The following sections provide example scenarios of how desired configuration management in Configuration Manager 2007 can be implemented to solve the following business requirements:
Comparing the Configuration of Computers against Best Practices Configuration from Microsoft and Other Vendors
This scenario demonstrates how customers can compare the configuration of their Microsoft Exchange Server against best practices specified in Microsoft System Center Configuration Manager 2007 Configuration Packs, and detect a potentially detrimental configuration before it negatively affects service level agreements (SLAs).
Woodgrove Bank has deployed Microsoft Exchange Server as its mission-critical e-mail system. Recently, the bank has experienced a number of system outages in which the Microsoft Exchange Information Store shut down unexpectedly. After several days of investigation, Jason Warren, Woodgrove Bank's Exchange Server administrator, discovered that the outages were the result of a number of incorrect settings. To reduce unplanned downtime in the future, Woodgrove Bank must find a way to detect when its Microsoft Exchange Servers have been misconfigured.
John Woods is Woodgrove Bank's IT systems manager. He learned that Microsoft published a number of recommended configurations for Microsoft Exchange Server 2003 as a Configuration Pack that can be applied with desired configuration management in Configuration Manager 2007. He decides to follow the course of action in the following table.
This is a possible result of implementing desired configuration management in this way:
-
Three months later, John confirms that the number of unplanned downtime incidents has dramatically decreased.
Remediating Non-Compliance with Software Distribution that Targets Computers with Software Packages or Scripts by Using a Collection that Is Automatically Populated with Computers Reporting Non-Compliance
This scenario demonstrates how customers can remediate non-compliance of security settings using desired configuration management.
A. Datum Corporation has a number of sales staff who frequently travel to customer locations to provide demonstrations and work with customers to help solve their technical problems. While traveling away from the company network, the sales people often reconfigure their laptops to interface with customer networks and share data. When the sales people return to their offices, their laptops are often out of compliance with the corporate standards. In particular, firewall settings and Microsoft Windows security permissions have often been changed to facilitate the interchange of information.
It is very time consuming for the security team to identify the non-compliant changes and to ensure that these laptops are not running malicious software (malware) and do not pose security risks to the corporate network. A. Datum Corporation wants an automated mechanism for evaluating these laptops, and it remediates them using corrective scripts to ensure they are brought back in line with corporate standards.
Ellen Adams works on the security team at A. Datum Corporation. Working with Tommy Hartono, the Configuration Manager administrator, she takes the course of action in the following table.
This is a possible result of implementing desired configuration management in this way:
-
Non-compliant laptop returns to company network and is automatically remediated.
One of the sales staff returns from a customer visit. The Configuration Management client running on the laptop downloaded the security configuration baseline when it was previously connected to the corporate network, and the client continued to evaluate its compliance with its assigned configuration baselines.
The sales person experienced some connection problems and tried disabling the firewall to resolve the issue, but did not enable it again. As soon as the laptop reconnects to the corporate network, its non-compliance results are sent to the Configuration Manager site.
The laptop is then automatically added to the collection that has the script advertised to it. There is no malicious software detected, so the security team does not need to take further action because the remediating script is automatically run on the laptop.
The laptop is brought back into compliance without administrator intervention.
See Also