官方网址：http://www.microsoft.com/learning/exams/70-401.mspx

Microsoft online resources

各知识点比重：

Note This preparation guide is subject to change at any time without
prior notice and at the sole discretion of Microsoft. Microsoft exams might include adaptive testing technology and simulation items. Microsoft does not identify the format in which exams are presented. Please use this preparation guide to prepare for the exam, regardless of its format.

原文：http://www.microsoft.com/learning/syllabi/en-us/6451afinal.mspx

Prerequisites
Before attending this course, students must have:
• A base-level understanding of Systems Management Server 2003.
• System Administrator–level working knowledge of:
• Deployment, configuration, and troubleshooting for Windows-based personal computers
• TCP/IP networking
• SQL Server
• Active Directory
• Basic Public Key Infrastructure concepts

Five days 课程大纲

Module 1: Overview of Configuration Manager 2007

This module provides an overview of Configuration Manager 2007 features. It also provides an overview of the Configuration Manager site architecture and clients.

Lessons

After completing this module, students will be able to:

Module 2: Planning and Deploying a Single-Site Architecture

This module explains how to prepare for and deploy a Configuration Manager site. It also describes how to discover resources and how to upgrade an SMS 2003 site to Configuration Manager 2007.

Lessons

Lab A: Deploying a Configuration Manager Site Server

Lab B: Managing Users and Configuring Boundaries and Discovery Methods

After completing this module, students will be able to:

Module 3: Planning and Deploying Configuration Manager 2007 Clients

This module explains how to prepare for and deploy Configuration Manager clients. It also describes how to manage client installations and how to troubleshoot client deployment issues.

Lessons

Lab A: Deploying Configuration Manager Clients

Lab B: Reviewing Client Deployment

After completing this module, students will be able to:

Module 4: Collecting Inventory and Metering Software Usage

This module explains how to collect and manage hardware and software inventory. It also describes how to configure software metering.

Lessons

Lab A: Collecting Inventory

y>

Lab B: Configuring Software Metering

After completing this module, students will be able to:

Module 5: Querying and Reporting Data

This module explains how to create and run queries and reports. It also describes how to create and run dashboards.

Lessons

Lab A: Creating Queries

Lab B: Creating a Reporting Point

Lab C: Creating Reports

Lab D: Creating a Dashboard

After completing this module, students will be able to:

Module 6: Preparing for and Managing Software Distribution

This module explains how to configure and manage software distribution. It also describes how to monitor and troubleshoot software distribution.

Lessons

Lab A: Preparing a Site for Software Distribution

Lab B: Deploying an Application Using Software Distribution

After completing this module, students will be able to:

Module 7: Deploying Operating Systems Using Configuration Manager 2007

This module explains how to deploy operating systems using Configuration Manager. It also describes how to configure operating system deployments using PXE.

Lessons

Lab A: Capturing a Reference Computer Using Configuration Manager 2007

Lab B: Deploying Operating Systems Using PXE

After completing this module, students will be able to:

Module 8: Deploying and Managing Software Updates

This module explains how to prepare for and manage software updates in Configuration Manager. It also describes how to monitor and troubleshoot software updates.

Lessons

Lab: Deploying and Managing Software Updates

After completing this module, students will be able to:

Module 9: Working with Desired Configuration Management in Configuration Manager 2007

This module explains how to configure desired configuration management in Configuration Manager. It also describes how to view compliance results.

Lessons

Lab: Configuring Desired Configuration Management

After completing this module, students will be able to:

Module 10: Using Remote Tools and Wake On LAN Features

This module explains how to work with Configuration Manager remote tools. It also describes how to configure and monitor Wake On LAN.

Lessons

Lab A: Configuring and Using Remote Tools

Lab B: Configuring and Using Wake On LAN

After completing this module, students will be able to:

Module 11: Managing Mobile Devices Using Configuration Manager 2007

This module provides an overview of mobile device management. It also describes how to configure server and client settings and how to manage mobile devices.

Lessons

Lab A: Configuring the Site Server to Support Mobile Device Management

Lab: Managing Mobile Devices Using Configuration Manager 2007

After completing this module, students will be able to:

Module 12: Maintaining and Troubleshooting Configuration Manager 2007

This module explains how to maintain Configuration Manager 2007 and how to troubleshoot Configuration Manager issues. It also describes how to backup and recover data and how to work with troubleshooting tools.

Lessons

Lab: Maintaining and Troubleshooting a Configuration Manager Site System

After completing this module, students will be able to:

Module 13: Planning and Configuring a Multiple Site Hierarchy

This module explains how to plan and configure a multiple-site hierarchy including installing a secondary site and installing a proxy management point. It also describes how to decommission sites and hierarchies and how to roam in multiple-site hierarchies.

Lessons

Lab A: Planning a Configuration Manager 2007 Hierarchy

Lab B: Installing Secondary Sites and Proxy Management Points

Lab C: Roaming Between Configuration Manager 2007 Sites

After completing this module, students will be able to:

当一个 Client 需要进行 content location 的时候，会发送 content location 的请求到 MP：

1.

当 Client 位于其 assigned site 的边界内，client 会发送 content location 请求到 default MP；

2.

当 client 位于和其 assigned site 有联系的 secondary site 的边界内的时候，如果 secondary site 有 proxy MP，client 会向 proxy MP 发送 contend location 请求；如果没有 proxy MP，client 会向 default MP 发送请求。

3.

当 client 不在其 assigned site 或和其 assigned site 有联系的 secondary site 的边界内的时候，client 可以通过 AD Domain Services (global roaming capability)获取 site 信息，然后向其目前当前roamed site 中的 resident MP 进行 content location；如果 resident MP 不能进行 content location（当前 site 中没有相应的 content 存在），client 会发送请求到其 default MP。

4.

When a client is located within the boundaries of a primary site lower in the hierarchy than its assigned site or a secondary site attached to its assigned site, a client that cannot access site information from Active Directory Domain Services (regional roaming capability), will continue to request content location from its default management point in its assigned site.

一台机器上，必须先在 site database server 上先建一个空的库实例（不要做任何设置），然后在安装是连接到

database server 的实例即可。

原文节选：

If ConfigMgr and SQL were on the same server, ConfigMgr would automatically create the database for

you.
Since SQL is running on a remote server, you do indeed have to create the database on the remote

SQL server first.

Just create it with the defaults…don’t make any edits/changes; the install will do the rest for you.

讨论的延伸：

如果 site server 和 site database server 不在一台机器上，SMS Provider 最好和 site database server 在同

一台机器上，这样做的效率更高。除非 site database server 是 SQL Server Virtual Cluster Instance 形式的

时候（ Provider 不能安装在 SQL Server Virtual Cluster 上），才需要安装在非这两者的机器上。

在 Site Maintenance 下存在两个节点，一个是 SQL Commands 【 默认为空，需要自定义 SQL 语句 】，一个是预定义的 Tasks 【不能新增，只能在已经的存在的 Task 上做配置】。

Backup ConfigMgr Site Server (默认关闭)

作用：可以设置对 Site Database 的备份时间和备份路径。

默认每周日零点开始。

Clear Install Flag (默认关闭)

作用：如果在设定的“Client Rediscovery Period”这个时间内，没有收到 Client 发送的 Heartbeat Discovery 信息则将清除掉 Client 客户机已经安装 SCCM Client的标识，这样就可以再次安装 client。

注意：如果开启这个 Task，

1.

要确保开启 Heartbeat Discovery；

2.

要设置“Client Rediscovery Period”的时间比 Heartbeat Discovery 时间要长，根据公司情况设置一个合理的倍数。（起码1.5倍，3倍以上是比较保险的）

默认21天。

Delete Aged Client Access License Data (默认关闭)

Client Access License：Many Microsoft server products utilize the Client Access License (CAL) model, including Exchange Server, SQL Server, and Systems Management Server. For a list of Microsoft products for which CALs are required, see the Microsoft CAL Guide (http://go.microsoft.com/fwlink/?LinkId=91230).

At this time, Configuration Manager 2007 only tracks CALs for Windows Server and Exchange Server.

默认180天。

Delete Aged Collected Files (默认开启)

Collected Files 是指从 site database 和 site server folder structure 中收集的 files data.

The Delete Aged Collected Files task is used to delete aged collected files data from the Configuration Manager 2007 site database and from the site server folder structure at the selected site only. Databases at other sites are not affected.

Once collected, files specified to be collected will only be collected during subsequent inventories if they have changed since the previous inventory. By default, the five most recent copies of collected files are stored on the site server in the inboxes\sinv.box\FileCol directory.

默认90天。

Delete Aged Computer Association Data (默认开启)

Computer Association Data 是指通过 OSD 方式完成系统按照并还原用户状态之后删除的计算机关联记录信息。

默认30天。

Delete Aged Configuration Management Data (默认开启)

Configuration Management Data：在修改 DCM、SUM、OSD 配置后，site database 会相应更新到最新的配置，而原有的配置信息仍然保存在 database 中。当 Client 都接收到新的配置 policy 之后（即不再根据老的 policy 报告其状态），和老的 policy 相关的信息将会根据配置的周期进行清除。

默认90天。

When changes are made to configuration items created when using desired configuration management, software updates management, or operating system deployment, the site database is updated with the new configuration item definition. The original configuration item definition is also stored in the site database. When clients have stopped reporting the original configuration item definition, the definition and any configuration item compliance history associated with that version is removed from the database according to the schedule you have specified.

Delete Aged Discovery Data (默认开启)

Discovery Data：包括通过 heartbeat discovery、network discovery、and Active Directory Domain Services discovery methods (System, User, and System Group) 获得的记录。

默认90天。

Delete Aged Inventory History (默认开启)

【似乎只和 hardware inventory 有关】

If the hardware inventory client agent is enabled at a site, or at any of its child sites, the Delete Aged Inventory History task deletes all client hardware inventory history data older than the number of days specified. The inventory history data is deleted from the Configuration Manager 2007 site database at the selected site only. After this task runs, only the current inventory data is left in the Configuration Manager 2007 site database. Site databases at other sites are not affected.

Defaults： Delete hardware inventory data older than 90 days; runs on Saturday between midnight and 5:00 A.M.

Delete Aged Software Metering Data (默认开启)

The minimum number of days that you can set to delete all software usage data is two. The maximum number is 255.

Defaults： Deletes software usage data older than five days; runs daily.

Delete Aged Software Metering Summary Data (默认开启)

【不清楚这里的 summary 到底是干了什么】

Delete Aged Status Messages (默认开启)

Defaults： Deletes status messages older than seven days; runs daily between midnight and 5:00 A.M.

Delete Inactive Client Discovery Data (默认关闭)

Clients 会被标识为 inactive 的两种情况：

1. When a client is flagged as obsolete it is also marked as inactive.

2. Clients can be marked inactive by the client health tool if the tool is configured to mark clients as inactive.

注意：The client health tool is not included in Configuration Manager Setup and must be downloaded and installed separately.

Delete Inactive Client Discovery Data 和 Delete Aged Discovery Data 比较相似，但是前者只针对 SCCM 2007 Client 操作，后者可以针对所有 discovered 的资源。

如果启用，其时间必须长于 Heartbeat 时间。This allows active clients to send a Heartbeat Discovery record to mark their client record as active so that this task does not delete them.

Defaults： Delete inactive client discovery data older than 90 days; Runs on Saturday between midnight and 5:00 A.M.. Not enabled by default.

Delete Obsolete Client Discovery Data (默认关闭)

一个新的记录会造成这个 Client 原有记录的obsolete。The newer record becomes the client’s current record, and the older record becomes obsolete.

如果开启这个任务，要保证其时间长于 heartbeat 时间。This allows clients to send Discovery Data Records (DDRs) so that the obsolete bit is set correctly.

Defaults：Deletes obsolete client discovery data older than seven days; runs on Saturday. This task is not enabled by default.

Monitor Keys (默认开启)

这个任务的作用是监视 database primary keys 的完整性。A primary key is a column or combination of columns that uniquely identify one row and distinguish it from any other row in a Microsoft SQL Server database table.

Defaults：Runs every Sunday, between midnight and 5:00 A.M.

Rebuild Indexes (默认开启)

作用：重建 SCCM 2007 site database 使用的 indexes。An index is a database structure created on a database table to speed up data retrieval. For example, searching an indexed column is often much faster than searching a column that is not indexed.

To improve performance, the Configuration Manager 2007 site database indexes are frequently updated to remain synchronized with the constantly changing data stored in the database. This task creates indexes on database columns that are at least 50 percent unique, drops indexes on columns that are less than 50 percent unique, and rebuilds all existing indexes that meet the data uniqueness criteria.

Defaults：Runs every Sunday, between midnight and 5:00 A.M.

Summarize Client Access License Weekly Usage Data (默认关闭)

Defaults：Not enabled. Runs on Saturday between midnight and 5:00 A.M.

Summarize Software Metering File Usage Data (默认开启)

作用：summarizes software metering file usage data from multiple records into one general record. This record provides summarized information about the application name, version, language, number of concurrent users, and hourly usage over a specified length of time. Data summarization helps compress the amount of data stored in the Configuration Manager 2007 site database.

This task can be used with the Summarize Software Metering Monthly Usage Data task to summarize software metering data, and to conserve space in the Configuration Manager 2007 site database.

Defaults：Runs daily, between midnight and 5:00 A.M.

Summarize Software Metering Monthly Usage Data (默认开启)

Defaults：Summarizes messages older than one month; runs daily, between midnight and 5:00 A.M.

#####
# SCCM 2007 特有的功能
#########################

ConfigMgr 包含了以下一些新功能:

• Desired Configuration Management (DCM)
• Network Access Protection (NAP)
• Wake-On-LAN (WOL)
• Site Modes (either Native or Mixed Mode with Native being used to facilitate management of Internet-based Clients or those that do not have a direct connection to your ConfigMgr infrastructure)
• Full support for Fully Qualified Domain Names (FQDNs) and IPv6
• Clients send new State Messages based on the state of a process at a given time of changes to their state (compared to Status Messages which provide information relating to data flow and component behaviour)
• A new improved version of the SMS Administrator Console
• Introduction of several new Site System Roles:
  Branch Distribution Point (BDP)
  Fallback Status Point (FSP)
  Pre-boot Execution Environment (PXE) Service Point
  Software Update Point (SUP)
  State Migration Point (SMP)
  System Health Validator Point (SHVP)
  NOTE: These are explained in the “What are the ConfigMgr 2007 Site System roles?” article
• Support for hosting the Site Database on a clustered SQL Server virtual instance or SQL Server 2005 named instances
• New Software Update Point Client installation method
• Boundaries can be defined based on IPv6 Prefix (as well as AD Site, IP subnet, and IP range as in SMS 2003)
• Support for upgrading from the Evaluation Version to the Full Version of the product without having to re-install/ reconfigure everything

#####
# SCCM 2007 相比 SMS 2003 做了改变的地方
#########################

• Feature Packs that used to be separate add-ons in SMS 2003 are now incorporated into the core ConfigMgr product (for example the Administration Feature Pack, Device Management Feature Pack, Operating System Deployment Feature Pack Update)
• Asset Intelligence introduced as an optional component in SMS 2003 SP3 is now included in the core product
  NOTE: As a result of the above two changes the core product requires a greater amount of server resources.
• Major changes to the way Backup and Recovery, and Software Updates work compared to SMS 2003
• Minor improvements to Collections, Remote Tools, Software Distribution and Software Metering compared to SMS 2003
• Senders can only now be installed on Primary or Secondary Site Servers
• Only one Client type (basically the SMS 2003 Advanced Client so no Legacy Clients)
• Only a single Security mode (similar to SMS 2003 Advanced Security mode)
• The Site Server’s local boundary is no longer automatically configured as a Site Boundary – you need to define this post installation
• Site Boundaries are no longer supported – only Roaming Boundaries are with a choice of “Slow or unreliable” or “Fast (LAN)”
• Client Push uses the Site Code of the Primary rather than being set to “Auto” as in SMS 2003

#####
# SCCM 2007 相比 SMS 2003 没有变化的地方
#########################

Some things have remained the same or have changed very little in ConfigMgr compared to SMS 2003:

• Discovery, Inventory, Queries and Reporting
• Key terminology such as Sites, Primary Sites, Secondary Sites remains the same
• Services, file names, share names and ConfigMgr-related groups retain the SMS prefix
• Many Status Messages still mention SMS as these could potentially refer to a Child SMS SMS 2003 Site
• Some programmatic elements have not been renamed such as the SMS Provider to avoid potential backwards compatibility issues for those people using WMI scripting

2007年8月24日，微软 System Center Configuration Manager 2007 (SCCM 2007) 已经正式发布了。详情见： http://www.myitforum.com/absolutenm/templates/IndustryNews.aspx?articleid=3845&zoneid=71

本文根据个人理解编写，欢迎大家指出我的错误，我会努力不断将其完善。谢谢！
我的MSN: xnming21@hotmail.com

SCCM 中服务器的角色有：
Branch Distribution Point
Component Server
Distribution Point
Fallback Status Point
Management Point
PXE Service Point
Reporting Point
Server Locator Point
Site Database Sever
Site Server
Software Update Point
State Migration Point
System health Validation Point

Advanced Client: 运行 Win2000 及其之后的操作系统的 Client。Advanced Client 可以被委派到 Mixed 模式的 Site。

Asset Intelligence: 智能资产管理。是 SCCM 2007 的一个功能，可以生成一个关于 Client 上安装的软件硬件清单的报告。

binary delta replication: SCCM 2007 一个功能，与 delta replication 不同，delta replication 是文件级的差别比较后复制，binary delta replication 是二进制级的差别比较复制。这个应用在管理远程分支机构比较有用。比如下发一个200M的软件，过了不久当这个软件升级（不可能 200M 都重写吧）后再次下发时，BDP 会将它现有的文件和 DP 上的新文件进行二进制级别的比较，然后只更新下载变化的部分。这样就大大节省了带宽。当然，同时这也增加了 CPU 的负责，对 CPU 要求比较高。这就叫以 CPU 换带宽嘛！^_^

BitLocker: 这是 Windows Vista 之后的操作系统才具有的功能，提供了对硬盘卷分区的底层加密，实现保护硬盘数据的目的。具体怎么回事偶也不清楚。

BITS: Background Intelligent Transfer Service. 提供了断点续传功能已经低带宽占用。

boundary: 管理边界，可以是一个 IP 子网，一个 IP 网段，一个 Ipv6 Prefix 以及一个 AD 站点等，用于定义一个 Configuration Manager site 的管理边界。Client 端可以利用边界确定被委派到哪个 Site 以及距离自己最近的一个 DP。这应该和 AD 中的关于站点的作用类似。Boundry 分两种网络连接类型：Lan 和 Slow or unreliable。

BDP: branch distribution point

client component: 在客户端上运行的 Configuration Manager 线程、服务或者程序，从而为 Client 提供 Configuration Manager 功能。

Configuration Manager client：任何运行着 Configuration Manager client 组件的计算机、Smart Phone、PPC等设备。一句话，可被 Configuration Manager 管理的设备。

Configuration Manager Site：位于多个子网下或同在一个域中的许多 Client 和 Site System 的集合。

Site Server: 成功安装了 Configuration Manager 的计算机，每个 Configuration Manager Site 只有一个 Site Server。

Site System: 具有配置管理功能的一台服务器，也就是被赋予了特定角色的服务器。一个 Site System 可以被赋予一个或多个角色。

SCCM 2007 是一个分布式的 Client/Server 系统，也就是说Site Server、Site System 和 Client 之间可以建立连接，其中一些连接的的端口是可以配置的，一些端口是固定不可配置的。

注：

如果需要配置成支持 Internet-based clients，参考 Supported Scenarios for Internet-Based Client Management 配置防火墙策略。对于 Internet-based clients 出了需要考虑端口方面的设置，同时需要考虑允许一些 HTTP verbs 和 headers 通过防火墙，具体参考 Prerequisites for Internet-Based Client Management。

可以配置的端口：

Configuration Manager 2007 allows you to configure the ports for the following types of communication:
• Client to site system
• Client to internet (as proxy server settings)
• Software update point to internet (as proxy server settings)
• Software update point to WSUS server
• Client to reporting point

默认情况下，client-to-site system 之间的连接如果通过 HTTP 使用 80 端口，通过 HTTPS 则使用 443 端口，client-to-site system 使用的端口是可以在初始安装 Configuration Manager site 的时候配置的。

不可配置的端口：

Configuration Manager does not allow you to configure ports for the following types of communication:
• Site to site (primary-to-primary or primary-to-secondary)
• Site server to site system
• Site server to site database server
• Site system to site database server
• Configuration Manager 2007 console to SMS Provider
• Configuration Manager 2007 console to the Internet

About RPC connections and Configuration Manager

Configuration Manager 2007 uses RPC extensively in its communications. RPC initially connects using port 135, then negotiates a port above 1024 for subsequent communication. This port number is dynamic, and cannot be changed within Configuration Manager 2007. To limit the available “random” ports used by RPC to a pre-defined range of ports, Microsoft offers a free RPC configuration tool. You can use the RPC configuration tool to establish a limited range of ports for use by RPC, then configure your IPsec filter to include the port range. For more information about the RPC configuration tool, see http://go.microsoft.com/fwlink/?linkid=93102
-LinkId=93102.

详细的端口使用情况

– > indicates one computer initiates and the other computer always responds

< -- > indicates that either computer can initiate

1. Site Server < -- > Site Server

2. Primary Site Server — > Domain Controller

3. Site Server < -- > Software Update Point(see note 6)

4. Software Update Point — > Internet

5. Site Server < -- > State Migration Point(see note 6)

6. Client — > Software Update Point

7. Client — > State Migration Point

8. Client — > PXE Service Point

9. Site Server < -- > PXE Service Point(see note 6)

10. Site Server < -- > System Health Validator(see note 6)

11. Client — > System Health Validator
The client requires the ports established with the Network Access Protection server such as DHCP and IPsec. No port is required for 802.1X.

12. Site Server < -- > Fallback Status Point(see note 6)

13. Client — > Fallback Status Point

14. Site Server — > Distribution Point

15. Client — > Distribution Point

16. Client — > Branch Distribution Point

17. Client — > Management Point

18. Client — > Server Locator Point

19. Branch Distribution Point — > Distribution Point

20. Site Server to Provider

21. Server Locator Point — > Microsoft SQL Server

22. Management Point — > Microsoft SQL Server

23. Provider — > SQL Server

24. Reporting Point — > SQL Server

25. Configuration Manager Console — > Reporting Point

26. Configuration Manager Console — > Provider

27. Configuration Manager Console — > Internet

28. Primary Site Server — > Microsoft SQL Server

29. Management Point — > Domain Controller

30. Site Server — > Reporting Point

31. Site Server < -- > Server Locator Point(see note 6)

32. Configuration Manager Console — > Site Server

33. Software Update Point — > WSUS Synchronization Server

34. Configuration Manager Console — > Client

35. Management Point < -- > Site Server(see note 6)

36. Site Server — > Client

Note：

1. 1. Proxy Server port This port cannot be configured, but can be routed through a configured proxy server.
2. 2 Alternate Port Available An alternate port can be defined within Configuration Manager for this value. If a custom port has been defined, substitute that custom port when defining the IP filter information for the IPsec policies.
3. 3 RAS Sender Configuration Manager 2007 can also use the RAS Sender with Point to Point Tunneling Protocol (PPTP) to send and receive Configuration Manager 2007 site, client, and administrative information through a firewall. Under these circumstances, the PPTP TCP 1723 port is used.
4. 4 Windows Server Update Services WSUS can be installed either on the default web site (port 80) or a custom web site (port 8530).
   After installation, the port can be changed.
   If the HTTP port is 80, then the HTTPS port must be 443.
   If the HTTP port is anything else, then the HTTPS port must be 1 higher, for example 8530 and 8531.
5. 5 Trivial FTP (TFTP) Daemon The Trivial FTP (TFTP) Daemon system service does not require a user name or password and is an integral part of the Windows Deployment Services (WDS). The Trivial FTP Daemon service implements support for the TFTP protocol defined by the following RFCs:
   • RFC 350 — TFTP
   • RFC 2347 — Option extension
   • RFC 2348 — Block size option
   • RFC 2349 — Timeout interval, and transfer size options

   Trivial File Transfer Protocol is designed to support diskless boot environments. TFTP Daemons listen on UDP port 69, but respond from a dynamically allocated high port. Therefore, enabling this port will allow the TFTP service to receive incoming TFTP requests, but will not allow the selected server to respond to those requests. Allowing the selected server to respond to inbound TFTP requests cannot be accomplished unless the TFTP server is configured to respond from port 69.

6. 6 Communication between the site server and site systems By default, communication between the site server and site systems is bi-directional. The site server initiates communication to configure the site system, and then most site systems connect back to the site server to send back status information. Reporting points and distribution points do not send back status information. If you select Allow only site server initiated data transfers from this site system on the site system properties, then the site system will never initiate communication back to the site server.

   Configuration Manager Remote Control Ports

   When you use NetBIOS over TCP/IP for Configuration Manager 2007 Remote Control, the following ports are used.

   Description	UDP	TCP
   Name resolution	–	137
   Messaging	–	138
   Client Sessions	–	139

   Ports Used by Windows Server 2003

   The following table list lists the core UDP and TCP ports that Windows Server 2003 uses, and their respective functions.

   Description	UDP	TCP
   Domain Name System (DNS)	53	–
   Dynamic Host Configuration Protocol (DHCP)	67 and 68	–
   Windows Internet Name Service (WINS)	138	–
   NetBIOS datagrams	138	–
   NetBIOS datagrams	–	139

   Connecting with Microsoft SQL Server

   If you use the TCP/IP Net-Library, enable port 1433 on the firewall. Use the Hosts file or an advanced connection string for host name resolution.

   If you use named pipes over TCP/IP, enable port 139 for NetBIOS functions. NetBIOS should be used only for troubleshooting Kerberos issue.

   Note

   TCP/IP is required for network communications to allow Kerberos authentication. Named pipes communication is not required for Configuration Manager 2007 site database operations and should only be used to troubleshoot Kerberos authentication issues.

   By default, SQL Server uses TCP (not UDP) port 1433 to listen on TCP/IP. To change the port, run SQL Server Setup on the server, and then click Change Network Support. If SQL Server uses port 1433, the client Net-Library works. If SQL Server uses a custom port number, the client must specify that port in the Data Source Name (DSN).

   Microsoft does not recommend that you enable UDP ports 137 and 138 for NetBIOS name resolution by using B-node broadcasts. Instead, you can use a WINS server or an LMHOSTS file for name resolution.

+---------+   send     +--------------+   relay    +--------+
+  SCCM   + ---------> +   Fallback   + ---------> +  Site  +
+ client  +  message   + status point +            + server +
+---------+            +--------------+            +--------+

Attention!!!

1. SMS 2003 client computers cannot use a fallback status point.
2. There is no equivalent of the status message viewer for state messages.

如果决定使用 fallback status point，那就在布署 client 之前就添加好这个 role。另外，虽然可以在一个站点中布署多个 fallback status point，但是每个客户端只能制定一个 fallback status point。

Using the Fallback Status Point for Client Deployment

在安装 client 遇到问题的时候，client 会发送到 fallback status point 的消息有如下几种：
• The client failed to install properly (for example, because of incorrect setup options or syntax errors, or because it failed to locate the required files).
• The client failed to be assigned to a site.
• The client failed to register with its assigned site.
• The client failed to locate its management point.
• There was a network connectivity problem between the client and the management point.
• The management point is not configured correctly (for example, Internet Information Services (IIS) is not configured correctly for a Configuration Manager management point).

Attention!!!

在 client 在成功安装之后，也会向 fallback status point 发送一个消息。当需要重启才能完成安装时，也会向 fallback status point 发送一个消息。

Using the Fallback Status Point to Identify Native Mode Communication Problems

因为 fallback status point 能够接收 unauthenticated 的通信，可以从处于 native 模式的客户端接收到由于 PKI 验证问题造成客户端和管理节点之间的通信问题的消息。Examples of state messages a client might send to a fallback status point to identify problems with native mode communication include the following:

• There is no valid client certificate.
• There is more than one possible valid client certificate without an appropriate certificate selection configuration specified.
• A server certificate needed for native mode communication fails to chain successfully to the trusted root certification.
• A server certificate needed for native mode communication is expired.
• A server certificate needed for native mode communication is revoked.