Home
%3CLINGO-SUB%20id%3D%22lingo-sub-377226%22%20slang%3D%22en-US%22%3EClient%20Migration%20from%20Configuration%20Manager%202007%20to%20Configuration%20Manager%202012%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-377226%22%20slang%3D%22en-US%22%3E%0A%20%26lt%3Bmeta%20http-equiv%3D%22Content-Type%22%20content%3D%22text%2Fhtml%3B%20charset%3DUTF-8%22%20%2F%26gt%3B%3CSTRONG%3E%20First%20published%20on%20TECHNET%20on%20Jan%2013%2C%202012%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%3CP%3EHi%2C%20I%20am%20Naveen%20Kumar%20Akkugari%20and%20I%20work%20at%20Microsoft%20in%20the%20Management%20Platforms%20and%20Service%20Delivery%20(MPSD)%20organization.%20I%20work%20on%20the%20Configuration%20Manager%20Infrastructure%20team%20which%20provides%20services%20to%20roughly%20300%2C000%20client%20machines%20at%20Microsoft.%20%26nbsp%3BBelow%20I%20share%20the%20process%20we%20followed%20to%20migrate%20client%20machines%20from%20Configuration%20Manager%202007%20to%20Configuration%20Manager%202012.%20We%20currently%20have%20a%20little%20over%20200%2C000%20machines%20migrated%20to%20Configuration%20Manager%202012%20from%20two%20different%20primary%20sites%20in%20Configuration%20Manager%202007.%26nbsp%3B%20In%20this%20blog%20post%2C%20I%20focus%20specifically%20on%20our%20client%20migration%20from%20one%20primary%20site%20(corporate%20headquarters)%20which%20has%20120%2C000%20client%20machines.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EAfter%20reviewing%20multiple%20options%20for%20client%20migration%20and%20installation%20(more%20info%20on%20client%20migration%20options%20can%20be%20found%20here%20-%20%3CA%20href%3D%22http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fgg712283.aspx%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%20http%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fgg712283.aspx%20%3C%2FA%3E%20)%2C%20we%20decided%20to%20continue%20using%20SUP%20based%20client%20installation.%20We%20also%20based%20GPO%20assignment%20on%20security%20groups%20due%20to%20some%20unique%20scenarios%20in%20our%20infrastructure.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EAs%20we%20prepared%20to%20migrate%20our%20clients%20to%20Configuration%20Manager%202012%2C%20we%20had%20several%20goals%20for%20client%20migration%2C%20including%3A%3C%2FP%3E%3CBR%20%2F%3E%3COL%3E%3CBR%20%2F%3E%3CLI%3EMigrate%20clients%20within%20project%20timeline%20(effectively%20and%20efficiently)%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3EAvoid%20any%20negative%20end-user%20impact%20for%20the%20existing%20services%2C%20such%20as%20patching%20and%20software%20distribution%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3EValidate%20Configuration%20Manager%202012%20client%20installation%20options%20(SWD%2C%20CPI%2C%20SUP)%20to%20provide%20feedback%20to%20the%20product%20group%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3EThe%20client%20migration%20approach%20needed%20to%20be%20simple%20for%20client%20migration%20testing%2C%20implementation%20%2C%20maintenance%2C%20and%20troubleshooting%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3EEnsure%20migrated%20clients%20remain%20in%20Configuration%20Manager%202012%20hierarchy%20and%20should%20not%20move%20back%20to%20Configuration%20Manager%202007%20hierarchy%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3EAvoid%20any%20client%20side%20changes%20such%20as%20domain%20or%20OU%20change%20for%20machines%20as%20that%20would%20have%20AD%20and%20GPO%20implications%3C%2FLI%3E%3CBR%20%2F%3E%3C%2FOL%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EIn%20Configuration%20Manager%202007%2C%20we%20had%20a%20single%20primary%20site%20supporting%20all%20corporate%20headquarters%20machines%20(120%2C000%20client%20machines)%20in%20one%20domain%20with%20one%20AD%20site.%20As%20you%20know%2C%20that%20scenario%20is%20not%20supported%20due%20to%20exceeding%20the%20maximum%20number%20of%20clients%20per%20site.%20We%20wanted%20to%20fix%20this%20unsupported%20scenario%20in%20Configuration%20Manager%202012%2C%20so%20we%20configured%20two%20primary%20sites%20and%20used%20security%20groups%20to%20split%20clients%20between%20the%20two%20sites.%20We%20then%20targeted%20the%20Client%20install%20command%20line%20and%20Windows%20Server%20Update%20Services%20(WSUS)%20settings%20via%20Group%20Policy%20Objects%20(GPO).%26nbsp%3B%20Figure%201%2C%20below%2C%20shows%20the%20details%20of%20this%20approach.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F93825iE6F6C6348AD61248%22%20%2F%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3CB%3EFigure%201%20%3C%2FB%3E%20%3A%20Policy%20Process%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EIn%20order%20to%20best%20manage%20the%20migration%20process%20and%20minimize%20any%20possible%20support%20impact%2C%20we%20decided%20to%20migrate%20systems%20in%20phases%20with%20approximately%205%2C000%20machines%20in%20each%20phase.%20Once%20a%20phase%20had%20completed%20and%20we%20verified%20the%20clients%20were%20healthy%2C%20we%20would%20proceed%20to%20the%20next%20set%20of%20machines.%20This%20was%20the%20process%20we%20followed%20for%20each%20phase%3A%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Ea)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Create%20GPO%20with%20client%20installation%20settings%20and%20WSUS%20settings%2C%20then%20assign%20to%20security%20group%20where%20we%20moved%20all%20machines%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Eb)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Publish%20the%20client%20in%20WSUS%20(enable%20the%20WSUS%20client%20install%20option%20on%20site)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Ec)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Identify%20the%20list%20of%20machines%20to%20migrate%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Ed)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Populate%20the%20machines%20in%20a%20new%20Security%20Group%20(SG)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Ee)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Create%20a%20collection%20on%20the%20ConfigMgr%202007%20site%20based%20on%20the%20security%20group%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Ef)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Wait%20until%20security%20group%20membership%20replicates%20across%20all%20Domain%20controllers%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Eg)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20Once%20machines%20added%20to%20the%20security%20group%20and%20replicated%20to%20all%20Domain%20controllers%2C%20deploy%20packages%20on%20them%20to%20update%20the%20security%20group%20membership%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Eh)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20As%20the%20clients%20updated%20their%20local%20security%20group%20membership%2C%20they%20received%20the%20assigned%20GPOs%20to%20install%20the%20client%20with%20the%20correct%20install%20command%20line%20and%20WSUS%20settings%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Ei)%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%26nbsp%3B%20As%20Configuration%20Manger%20client%20is%20already%20published%20in%20WSUS%2C%20machines%20will%20now%20get%20the%20Configuration%20Manger%202012%20client%20installed%20automatically%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EFigure%202%20below%20shows%20the%20end-to-end%20process%20described%20above%20for%20Client%20Migration.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F93826i214DE3C408E32CD4%22%20%2F%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3CB%3EFigure%202%20%3C%2FB%3E%20%3A%20Client%20Process%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EThe%20followings%20tips%20may%20be%20useful%20to%20you%20as%20you%20plan%20your%20own%20client%20migrations.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Ea.%20%3CB%3E%20Use%20the%20following%20Criteria%20to%20identify%20the%20list%20of%20machines%20to%20migrate.%20%3C%2FB%3E%3C%2FP%3E%3CBR%20%2F%3E%3CUL%3E%3CBR%20%2F%3E%3CUL%3E%3CBR%20%2F%3E%3CUL%3E%3CBR%20%2F%3E%3CLI%3EMachines%20should%20be%20in%20the%20targeted%20domain%2C%20and%20workstation%20OU%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3EHeartbeat%20should%20be%20less%20than%207%20days%20old%3C%2FLI%3E%3CBR%20%2F%3E%3C%2FUL%3E%3CBR%20%2F%3E%3C%2FUL%3E%3CBR%20%2F%3E%3C%2FUL%3E%3CBR%20%2F%3E%3CP%3Eb.%20%3CB%3EPopulate%20the%26nbsp%3B%20machines%20in%20Security%20group%20%3C%2FB%3E%20with%20this%20VB%20script%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWe%20used%20the%20VBS%20script%20below%20to%20populate%20the%20machines%20to%20security%20group%20(add%20the%20domain%20name%20in%20the%20script).%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CTABLE%3E%0A%20%20%20%3CTBODY%3E%3CTR%3E%0A%20%20%20%20%3CTD%3E%3CBR%20%2F%3E%3CP%3EOption%20Explicit%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EDim%20objFile%2C%20objGroup%2C%20objFSO%2C%20strFile%2C%20strGroup%2CVBInfo%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EDim%20strNTName%2C%20objComputer%2C%20strNetBIOSDomain%2C%20intCount%2C%20input%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EDim%20objLogFile%2C%20strLogFileName%2C%20strScriptFullName%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EstrNetBIOSDomain%20%3D%20%22Domain%20Name%22%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EConst%20ForReading%20%3D%201%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EConst%20ForAppending%20%3D%208%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EConst%20OverWriteExisting%20%3D%20True%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EstrScriptFullName%20%3D%20Wscript.ScriptFullName%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EstrLogFileName%20%3D%20Left(strScriptFullName%2C%20Len(Wscript.ScriptFullName)%20-%204)%20%26amp%3B%20%22.log%22%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E'%20Check%20for%20required%20arguments.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EIf%20(Wscript.Arguments.Count%20%26lt%3B%202)%20Then%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EMSGBox%20%22Required%20Argument(s)%20are%20missing%22%20%26amp%3B%20vbCrLf%20%26amp%3B%20%22Syntax%3A%26nbsp%3B%20cscript%20AddMachinestoSG.vbs%20MachineList.txt%20SecGroupName%22%2CvbExclamation%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWscript.Quit(0)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EEnd%20If%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EstrFile%20%3D%20Wscript.Arguments(0)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EstrGroup%20%3D%20Wscript.Arguments(1)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E'%20Open%20the%20text%20file%20of%20user%20names.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3ESet%20objFSO%20%3D%20CreateObject(%22Scripting.FileSystemObject%22)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20Resume%20Next%3C%2FP%3E%3CBR%20%2F%3E%3CP%3ESet%20objFile%20%3D%20objFSO.OpenTextFile(strFile%2C%20ForReading)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EIf%20(Err.Number%20%26lt%3B%26gt%3B%200)%20Then%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20GoTo%200%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWscript.Echo%20%22Unable%20to%20open%20file%20%22%20%26amp%3B%20strFile%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWriteToLog(%22Unable%20to%20open%20file%20%22%20%26amp%3B%20strFile)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWscript.Quit(1)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EEnd%20If%3C%2FP%3E%3CBR%20%2F%3E%3CP%3ESet%20objLogFile%20%3D%20objFSO.OpenTextFile(strLogFileName%2C%20ForAppending%2C%20True)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EIf%20(Err.Number%20%26lt%3B%26gt%3B%200)%20Then%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20GoTo%200%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWscript.Echo%20%22Unable%20to%20open%20Log%20file%20%22%20%26amp%3B%20strLogFile%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWriteToLog(%22Unable%20to%20open%20Log%20file%20%22%20%26amp%3B%20strLogFile)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWscript.Quit(1)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EEnd%20If%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E'%20Bind%20to%20the%20group%20object%20in%20Active%20Directory%2C%20using%20the%20WinNT%20provider.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20Resume%20Next%3C%2FP%3E%3CBR%20%2F%3E%3CP%3ESet%20objGroup%20%3D%20GetObject(%22WinNT%3A%2F%2F%22%20%26amp%3B%20strNetBIOSDomain%20%26amp%3B%20%22%2F%22%20%26amp%3B%20strGroup%20%26amp%3B%20%22%2Cgroup%22)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EIf%20(Err.Number%20%26lt%3B%26gt%3B%200)%20Then%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20GoTo%200%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWscript.Echo%20%22Unable%20to%20bind%20to%20security%20group%20%22%20%26amp%3B%20vbCrLf%20%26amp%3B%20strGroup%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWriteToLog(%22Unable%20to%20bind%20to%20security%20group%20%22%20%26amp%3B%20vbCrLf%20%26amp%3B%20strGroup)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EobjFile.Close%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWscript.Quit(1)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EEnd%20If%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20GoTo%200%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E'wscript.echo%20objGroup.Name%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E'%20Read%20machine%20names%20from%20the%20text%5CCSV%20file%2C%20bind%20to%20the%20computers%2C%20and%20add%20them%20to%20the%20security%20group.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EDo%20Until%20objFile.AtEndOfStream%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EstrNTName%20%3D%20Trim(objFile.ReadLine)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EIf%20(strNTName%20%26lt%3B%26gt%3B%20%22%22)%20Then%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20Resume%20Next%3C%2FP%3E%3CBR%20%2F%3E%3CP%3ESet%20objComputer%20%3D%20GetObject(%22WinNT%3A%2F%2F%22%20%26amp%3B%20strNetBIOSDomain%20%26amp%3B%20%22%2F%22%20%26amp%3B%20strNTName%20%26amp%3B%20%22%24%22)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EIf%20(Err.Number%20%26lt%3B%26gt%3B%200)%20Then%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20GoTo%200%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWscript.Echo%20strNTName%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22ERROR%22%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22Machine%20not%20found%2C%20please%20ensure%20the%20computer%20account%20exists%22%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWriteToLog(strNTName%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22ERROR%22%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22Machine%20not%20found%2C%20please%20ensure%20the%20computer%20account%20exists%22)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EElse%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EIf%20(objGroup.IsMember(objComputer.AdsPath)%20%3D%20False)%20Then%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E'%20Add%20the%20computer%20to%20the%20group.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EobjGroup.Add(objComputer.AdsPath)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EIf%20(Err.Number%20%26lt%3B%26gt%3B%200)%20Then%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E'Wscript.echo%20Err.Number%20%26amp%3B%20%22%20-%20%22%20%26amp%3B%20Err.Description%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20GoTo%200%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWscript.Echo%20strNTName%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22ERROR%22%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22Error%20adding%20machine%20to%20group%20%22%20%26amp%3B%20strGroup%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWriteToLog(strNTName%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22ERROR%22%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22Error%20adding%20machine%20to%20group%20%22%20%26amp%3B%20strGroup)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EElse%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20GoTo%200%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWscript.Echo%20strNTName%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22SUCCESS%22%20%26amp%3B%20%22%3B%22%20%26amp%3B%26nbsp%3B%20%22Machine%20sucessfully%20added%20to%20%22%20%26amp%3B%20strGroup%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWriteToLog%20(strNTName%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22SUCCESS%22%20%26amp%3B%20%22%3B%22%20%26amp%3B%26nbsp%3B%20%22Machine%20sucessfully%20added%20to%20%22%20%26amp%3B%20strGroup)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EEnd%20If%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EElse%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWscript.echo%20strNTName%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22SUCCESS%22%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22Machine%20already%20in%20group%20%22%20%26amp%3B%20strGroup%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EWriteToLog(strNTName%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22SUCCESS%22%20%26amp%3B%20%22%3B%22%20%26amp%3B%20%22Machine%20already%20in%20group%20%22%20%26amp%3B%20strGroup)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EEnd%20If%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EEnd%20If%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EEnd%20If%3C%2FP%3E%3CBR%20%2F%3E%3CP%3ELoop%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E'%20Clean%20up.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EobjFile.Close%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3ESub%20WriteToLog(Message)%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E'*%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E'*%26nbsp%3B%20To%20write%20messages%20to%20the%20log%20file%20or%20to%20console%20if%20%2FDebug%20is%20passed%20as%20command%20line%20argument%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E'*%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20Resume%20Next%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EIf%20IsObject(objLogFile)%20Then%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EobjLogFile.WriteLine%26nbsp%3B%20Now%20%26amp%3B%20%22%3B%22%20%26amp%3B%20Message%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EElse%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EEnd%20If%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EOn%20Error%20GoTo%200%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EEnd%20Sub%20'WriteToLog()%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3C%2FTD%3E%0A%20%20%20%3C%2FTR%3E%0A%20%20%3C%2FTBODY%3E%3C%2FTABLE%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3CB%3E%20Here%E2%80%99s%20how%20we%20used%20the%20script%20to%20populate%20machines%20to%20a%20Security%20group%3A%20%3C%2FB%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Ea.%20Copy%20the%20files%20from%20the%20release%20folder%20to%20any%20location%20locally.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Eb.%20Create%20a%20text%20file%2C%20and%20populate%20with%20required%20system%20names%20(without%20any%20prefix%2Fsuffix%20like%20%24)%20on%20each%20line.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Ec.%20At%20command%20prompt%2C%20Run%20the%20following%20command%20from%20the%20location%20where%20script%20is%20copied.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Ec%3A%5C%26gt%3B%20cscript%20AddMachinesToSG.vbs%20%3CMACHINELIST.TXT%3E%20%3CSECURITY_GROUP_NAME%3E%3C%2FSECURITY_GROUP_NAME%3E%3C%2FMACHINELIST.TXT%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Eex%3A%20cscript%20AddMachinesToSG.vbs%20MachineList.txt%20DOG_Servicesd%3C%2FP%3E%3CBR%20%2F%3E%3CP%3Ed.%20Use%20the%20Klist%20utility%20via%20Software%20Distribution%20to%20minimize%20client%20impact%20for%20machine%20reboot%20and%20expedite%20the%20deployment%20by%20forcing%20the%20computer%20to%20recognize%20the%20group%20policies%20for%20the%20security%20group%3A%3C%2FP%3E%3CBR%20%2F%3E%3CP%3ECommands%3C%2FP%3E%3CBR%20%2F%3E%3CUL%3E%3CBR%20%2F%3E%3CUL%3E%3CBR%20%2F%3E%3CLI%3Eklist.exe%20-li%200x3e7%20purge%3C%2FLI%3E%3CBR%20%2F%3E%3CLI%3Egpupdate.exe%20%2Ftarget%3Acomputer%20%2Fforce%3C%2FLI%3E%3CBR%20%2F%3E%3C%2FUL%3E%3CBR%20%2F%3E%3C%2FUL%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EThe%20graph%20in%20Figure%203%20below%20shows%20the%20client%20deployment%20trend%20of%20a%20more%20recent%20site%20we%20migrated%20using%20this%20client%20deployment%20process.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F93827i23F47E46B41FF702%22%20%2F%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EFigure%203%20.%20Client%20Deployment%20Trend%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3EI%20hope%20you%20enjoy%20this%20blog%20entry%20about%20how%20we%20deployed%20clients%20in%20our%20environment.%26nbsp%3B%20Today%20we%E2%80%99re%20just%20past%20200%2C000%20clients%20on%20Configuration%20Manager%202012%2C%20and%20we%E2%80%99re%20looking%20forward%20to%20finishing%20our%20client%20migrations.%20Any%20questions%20on%20how%26nbsp%3Bare%20migrating%20to%20Configuration%20Manager%202012%2C%26nbsp%3Bplease%20just%20let%26nbsp%3Bus%20know.%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%3CBR%20%2F%3E%3CP%3E%3C%2FP%3E%0A%20%0A%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-377226%22%20slang%3D%22en-US%22%3EFirst%20published%20on%20TECHNET%20on%20Jan%2013%2C%202012%20Hi%2C%20I%20am%20Naveen%20Kumar%20Akkugari%20and%20I%20work%20at%20Microsoft%20in%20the%20Management%20Platforms%20and%20Service%20Delivery%20(MPSD)%20organization.%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-377226%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3Econfigmgr%202012%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EEngineering%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Emsit%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Eoperations%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESCCM%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESystem%20Center%20Configuration%20Manager%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft
First published on TECHNET on Jan 13, 2012

Hi, I am Naveen Kumar Akkugari and I work at Microsoft in the Management Platforms and Service Delivery (MPSD) organization. I work on the Configuration Manager Infrastructure team which provides services to roughly 300,000 client machines at Microsoft.  Below I share the process we followed to migrate client machines from Configuration Manager 2007 to Configuration Manager 2012. We currently have a little over 200,000 machines migrated to Configuration Manager 2012 from two different primary sites in Configuration Manager 2007.  In this blog post, I focus specifically on our client migration from one primary site (corporate headquarters) which has 120,000 client machines.


After reviewing multiple options for client migration and installation (more info on client migration options can be found here - http://technet.microsoft.com/en-us/library/gg712283.aspx ), we decided to continue using SUP based client installation. We also based GPO assignment on security groups due to some unique scenarios in our infrastructure.



As we prepared to migrate our clients to Configuration Manager 2012, we had several goals for client migration, including:



  1. Migrate clients within project timeline (effectively and efficiently)

  2. Avoid any negative end-user impact for the existing services, such as patching and software distribution

  3. Validate Configuration Manager 2012 client installation options (SWD, CPI, SUP) to provide feedback to the product group

  4. The client migration approach needed to be simple for client migration testing, implementation , maintenance, and troubleshooting

  5. Ensure migrated clients remain in Configuration Manager 2012 hierarchy and should not move back to Configuration Manager 2007 hierarchy

  6. Avoid any client side changes such as domain or OU change for machines as that would have AD and GPO implications



In Configuration Manager 2007, we had a single primary site supporting all corporate headquarters machines (120,000 client machines) in one domain with one AD site. As you know, that scenario is not supported due to exceeding the maximum number of clients per site. We wanted to fix this unsupported scenario in Configuration Manager 2012, so we configured two primary sites and used security groups to split clients between the two sites. We then targeted the Client install command line and Windows Server Update Services (WSUS) settings via Group Policy Objects (GPO).  Figure 1, below, shows the details of this approach.



Figure 1 : Policy Process



In order to best manage the migration process and minimize any possible support impact, we decided to migrate systems in phases with approximately 5,000 machines in each phase. Once a phase had completed and we verified the clients were healthy, we would proceed to the next set of machines. This was the process we followed for each phase:



a)      Create GPO with client installation settings and WSUS settings, then assign to security group where we moved all machines


b)      Publish the client in WSUS (enable the WSUS client install option on site)


c)       Identify the list of machines to migrate


d)      Populate the machines in a new Security Group (SG)


e)      Create a collection on the ConfigMgr 2007 site based on the security group


f)       Wait until security group membership replicates across all Domain controllers


g)      Once machines added to the security group and replicated to all Domain controllers, deploy packages on them to update the security group membership


h)      As the clients updated their local security group membership, they received the assigned GPOs to install the client with the correct install command line and WSUS settings


i)        As Configuration Manger client is already published in WSUS, machines will now get the Configuration Manger 2012 client installed automatically



Figure 2 below shows the end-to-end process described above for Client Migration.




Figure 2 : Client Process



The followings tips may be useful to you as you plan your own client migrations.



a. Use the following Criteria to identify the list of machines to migrate.





      • Machines should be in the targeted domain, and workstation OU

      • Heartbeat should be less than 7 days old




b. Populate the  machines in Security group with this VB script



We used the VBS script below to populate the machines to security group (add the domain name in the script).




Option Explicit


Dim objFile, objGroup, objFSO, strFile, strGroup,VBInfo


Dim strNTName, objComputer, strNetBIOSDomain, intCount, input


Dim objLogFile, strLogFileName, strScriptFullName



strNetBIOSDomain = "Domain Name"



Const ForReading = 1


Const ForAppending = 8


Const OverWriteExisting = True



strScriptFullName = Wscript.ScriptFullName


strLogFileName = Left(strScriptFullName, Len(Wscript.ScriptFullName) - 4) & ".log"



' Check for required arguments.


If (Wscript.Arguments.Count < 2) Then


MSGBox "Required Argument(s) are missing" & vbCrLf & "Syntax:  cscript AddMachinestoSG.vbs MachineList.txt SecGroupName",vbExclamation


Wscript.Quit(0)


End If


strFile = Wscript.Arguments(0)


strGroup = Wscript.Arguments(1)


' Open the text file of user names.


Set objFSO = CreateObject("Scripting.FileSystemObject")


On Error Resume Next


Set objFile = objFSO.OpenTextFile(strFile, ForReading)


If (Err.Number <> 0) Then


On Error GoTo 0


Wscript.Echo "Unable to open file " & strFile


WriteToLog("Unable to open file " & strFile)


Wscript.Quit(1)


End If


Set objLogFile = objFSO.OpenTextFile(strLogFileName, ForAppending, True)


If (Err.Number <> 0) Then


On Error GoTo 0


Wscript.Echo "Unable to open Log file " & strLogFile


WriteToLog("Unable to open Log file " & strLogFile)


Wscript.Quit(1)


End If


' Bind to the group object in Active Directory, using the WinNT provider.


On Error Resume Next


Set objGroup = GetObject("WinNT://" & strNetBIOSDomain & "/" & strGroup & ",group")


If (Err.Number <> 0) Then


On Error GoTo 0


Wscript.Echo "Unable to bind to security group " & vbCrLf & strGroup


WriteToLog("Unable to bind to security group " & vbCrLf & strGroup)


objFile.Close


Wscript.Quit(1)


End If


On Error GoTo 0


'wscript.echo objGroup.Name


' Read machine names from the text\CSV file, bind to the computers, and add them to the security group.


Do Until objFile.AtEndOfStream


strNTName = Trim(objFile.ReadLine)


If (strNTName <> "") Then


On Error Resume Next


Set objComputer = GetObject("WinNT://" & strNetBIOSDomain & "/" & strNTName & "$")


If (Err.Number <> 0) Then


On Error GoTo 0


Wscript.Echo strNTName & ";" & "ERROR" & ";" & "Machine not found, please ensure the computer account exists"


WriteToLog(strNTName & ";" & "ERROR" & ";" & "Machine not found, please ensure the computer account exists")


Else


If (objGroup.IsMember(objComputer.AdsPath) = False) Then


' Add the computer to the group.


objGroup.Add(objComputer.AdsPath)


If (Err.Number <> 0) Then


'Wscript.echo Err.Number & " - " & Err.Description


On Error GoTo 0


Wscript.Echo strNTName & ";" & "ERROR" & ";" & "Error adding machine to group " & strGroup


WriteToLog(strNTName & ";" & "ERROR" & ";" & "Error adding machine to group " & strGroup)


Else


On Error GoTo 0


Wscript.Echo strNTName & ";" & "SUCCESS" & ";" &  "Machine sucessfully added to " & strGroup


WriteToLog (strNTName & ";" & "SUCCESS" & ";" &  "Machine sucessfully added to " & strGroup)


End If


Else


Wscript.echo strNTName & ";" & "SUCCESS" & ";" & "Machine already in group " & strGroup


WriteToLog(strNTName & ";" & "SUCCESS" & ";" & "Machine already in group " & strGroup)


End If


End If


End If


Loop



' Clean up.


objFile.Close




Sub WriteToLog(Message)


'*


'*  To write messages to the log file or to console if /Debug is passed as command line argument


'*


On Error Resume Next



If IsObject(objLogFile) Then


objLogFile.WriteLine  Now & ";" & Message


Else


End If



On Error GoTo 0



End Sub 'WriteToLog()






Here’s how we used the script to populate machines to a Security group:


a. Copy the files from the release folder to any location locally.


b. Create a text file, and populate with required system names (without any prefix/suffix like $) on each line.


c. At command prompt, Run the following command from the location where script is copied.


c:\> cscript AddMachinesToSG.vbs <MachineList.txt> <Security_Group_Name>


ex: cscript AddMachinesToSG.vbs MachineList.txt DOG_Servicesd


d. Use the Klist utility via Software Distribution to minimize client impact for machine reboot and expedite the deployment by forcing the computer to recognize the group policies for the security group:


Commands




    • klist.exe -li 0x3e7 purge

    • gpupdate.exe /target:computer /force




The graph in Figure 3 below shows the client deployment trend of a more recent site we migrated using this client deployment process.




Figure 3 . Client Deployment Trend



I hope you enjoy this blog entry about how we deployed clients in our environment.  Today we’re just past 200,000 clients on Configuration Manager 2012, and we’re looking forward to finishing our client migrations. Any questions on how are migrating to Configuration Manager 2012, please just let us know.