Security Incident Response

If you think you have or know you have a Security Incident please fill in the form and our experienced Onevinn CSIRT team will reach out shortly.
 
The team has long experience in supporting customers in Incident Response and Compromised Recovery.
 
Keep calm and we will be with you shortly!

Jörgen Nilsson 03 Apr 2020
2 min

First look – Orchestration groups in MEMCM 2002

Orchestration Groups is a new feature in Configuration Manager 2002 and replaces Server Groups which never made it out of pre-release.. Orchestration Groups is a pre-release feature that you need to enable if you intend to use it.
NOTE: Orchestration Groups will replace Server Groups if you are using that today and convert your Server Groups to Orchestration Groups.

I have been testing it out since MEMCM 2002 was released in fast-ring and it works really well and I love the new UI.

Orchestration Groups are basically a group of devices you want to install Software Updates to in a controlled way, with Pre and Post PowerShell Scripts that are executed on each device in the Orchestration Group. Could be for example SQL Servers, Clusters and multi layered applications.
We simply deploy our Software Updates to our collections as we normally do if the server is a member of an Orchestration group the Orchestration Group starts and we can track the progress in the Admin Console! Really Nice!

Before we create an Orchestration group let’s look at the limitations.
– A device can only be member of one Orchestration Group
– Max 1000 devices per Orchestration Group
– Make sure the Configuration Manager client is upgraded to at least MEMCM 2002
– If Software updates are installed from Software Center then Orchestration Groups are bypassed.

Create an Orchestration Group

We start with giving it a name.

Select the devices that should be members in the group.

We have three option:
– Allow a precentage of the machines to be updated at the same time
– Allow a number of machines to be updated at the same time
– Specify the the maintenance sequence

We can add a Pre-script, I used a simple one that writes the date and time it started to a log file, C:\Orchestration.log file. It will be executed on all the devices in the group.
Exit 0 = Success
Exit Code 3010 = Success with Reboot

We can use a Post-script as well, same hear it adds stop to the same log file on C:\Orchestration.log file.

The we are done!

How does it work?

We can start the Orchestration group manually using the UI to test it out. When we use it in production the Orchestration Group we simply deploy the Software Updates as normal and when the installation of Software Updates start the Orchestration Group kicks off.
When the Orchestration group starts we have nice UI to track the progress.

We can use Run Scripts for a server in a group and also start remote control to troubleshoot as well. Really nice!

What about log files then?
On the Site server we can track the progress in the SMS_Orchestration.log file.

On each device in an Orchestration Group we can track and troubleshoot the process using the MaintenanceCoordinator.log file, where we can see the Pre-script being executed as shown below for example.

When looking in the file system on one of the target devices we can see that my pre/post script writes to the Orchestration.log file

Conclusion, Orchestration groups is a pre-release feature in MEMCM 2002 which looks really promising! Test it out send frowns and smileys with what you like and what you are missing to the product group!