of Microsoft's best events (it was pretty awful), but there was one bit of information they presented that I hadn't noticed before.

There are some big changes with the way the System Center products are licensed with the 2012 release. Gone are the days when you could licence Operations Manager or Configuration Manager separately. All the products are bundled together and there are only two options for licensing now-

• System Center 2012 Datacenter Edition
• System Center 2012 Standard Edition

Both products give you the entire System Center suite - Operations Manager, Config Manager, DPM, VMM, Service Manager, Forefront Endpoint Protection and the two new guys Orchestrator (formerly Opalis) and App Controller (formerly project Concero). The only difference (apart from price) is that the Datacenter edition allows you to install as many virtual machines as you want on a two core server - the Standard edition is stuck at two VMs.

On the client side, the Core CAL will still give you ConfigMgr and Forefront Endpoint Protection. The Enterprise CAL adds DPM, OpsMgr, Orchestrator and Service Manager.

SQL Server 2008 R2 in a task sequence

When packaging up software for SCCM I like to find a silent install switch that shows some kind of progress bar. This has the obvious benefit of providing feedback during testing, but can cause unexpected problems. Like when installing SQL Server 2008 R2 Express.

There are 2 silent install parameters for SQL Server 2008 R2-

• /Q - quiet install with no user interface
• /QS - quiet install but with progress dialog

I'd normally prefer to use /QS so I can see what is going on during testing. However, this is the result of my testing with SCCM-

• /Q - works fine in a Task Sequence
• /QS - doesn't work at all

So, if you're having an issue with installing SQL Server 2008 R2 (and 2008 R2 Express), try using /Q instead of /QS.

The other issue that I saw with the install is that the command line can be longer than 255 characters and this is a hard limit in the Program Command Line box in SCCM. The solution to this is to copy the command line into an install.cmd file and run that instead. This allows you to have command lines like this-

SQLEXPR_x86_ENU.exe /ACTION=INSTALL /FEATURES=SQLEngine /INSTANCENAME=MyInstance /SQLCOLLATION=Latin1_General_BIN /SQLSVCSTARTUPTYPE=Automatic /SQLSVCACCOUNT="NT AUTHORITY\NETWORK SERVICE" /SQLSYSADMINACCOUNTS="BUILTIN\ADMINISTRATORS" /IAcceptSQLServerLicenseTerms="True" /Q

Automatically delete roaming profiles on workstations

If you're running a pre-Vista OS and have roaming profiles enabled you have probably noticed that Windows will cache those profiles on workstations. This is great if it's your primary machine as you don't need to download the entire profile every time you log in, but can be a real pain for lab style machines. If you have enough different logins your workstations can run out of disk space!
One of the solutions to this is to run Delprof. This is a Microsoft utility that will delete inactive profiles. A sample command line is

delprof.exe /I /Q /D:30

The above command will remove inactive profiles that are over 30 days old. Depending on the traffic on your machines you may wish to increase this value. But what is the best way of running this command?

I'd recommend deploying this using schtasks. This allows you to run delprof when the machine is idle - I've seen corruptions occur when delprof runs at logon or logoff, so this is probably a safer way. I run the following batch file on each workstation -

copy delprof.exe c:\windows\system32

schtasks /create /tn "Delete Inactive Profiles" /tr "delprof.exe /I /Q /D:5" /sc ONIDLE /i 5 /ru "SYSTEM"

Delprof is available from the Microsoft download center (www.microsoft.com/download/en/details.aspx?id=5405).

Fixing broken SMSSLP settings

MadLuka has a great post here about some issues related to the R3 upgrade for the SCCM client. Basically, deploying this hotfix without respecifying the correct parameters can knock out your SMSSLP settings on your clients. This is not an issue if your clients can find the management point using WINS, DNS or Active Directory, but is a massive issue if you have workgroup clients that don't use these technologies.

Our fix was to roll out the registry key HKLM\SOFTWARE\Microsoft\CCM\SMSSLP to all affected machines and this fixed the issue.