SOLVED Custom task sequences, user-centric and application model: how to fit it all together?

[Chris Cools]

Hi everybody,

We are currently planning migration from Altiris Notification Server to SCCM 2012 R2.

In Altiris we only use packages, application model is new in SCCM and we are considering using it. We have a few issues though, and I don't see how app model can solve these for us. I would like to hear from the experts if there are any decent ways to achieve what we want.

Using full app model is possible in theory but too costly for us, it would mean that we have to 'touch' 800+ existing packages we use today (environment: financial company with 40000+ workstations distributed over several countries). So if we are going for the app model it will be an evolution, not a revolution. A hybrid model (packages and applications) will be used at first instance.

We have 'special' packages today which are business-critical and require a fixed sequence of installation. For example, we have applications that first need a certain Java version to be installed, then remove some stuff, install other stuff in a certain sequence, reinstall the previously removed stuff, et cetera...

To do this, we need custom task sequences because the app model doesn't support this kind of setup (I'm newbie so I might be mistaking, hence these questions on this blog). We have been playing around with these and the results are promising, we do have control over the installation.

But this generates a bunch of other problems for us... For example (some are hypothetical but can (and will) occur in our company). I have a few questions for the experts:

1. Is it OK to mix apps and packages in a task sequence?

I think this is no problem, I've seen that working already but feel free to share your thoughts anyway! )

2. Is it OK to use a package as dependency for an application and vice versa or is this simply not possible?

If possible, I see issues when updates of software is needed. Let's say you have app A with dependencies app B and package C. Let's then say you need to upgrade app A and package C at a certain moment in time. How will this work in real-life since the app can be updated through supersedence but the packages needs a push? Assuming I'm correct about that, as stated before, I am a newbie to SCCM and especially app model.

3. What about supersedence?

It sounds great in theory but in real-life we want to have control over the how and what and when and we need to keep software levels in our company at all times as up to date as possible. We can push packages to workstations via Altiris today and SCCM will have the same capabilities, no doubt about that. But if I'm not mistaking, supersedence will just do its thing whenever the clients is aware of the new application.

How can we guide everything when we want it? And how can we control things? For example, we do not want workstations starting installations randomly, we want to control and execute these things in a planned way.

Furthermore, most applications can install in the background while a user is logged on and working on a workstation. Today we've created a powershell-based messaging framework which notifies the user that an installation will start and he / she can postpone for two hours max or start immediately. But in some cases we need the user to not interfere in any way with the installation (f.e. upgrading an application that is being used by a user thus opened on his workstation). We have created a 'lock-mechanism' for these scenario's which basically means 'user gets notified that his / her workstation will be rebooted and locked - reboot is performed - lock mechanism prevents user to log on again while installation is running'. After installation the workstation boots again to remove the lock and the user can log on again. How can we do this with supersedence (or in general in SCCM)? I'm afraid we will have to create or adapt the lock mechanism for SCCM or am I wrong?

4. Custom task sequences and user-centric model

I think it is kind of stupid that task sequences can't be targeted to users but only to devices. Custom TS is what we need for stuff like the special sequences packages I've described earlier. We have a 'everyone can use every workstation in our network thus personal software is available (for install) on any device the user logs on to'-policy which means that

- primary device has the user's personal software installed
- Altiris Software Portal is available on other workstations and users can request and install personal software in this way

This is however a problem when you can't assign TS to a user. I have created a PS script which will be triggered from an application and basically just checks for the deploymentID of the TS and will trigger it from the local device. Prerequisite is that the TS is deployed to all devices (available, required by 2033 something). Is there a better way to do this? I cam't believe Microsoft doesn't support targeting TS to user collections? I know a TS is normally used for OSD, but it is an ideal tool for 'guided software installations'. App model and dependency groups do not solve our issues with special packages! I can't even set a priority between dependency groups and they are limited to five. I could make every package / application a dependency of the 'previously needs to be installed package / application' I guess but that will become unmanageable quickly. We do have packages today that can be installed stand-alone but at the same time serve as dependency of another package. We don't want the stand-alone installation to start installing a package that we needed to define as dependency just for the sake of installation order.


I know these are a lot of questions at once and I'm sure not everything is explained as it should so it will be difficult for the experts to reach detailed solutions. No worries, that's not what I'm asking, I simply want to discuss the best practices and ideas for situations like the ones described above.

Thanks in advance!
Regards, Chris

 

[Prajwal Desai]

1. Is it OK to mix apps and packages in a task sequence? - Yes I don't see any issues with that.
2. Is it OK to use a package as dependency for an application and vice versa or is this simply not possible? - Yes I guess this is possible. You can choose to upgrade the app along with the dependencies.
3. But in some cases we need the user to not interfere in any way with the installation - With SCCM when you depploy an app you have 2 options, REQUIRED and AVAILABLE. When you use AVAILABLE option the user has to manually install the app, when REQUIRED option is used the app installs silently in the background.
4. As far as i know a task sequence can only be advertised to a computer account. You are correct, the TS is used mainly for OSD. In SCCM you can deploy the apps to the users / user group so that whenever the user logs in to any of the machine in the network he/she gets the app deployed. We cannot assign the TS to users. Check this link for more info - http://blogs.technet.com/b/configmgrteam/archive/2013/07/10/user-centric-application-management.aspx

I may not have provided answers to all your questions, let me know if you need any help from me, i will try my best to answer your questions.

 

[Chris Cools]

Hi Prajwal,

Thanks for the feedback.
It is kind of my own mistake, I didn't explain my issue enough as I already suspected. But it is not easy to give you all the details without spamming the forum, and that's not my intention.

To be honoust, you're not telling me anything new, this is all basic SCCM functionality. I'll try to explain the issues I have more in detail.

1. as I already stated myself, this should not be a problem and if needed I can do that
2. this is a scenario where I'm a little bit afraid of what exactly will happen in this kind of situation. I hope to get some hands-on experience from fellow system admins having coped with this already.

A package needs to be updated, uninstalled via a program and redeployed (new program for the new version). I understand that, we do this in Altiris in the same manner. But what with the application? This one will supersede, and I can't find any info on the possibility to control this. As I stated before, I work for a financial institution with a very demanding business so I simply can't afford having to say to my users: 'everything is triggered and deployed, I guess it will arrive in let's say... I don't know frankly '

Of course, Altiris has the same issue when client policy retrieval takes its time but I can manipulate that rather easy. And I know what will happen during the upgrade since I've tested and piloted the actual 'uninstall old - reinstall new application' scenario beforehand and I have the ability to 'lock' machines during installation. Not always needed, but for our bigger packages (SAS, SAP, Visual Studio, TM1, QBS, ...) I often need to make sure the user is not working with any of these applications or installation will fail. But for Altiris (packages) I have several PX tools available to restart isntallations, I know how to troubleshoot failures and I have a good idea of what I can expect when I open a task to start the upgrades in our park.

For SCCM, I can handle the packages, there similar then these from Altiris but still they are packages... Applications however and especially supersedence frightens me a bit.
Today we release and update packages as follows:

Note that we have a policy to never upgrade an installation. We always first uninstall previous version, then install new version. This might seem overhead in some cases but i proved to be working fine and it makes sure we start from a 'clean' install (I admit we have sometimes issues with userprofiles, both locally and remote) but apart from that we have a goof system, average success rate is currently between 95-99% per release. And we have one every month...

Our current way of working:

- test in test environment (TDA):
1) a clean install of the new version
2) an uninstall - freshly install to cover both possible PRO scenario's (of course only for software already existing in our company, new software is only testen as a clean install)

- test in TDA succeeded?
1) repeat the above processes on PRO pilot machines
2) cooperate with key-users of the application to test everything on a functional level

- test in PRO pilot succeeded?
1) prepare release for a given weekend --> push weekend
2) for the unreachables off the weekend we offer a 'postpone framework' which the user can use to install the software at his convenience (scheduling option); altiris software portal is also possible but is less flexible)
3) when the package becomes mandatory we will repush every day to whomever didn't install the upgrade yet

Advantage for us, we pretty much have total control over when whe push and when software is 'available' to users. And even in mandatory period we have control since we have a policy that we can push the sofware at any time during business hours (users have had three chances to do this themselves so after mandatory we don't have to mind about possible unavailability during the installation). Of course we try to be as userfriendly as possible so mostly I start installations during lunch hours or when users are in meeting or something and don't need their machines...


So, to finally come to my point

How can I have control about supersedence? As I'm not mistaking, evalutation cycles will run and if a msi detects it has a higher version it will start doing it's thing.
Am I correct about that? Furthermore, what if users are working in the installation that we want to supersede and isntall starts unexpectedly? Is there a 'postpone' functionality foreseen? Im am aware of what a required or available deployment means, it is the 'availblale' part I'm worried about... Will I be able to control it time-wise, can i trigger it on-demand, et cetera...
I love SCCM (and like the look and feel much better than the Altiris Console) but at the moment it looks like I'm not gonna be able to deliver the same service as I used to do. And that's not an option for me, unfortunately.. I guess I will have to start making scripts and wrappers to keep thing under control, kind of what whe did with Altiris for some stuffs we offer...

Again, I'm a newbie, I have read a lot over SCCM and it's capabilities, but scenario's like the ones I need to support in real-life, I haven't seen those yet I admit, we have difficult customers but still I need to deliver them at least the same service as we do now.. and they expect even more from the new tool, but I do not believe (at this moment and with my little knowledge / experience with the tool) that I can manage these things out-of-the-box...


That's why I would like to discuss with experts and more experienced SCCM admins, I assume there are people out there having to cope with the exact same problems as we have...

- stage or swap a user machine and restore the software automatically and immediately
- support a set of high-availble machines with fixed software stocks on there
- preprovision content to DP's in local branches (we'll probably use 1E Nomad for this so this is probably not a big issue)
- capabality for a user to 'refresh' his PC from any location or any place (wired, wifi, vpn)
- support for special sequence installations (we have around 80 of them so almost 10% of our software portfolio)
- ...

And you're completely right, TS can't be targeted to user collections. I have a workaround for that issue but it is to my humble opinion something that logically should be possible! Now I have to create an app that I can point to user collections, run a PS in there to search for a deployment ID of a TS previously deployed to the device. This is a little overhead...


Anyway, if anyone ever encountered these kind of challenges please share your thoughts, thanks!

PS: I'm sorry for the many words but I need to explain it so you guys are aware of why some 'logical'solutioms aren't sufficient for us...

 

[Chris Cools]

Hi Prajwal, you can close this thread.

- stage or swap a user machine and restore the software automatically and immediately
- support a set of high-available machines with fixed software stocks on there
User Device Affinity (predeploy) and primary users per device will be used

- preprovision content to DP's in local branches (we'll probably use 1E Nomad for this so this is probably not a big issue)
1E Nomad has been accepted by our procurement team as third-party solution

- capabality for a user to 'refresh' his PC from any location or any place (wired, wifi, vpn)
1E ActiveEfficiency, 1E PXE Lite and SCCM PXE OSD will do the trick

- support for special sequence installations (we have around 80 of them so almost 10% of our software portfolio)
We do want to work user-centric but we need task sequences for most of our software and they can't be assigned to user collections, only to device collections. Dependency groups in SCCM aren't sufficient for what we must be able to provide our business, so we need custom task sequences. As a workaround we use an application which triggers the TS locally on the client (application just contains a powershell script). This application is provided in the application catalog of the user and provides flexibility, they can use any domain machine and install their personal software from the application catalog. Also, we just need to send the metadata of the TS to our devices and users can locally start it via the application in their application catalog. We do not want every user to be able to install every software from Software center, therefore this workaround.

If anyone has a better solution to...

- sent a custom task sequence to a user collection in stead of a device collection
- make sure that only users with installation rights can install the software (or even see it, that's why we avoid software center)

...let me know!

Thanks