The first step is to create two SMS specific
security groups in your Domain OU.
These two security groups are vital to the
over all security and functionality of SMS.
The following information shows you he
naming convention we would like you to use
along with an explanation of how each
security group is used.
SMS-<Department Name>-Admins -
This
group should contain the user
accounts of
staff members in your department who
will be managing your
departmental systems using SMS. This group
is used to grant permissions to the
various SMS object classes which
are applicable to your
department.
In addition, this group will be added as a member
of the SMS-Admins group,
which will give you the needed
permissions to access files
shares containing SMS-related
tools and utilities.
SMS-<Department
Name>-Systems -
This
group should contain all of the
Active Directory computer accounts
in your department that you would
like to manage with SMS. In
the SMS Console, the logical
grouping of your managed
machines is called an SMS
Collection. This
Collection is populated based on
a query which synchronizes AD
security group membership to the
membership of the SMS
Collection.
Once these two security groups have been
created and the appropriate AD computer/user
accounts have been added to these groups as
members, contact
Enterprise Client Management so that the
preparation process may be completed.
The second step is to prepare your clients
and admin machine for SMS Management.
This involves setting the proper firewall
exceptions (usually via a GPO) on clients in
order to communicate with the SMS server and
on the Admin machine in order to access the
SMS Console. A guide to necessary
firewall exceptions
is here.
The third step is installing the proper
tools on the Administrator's machine.
This includes installing the SMS Console,
the Active Directory Admin Pack, and the
Group Policy Management Console. Links
to these downloads are on
a protected site. Contact ECM in
order to gain access if you don't have it
already.
The SMS Database
Though SMS uses Active Directory objects
such as security groups and system accounts
to determine to which machines a certain
application is deployed, the SMS system does
this in an indirect fashion. For
example, instead of deploying software
directly to a certain AD security group, an
SMS administrator would deploy an
application to an SMS-specific collection
that is based on the system accounts' group
membership.
...continue to SMS
Discovery >>>
