How to Manage Clients in Configuration Manager

To manage clients from the Devices node

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, click Devices.

3. Select one or more devices, and then select one of the available client management tasks from the ribbon, or by right-clicking the device.

   Task	More information
   Manage user device affinity information	Allows you to configure the associations between users and devices, which enables you to efficiently deploy software to users. See How to Manage User Device Affinity in Configuration Manager
   Add the device to a new or existing collection	Use these collection-related actions to quickly add the selected device to a collection, by using a direct rule. Operations and Maintenance for Collections in Configuration Manager
   Install and reinstall the client by using the Client Push wizard	The Client Push wizard offers an efficient way to install and reinstall the Configuration Manager client to repair it or to reconfigure it on computers that run Windows with site configuration options and with any additional client.msi properties that you have specified for client push installation. Tip There are many different ways to install (and reinstall) the Configuration Manager client. Although the Client Push wizard offers a convenient client installation method because you can run it from the console, this client installation method has many dependencies and is not suitable for all environments. If you cannot successfully install the client by using client push, there are many other client installation methods that you can use. For more information about the dependencies, see Prerequisites for Computer Clients. For more information about the other client installation methods, see Determine the Client Installation Method to Use for Windows Computers in Configuration Manager. See How to Install Configuration Manager Clients by Using Client Push.
   Reassign Site	Reassign one or more clients, including managed mobile devices, to another primary site in the hierarchy. Clients can be reassigned individually or can be multi-selected and reassigned in bulk to a new site.
   Remotely administer the client	You can run Resource Explorer to see the hardware and software inventory information from a Windows client, and remotely administer it by using Remote Control, Remote Assistance, or Remote Desktop. See How to Use Resource Explorer to View Hardware Inventory in Configuration Manager. See How to Remotely Administer a Client Computer by Using Configuration Manager.
   Approve a client	When the client communicates with site systems by using HTTP and a self-signed certificate, you must approve these clients to identify them as trusted computers. By default, the site configuration automatically approves clients from the same Active Directory forest and trusted forests so you do not have to manually approve each client. However, you must manually approve workgroup computers that you trust and any other computers that you trust but are not approved. Warning Although some management functions might work for unapproved clients, this is an unsupported scenario for Configuration Manager. You do not have to approve clients that always communicate to site systems by using HTTPS rather than HTTP, or clients that use a PKI certificate when they communicate to site systems by using HTTP. These clients establish trust with Configuration Manager by using the PKI certificates.
   Block or unblock a client	Block a client that you no longer trust, to prevent it from receiving client policy and to prevent Configuration Manager site systems from communicating with it. Warning Blocking a client only prevents communication from the client to Configuration Manager site systems and does not prevent communication to other devices. In addition, when the client communicates to site systems by using HTTP instead of HTTPS, there are some security limitations. If you later change your mind, you can unblock a client that has been blocked. However, if you unblock an Intel AMT-based computer that was provisioned for AMT when it was blocked, you must take additional steps before you can manage that computer again out of band. See Determine Whether to Block Clients in Configuration Manager.
   Manage the client out of band	For Intel AMT-based computers that are provisioned by Configuration Manager, you can manage these computers out of band by using power actions from the console and by connecting to them by using the Out of Band Management console. See How to Manage AMT-based Computers Out of Band in Configuration Manager.
   Clear a required PXE deployment	Use this option to redeploy any required PXE deployments for the selected computer. See How to Deploy Operating Systems by Using PXE in Configuration Manager
   Manage the client properties	You can view the discovery data and deployments targeted for the client. You can also configure any variables that task sequences use to deploy an operating system to the device.
   Delete the client	Warning Do not delete a client if you want to uninstall the Configuration Manager client or remove it from a collection. The Delete action manually deletes the client record from the Configuration Manager database and typically, you should not use this action unless it is for troubleshooting scenarios. If you delete the client record and the Configuration Manager client is still installed and communicating with Configuration Manager, Heartbeat Discovery will recreate the client record and it will reappear in the Configuration Manager console, although the client history and any previous associations will be lost. Note When you delete a mobile device client that was enrolled by Configuration Manager, this action also revokes the PKI certificate that was issued to the mobile device and this certificate is then rejected by the management point, even if IIS does not check the CRL. Certificates on mobile device legacy clients are not revoked when you delete these clients. To uninstall the client, see Uninstall the Configuration Manager Client. To assign the client to a new primary site, see How to Assign Clients to a Site in Configuration Manager. To remove the client from a collection, reconfigure the collection properties. See How to Manage Collections in Configuration Manager.
   Wipe a mobile device	You can wipe mobile devices that support the wipe command. This action permanently removes all data on the mobile device, which includes personal settings and personal data. Typically, this action resets the mobile device back to factory defaults. Wipe a mobile device when the mobile device is no longer trusted; for example, it has been lost or stolen. Tip Check the manufacturer’s documentation for more information about how the mobile device processes a remote wipe command. When you send a wipe request, there is often a delay until the mobile device receives the wipe command: If the mobile device is enrolled by Configuration Manager or by Microsoft Intune, the client receives the wipe command when it next downloads its client policy. If the mobile device is managed by the Exchange Server connector, the mobile device receives the wipe command when it next synchronizes with Exchange. You can use the Wipe Status column to monitor when the mobile device receives the wipe command. Until the mobile device sends a wipe acknowledgment to Configuration Manager, you can cancel the wipe command.
   Retire a mobile device	For System Center 2012 Configuration Manager SP1 and later: The Retire option is supported only by mobile devices that are enrolled by Intune. For more information, see Help protect your data with remote wipe, remote lock, or passcode reset using Configuration Manager.
   Change the ownership of a device	For System Center 2012 R2 Configuration Manager and later: You can change the ownership of devices to Company or Personal if a device is not domain-joined and does not have the Configuration Manager client installed. You can use this value in application requirements to control deployments and you can also use this configuration to control how much inventory is collected from users’ devices. For more information, see Manage Mobile Devices with Configuration Manager and Microsoft Intune.

To manage clients from the Device Collections node

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, click Device Collections.

3. Select a collection, and then select one of the available client management tasks from the ribbon, or by right-clicking the collection.

   Task	More information
   Scan computers for malware and download antimalware definition files.	See Operations and Maintenance for Endpoint Protection in Configuration Manager.
   Deploy software, configuration baselines, and task sequences.	For more information about deploying software and configuration baselines, see the following: Deploying Software and Operating Systems in System Center 2012 Configuration Manager Compliance Settings in Configuration Manager
   Configure power management settings.	See How to Create and Apply Power Plans in Configuration Manager. Power plans can only be used with computers that run Windows.
   Enable AMT provisioning.	Configure this option when the site has been configured to provision Intel AMT-based computers so that you can manage them out of band. See Step 7: Displaying the AMT Status and Enabling AMT provisioning
   Notify computers to download policy as soon as possible.	For System Center 2012 Configuration Manager SP1 and later: Use client notification to notify the selected Windows clients to download computer policy as soon as possible outside the configured client policy polling interval. Client notification tasks are displayed in the Client Operations node in the Monitoring workspace.

To configure the client cache when you install clients by using manual client installation

• Run the CCMSetup.exe command from the install source location and specify the following properties that you require, and separated by spaces:

  • DISABLECACHEOPT:

  • SMSCACHEDIR:

  • SMSCACHEFLAGS:

  • SMSCACHESIZE:

  Note

  For more information about these command line properties for CCMSetup.exe, see About Client Installation Properties in Configuration Manager.

To configure the client cache folder when you install clients by using client push installation

1. In the Configuration Manager console, click Administration.

2. In the Administration workspace, expand Site Configuration, and then click Sites.

3. In the Sites list, select the site for which you want to configure automatic site-wide client push installation.

4. On the Home tab, in the Settings group, click Client Installation Settings, and then click the Installation Properties tab.

5. On the Installation Properties tab, specify the following properties that you require, and separate them by using spaces:

   - DISABLECACHEOPT:
   
   - SMSCACHEDIR:
   
   - SMSCACHEFLAGS:
   
   - SMSCACHESIZE:
   
     <div class="alert">
   
   
     > [!NOTE]
     > <P>For more information about these command line properties for CCMSetup.exe, see <A href="gg699356(v=technet.10).md">About Client Installation Properties in Configuration Manager</A>.</P>
   
   
     </div>
   

6. Click OK to save the properties that you have specified.

To configure the client cache folder without reinstalling the client

1. On the client computer, navigate to Configuration Manager in Control Panel, and then double-click to open the properties.

2. Click the Cache tab.

3. Specify the disk space to reserve for the client cache.

4. To change the location of the client cache folder, click Change Location, and then specify the new location. The default location is %windir%\ccmcache.

5. To delete the files currently stored in the client cache folder, click Delete Files.

6. Click OK to close Configuration Manager Properties.

To uninstall the Configuration Manager client from the command prompt

1. Open a Windows command prompt and change the folder to the location in which CCMSetup.exe is located.

2. Type Ccmsetup.exe /uninstall, and then press Enter.

To change the hierarchy setting for managing conflicting records

1. In the Configuration Manager console, click Administration.

2. In the Administration workspace, expand Site Configuration, and then click Sites.

3. In the Sites group, click Hierarchy Settings, and then click the Client Approval and Conflicting Records tab.

4. Click either Automatically resolve conflicting records to automatically merge conflicting records, or click Manually resolve conflicting records, and then click OK.

   Note

   When Configuration Manager can resolve the conflict by using the computer account or a PKI certificate, this setting is ignored and the conflict is automatically resolved.

To manually resolve conflicting records

1. In the Configuration Manager console, click Monitoring.

2. In the Monitoring workspace, expand System Status, and then click Conflicting Records.

3. In the results pane, select one or more conflicting records, and then click Conflicting Record.

4. In the Conflicting Record dialog box, select one of the following, and then click OK:

   - **Merge** to combine the newly detected record with the existing client record, creating one unified record.
   
   - **New** to create a new record for the conflicting client record.
   
   - **Block** to create a new record for the conflicting client record, but mark it as blocked.
   

To initiate client policy retrieval by using client notification (Configuration Manager SP1 only)

1. In the Configuration Manager console, click Assets and Compliance.

2. In the Assets and Compliance workspace, click Device Collections.

3. Select the device collection containing the computers that you want to download policy and then, in the Home tab, in the Collections group, click Client Notification and then click Download Computer Policy.

   Note

   You can also use client notification to initiate policy retrieval for one of more selected devices that are displayed in a temporary collection node under the Devices node.

To manually initiate client policy retrieval by using the Actions tab on the Configuration Manager client

1. Select Configuration Manager in the Control Panel of the computer.

2. Click the Actions tab.

3. Click Machine Policy Retrieval & Evaluation Cycle to initiate the computer policy, and then click Run Now.

4. Click OK to confirm the prompt.

5. Repeat steps 3 and 4 for any other actions that you require, such as User Policy Retrieval & Evaluation Cycle for user client settings.

6. Click OK to close Configuration Manager Properties.

To manually initiate client policy retrieval by using a script

1. Open a text editor, such as Notepad.

2. Copy and insert the following into the file:

     on error resume next
   
     dim oCPAppletMgr 'Control Applet manager object.
     dim oClientAction 'Individual client action.
     dim oClientActions 'A collection of client actions.
   
     'Get the Control Panel manager object.
     set  oCPAppletMgr=CreateObject("CPApplet.CPAppletMgr")
     if err.number <> 0 then
         Wscript.echo "Couldn't create control panel application manager"
         WScript.Quit
     end if
   
     'Get a collection of actions.
     set oClientActions=oCPAppletMgr.GetClientActions
     if err.number<>0 then
         wscript.echo "Couldn't get the client actions"
         set oCPAppletMgr=nothing
         WScript.Quit
     end if
   
     'Display each client action name and perform it.
     For Each oClientAction In oClientActions
   
         if oClientAction.Name = "Request & Evaluate Machine Policy" then
             wscript.echo "Performing action " + oClientAction.Name 
             oClientAction.PerformAction
         end if
     next
   
     set oClientActions=nothing
     set oCPAppletMgr=nothing
   

3. Save the file with a .vbs extension.

4. On the client computer, run the file using one of the following methods:

   - Navigate to the file by using Windows Explorer, and double-click the script file.
   
   - Open a command prompt, and type: **cscript \<path\\filename.vbs\>**.
   

5. Click OK in the Windows Script Host dialog box.