Contents
-
Introducing Tachyon
-
Quick Start
-
Implementing Tachyon
-
Using Settings
-
Using Explorer
-
Using Guaranteed State
-
Using Inventory
-
Using Experience
-
Using Patch Success
-
Troubleshooting
-
Extending Tachyon
-
Training
-
Tachyon Operator v5.0 Lab Guide
-
Tachyon Advanced v5.0 Lab Guide
-
Ex 1 - TCN Adv 5.0 - TIMS Explained
-
Ex 2 - TCN Adv 5.0 - TIMS Functions
-
Ex 3 - TCN Adv 5.0 - SCALE The Relational Model
-
Ex 4 - TCN Adv 5.0 - Creating an Instruction: Critical Services
-
Ex 5 - TCN Adv 5.0 - Creating an Instruction that executes a Script
-
Ex 6 - TCN Adv 5.0 - Visualization and Aggregation
-
Ex 7 - TCN Adv 5.0 - Extending Guaranteed State
-
Ex 8 - TCN Adv 5.0 - Real World Examples for Guaranteed State
-
Ex 9 - TCN Adv 5.0 - Tachyon Activity Record
-
Ex 1 - TCN Adv 5.0 - TIMS Explained
-
Tachyon - Nomad as Content Provider Lab Guide
-
Tachyon Operator v5.0 Lab Guide
-
Reference
Real World Examples for Guaranteed State
Application Health Check
There are times when we have an application that we need to make sure is running and up to date like Windows Defender or other anti-malware solutions. This exercise will build a policy to check the state of our Application Virtualization Client (App-V), but this scenario could be used for any application. We will check for the installation, the service state (running) and the current version installed. We will add two triggers, one to fire the rule if the service stops and one to fire on a schedule.
Create the Missing Rule
This rule will check to see if the device has the application installed. Since this is a critical application, we will call the device non-compliant if the App-V Client is not installed. If we do not care to report on devices that do not have the application installed, we could use a Pre-Condition check and only report on devices that actually have the application in question installed.
- In Guaranteed State, navigate to Administration->Rules
- Click on New in the far right
- In the Name field type in Check that the App-V Client is installed
- In the Description field type in Check that App-V Client is installed
- In the Type field select Check
- Click on Triggers.
- Choose Periodic (hours)
- In the Interval Hours field type in 168
- Click on Check
- In the Select check to be performed field select Check for WMI namespace <WMI namespace to check for>
- In the Namespace field type in root\Microsoft\appvirt
- Click Save
Create the Service Rule
- In Guaranteed State, navigate to Administration->Rules
- Click on New in the far right
- In the Name field type in Check that the App-V Client Service is running
- In the Description field type in Ensures the App-V Client Service is running
- In the Type choose Fix
- Click on Triggers and select When the state of the named Windows service changes
- In the Service Name field type in sftlist
- Click on Check
- In the Check field choose Check that service "<ServiceName>" is <State>
- In the ServiceName field type in sftlist
- In the State field select Running
- Click on Fix
- In the Select fix to be run if device is non-compliant with check Choose Request service "<Short name of service>" to <Service action to perform>
- In the ServiceName field type in sftlist. In the Action name field choose Start
- Click Save
Create the Version Rule
We will check to make sure the latest version of the App-V Client is installed. We will run this check each time the App-V Client process starts.
- In Guaranteed State, navigate to Administration – Rules
- Click on New on the right
- In the Name field type in Check that the App-V Client is the Latest Version
- In the Description field type in Check that the App-V Client is the Latest Version
- In the Type choose Check
- Click on Triggers and select When a Process Starts (Windows Only)
- In the Process Name field type in C:\Program Files\Microsoft Application Virtualization Client\SftList.exe
- Click on Check
- In the Check field choose Check that registry key <Hive>\<Subkey>\<Name> has <ValueType> value of "<Value>"
- In the Hive field select HKLM
- In the Subkey field type in SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DB9F70CD-29BC-480B-8BA2-C9C2232C4553}
- In the Name field type in DisplayVersion
- In the Value field type in 4.6.1.20870
- In the Value Type field select REG_SZ
- Click Save
Create the Policy
Now, we will create the policy that will contain all of our rules.
- In Guaranteed State, navigate to Administration->Policies
- Click on New in the column on the right
- In the Name and Description fields type in App-V Client Health Check
- In the All Rules section filter for contains App-V Client and select the 3 rules that we just created Check the App-V Client Version, Check that the App-V Client Service is running, and Check that the App-V Client is installed
- Click the double arrows to the right to add them to the Assigned Rules section
- Click Save
Deploy the Policy
- Select App-V Client Health Check and click Assign
- Select the All Win10 Lab Workstations Devices Management Group and click Save
- Click Deploy. Select Ok
- Navigate to Overview and select the App-V Client Health Check policy in the drop-down
- You may have to refresh in order to see the results
Set the Stage for Broken Application
Now we will "break" our application to see how Guaranteed State shows the results.
- Log into 1ETRNW101 as 1ETRN\Tachyon_AdminG
- Stop the Microsoft Application Virtualizaion Client Service
- In Guaranteed State - Overview with the App-V Client Health Check Policy selected
- Notice the device move into the non-compliant state
Service Desk Ticket Symptom
There are times when we have an incident reported to the Service Desk that has the potential for wide-spread impact in our environment. It may be related to a global application or a business-critical functionality. Typically, what we see happening is the first user to experience the issue calls the service desk and a fix is determined and applied. The Service Desk must depend on the spread of that solution to the other help desk agents using a KB article or other such knowledge transfer. When the next user has the issue, they call the Service Desk, and if they are lucky the agent will know the resolution and be able to apply it. Alternatively, the Agent may have to come up with the solution again, duplicating efforts and wasting time for both the agent and the end user. With Guaranteed State we can create a policy for this issue and have the device remediated immediately without a need for a service desk call and maybe even before the end user knows they have the issue. In this exercise we will use a harmless event to show you the functionality. We will call it Help Desk Issue #2.
Create the Rule
In this exercise we will use a specific event in the Event Viewer as our trigger. This way we can perform the fix each time that event fires. In our example, the fix is simply going to be restarting the service but we could just as easily do anything else to the device that we needed to.
- In Guaranteed State, navigate to Administration->Rules
- Click on New on the right
- In the Name field type in Check For Help Desk Issue #2
- In the Description field type in A great description that tells you what Help Desk Issue #2 is
- In the Type field select Fix
- Click on Triggers. Choose When an even log entry is created (Windows only)
- In the Channel field type in Application
- In the Query field type in *[System[(Level=2) and (EventID=1000)]] and *[EventData[Data='onenote.exe']]
- In the Debounce time (seconds) field type in 60
- Click on Check
- In the Select check to be performed choose Check that service "<Servicename>" is <State>
- In the ServiceName field type in Windows Update
- In the State field select Running
- Click on Fix
- In the Fix box select Request service "<Short name of service>" to <Service> action to perform
- In the Service name box type in Wuauserv
- In the Action box select start
- Click Save
Create the Policy
- In Guaranteed State, navigate to Administration - Policies
- Click New on the right
- In the Name and Description boxes type in Help Desk Issue #2
- In the All Rules section choose our Check for Help Desk Issue #2 rule
- Click the double Arrows to move the rule to the assigned rules box
- Click Save
Assign and Deploy the Policy
- Select our Help Desk Issue #2 policy and click Assign
- Click the Plus sign and Select our All Devices management group and click OK
- Click Deploy and OK on the message popup
Viewing the Initial Results
- Open the Services applet and stop the Windows Update Service.
- Navigate to C:\ProgramData\1E\Client and open 1E.Client.log in CMTrace
- Look in the log for "Policy Rule "Check for HelpDesk Issue #2""
- You will see entries for downloading the policy, processing the instruction, and running the fix (starting the service)
Set the Stage
Since our rule has a trigger to look for a specific event from the event logs we will force that event to occur on a device. This will force our rule to run again.
- Open the Services applet and stop the Windows Update service again
- Launch an Administrative command prompt
- In the command prompt type in the following:
eventcreate /ID 1000 /L Application /SO onenote.exe /T Error /D "onenote.exe"
View the Results
- Open the 1E.Client.log again and notice the entries for the reprocessing of the rule
- Open the Services applet and notice the Windows Update service has been started. If you did not close the applet you may have to refresh
Removing Unauthorized Software
In this exercise we will create a policy that will remove a piece of software that is not allowed to be used in our environment. We have several devices in our environment with unapproved software installed and this is leading to non-productive workers. We will create a policy that looks for Orca and perform the removal. We will use the process of Orca starting as a trigger for the rule so that we can also remove subsequent installations of the application after we remove it the initial time.
Create the Fragment
This fragment will be used to remove any software that was installed using MSI. We will ask for the Product Name and Publisher as our parameters.
- Launch TIMS
- In the code block type in the following:
- Click Run
- Notice the results
- In TIMS click on Add Parameter
- In the Name field type in Software
- In the Hint Text type in Unauthorized Software Product
- Click Add Parameter again and type Publisher in the Name field and Unauthorized Publisher Name in the Hint text field
- Click OK
- In the Instruction Definition section Comments field type in Checks to see if unauthorized software is installed
- In the description field type in Does this machine have unauthorized software?
- In the Name field type in 1E-GuaranteedState-Check-UnauthorizedSoftware
- In the Readable payload type in Check for %Software% by %Publisher%
- Click on Schema choose yes to create the schema. Change the length of the data field to 1024. Click OK
- Save the file as 1E-GuaranteedState-Check-UnauthorizedSoftware.xml in C:\tools\AdditionalProductPacks\Product_Pack_Templates
- Create a folder in C:\Tools\AdditionalProductPacks\Product_Pack_Templates called UnauthorizedSoftware
- Move your fragment to C:\Tools\AdditionalProductPacks\Product_Pack_Templates\UnauthorizedSoftware\Fragments\Check (you will need to create the additional two folders)
- Copy the manifest.xml from one of the other product pack folders to C:\Tools\AdditionalProductPacks\Product_Pack_Templates\UnauthorizedSoftware
- Find a .ico file on your machine to use for your Product Pack. Copy the file to C:\Tools\AdditionalProductPacks\Product_Pack_Templates\UnauthorizedSoftware
- Edit your manifest.xml for your Unauthorized Software Product Pack
- Change the Name, description, and icon file references. Save the file as manifest.xml
- Now we will edit this fragment and create a Fix for the removal of Orca. At the end of line 3 in your code block hit the enter key to create a new line 4 (above the ELSE)
- Type in the following on your new empty line 4
- In the Instruction Definition Section Comments field type in Checks to see if unauthorized software is installed
- In the Description field type in Ensures that unauthorized software is not installed
- In the Name field type in 1E-GuaranteedState-Fix-UnauthorizedSoftwareRemoval
- In the Readable Payload field type in Check for %Software% by %Publisher% and remove
- Save file as C:\Tools\AdditionalProductPacks\Product_Pack_Templates\UnauthorizedSoftware\Fragments\Fix\1E-GuaranteedState-Fix-UnauthorizedSoftwareRemoval.xml
@Software = Software.GetInstallations(Publisher:"%Publisher%",Product:"%Software%"); IF (@Software) SELECT 0 as Passed, "%Software% installed" as Data; ELSE SELECT 1 as Passed, "%Software% not installed" as Data; ENDIF;
Software.Uninstall(Publisher:"%Publisher%",Product:"%Software%");
Upload into Guaranteed State
- In File Explorer navigate to C:\Tools\AdditionalProductPacks\Product_Pack_Templates\UnauthorizedSoftware
- Multi select all of the files in that folder and right click and choose Send to Compressed (zipped) folder
- Rename the .zip file to UnauthorizedSoftware.zip
- Copy the file to C:\Tools\tachyonplatform.v5.0.0.592\ProductPacks\Integrated
- Launch Tachyon.ProductPackDeploymentTool.exe
- In the Server name field change .acme.local to .1etrn.local and click on Test Connection
- Uncheck Select all and only select our Unauthorized Software Product Pack
- Click Upload Selected
Create the Rule
We will be creating a rule to remove Orca. With this parameterized fragment you could make multiple rules to add to your policy if you wanted to remove a number of software titles. The Software.Uninstall module and method only works for software installed via the Windows Installer (.MSI format). We could just as easily use the NativeServices.RunCommand instead, we would just need to supply the command line for the unattended uninstall.
- Launch Guaranteed State as our Admin 1ETRN\Manager1
- Navigate to Administration->Rules
- Click New to create a new rule Name it Remove Orca
- Put in a meaningful description
- Select Fix for type
- Click the Triggers tab
- Choose the trigger When a process starts (Windows only)
- In the Executable field type in C:\Program Files\Orca\orca.exe
- Click on Check
- In the Check field select Check for <Unauthorized Software Product> by <Unauthorized Publisher Name>
- In the Software field type in the Product Name in this case Orca
- In the Publisher field type in the Publisher Name in this case Microsoft Corporation
- Click on Fix
- Select the Check for <Unauthorized Software Product> by <Unauthorized Publisher Name> and Remove
- Type the product name in the Software field - Orca
- Type the Publisher name in the Publisher field - Microsoft Corporation
- Click Save
Create the Policy
- Navigate to Administration->Policies
- Click New to create a new policy name it Remove Unauthorized Software
- Put in a meaningful description
- Select our Remove Orca Rule
- Click the double right arrow to move it over to the assigned section
- Click Save
Assign and Deploy the Policy
- Select our Remove Unauthorized Software policy
- Click Assign. Choose our All Win7 Devices Management Group
- Navigate to Start - All Programs and notice that Orca is installed on this device
- Click Deploy. Click OK
View the Results
- Navigate to Overview. Click the dropdown to select our Remove Unauthorized Software Policy
- You will see the devices become non-compliant the rule will then remove the software.
- Navigate to C:\ProgramData\1E\Client and Open the 1E.Client.log using CMTrace
- Check the Client entries for the processing of the policy. Leave the log file open
- Notice that Orca has been removed
- Reinstall Orca from the ConfigMgr Content location using the desktop shortcut
- Open Software\Orca and double click Orca.msi. Select the Complete installation
- Once the install completes launch Orca close Orca to allow the uninstall to complete
- Navigate back to the 1E.Client.log and notice that Orca has been removed again. Look at Start - All Programs to ensure it has been removed.
Lab Summary
In this lab we learned how to use Guaranteed State in some real-world scenarios. As you can see Guaranteed State is very flexible and can be used for many, many different jobs to keep our environment healthy and configured correctly.