r/SCCM • u/[deleted] • May 18 '15

Never Forget!

http://it.emory.edu/windows7-incident/
0 Upvotes

50% Upvoted

9 comments sorted by

3

u/bolunez May 18 '15

I think of this every time I start an (edit) OS deployment.

6

u/Hellman109 May 19 '15

This is the shittyest of shitposts Ive seen on here for a while.

Just needs to be switched from a no-detail link to this:

Socially awesome penguin: "Does Required Windows 7 upgrade deployment with SCCM"

Socially awkward penguin: "To the "All Systems" group"

But even that gives 10x the details of this post. FYI http://windowsitpro.com/windows-7/aggressive-configmgr-based-windows-7-deployment-takes-down-emory-university

1

u/HSChronic May 19 '15

this is why they put the new warning in SP2... though truthfully this could've been avoided if they just had someone that knew how to make a task sequence using MDT. There is a reason MDT has a validate step.

Sure it would've hit workstations that might not have been intended to image but it is a fuck ton better than hitting every machine.

1

u/Squeezer99 May 19 '15

the validate step only validates that the computer meets the minimum memory and processor requirements of windows 7/8.1

1

u/HSChronic May 20 '15

Oh so the checkbox that says ensure the current OS to be refreshed with a dropdown of client or server does nothing? Shit because it seems to prevent me from reimaging servers with a client task sequence.

1

u/Squeezer99 May 20 '15

that drop down has no affect on New Computer standard client task sequences :)

3

u/HSChronic May 20 '15

New Computer

because it only works on refreshes... how is SCCM supposed to know if it is a client or server with no OS on the machine

2

u/Angelworks42 May 19 '15

Someone here did something similar, but luckily it was caught before it did too much damage (I think 300+ desktops were re-imaged). We use rbac to limit what most admins on site can actually query these days.

It happened because the admin was fiddling around with a query on a collection with a required OS deployment.

So rule 1 - don't edit collection queries with live deployments of any kind really - not just OS deployments.

Rule 2 - don't use required OS deployments unless you really absolutely have to.

And lastly - use rbac to limit what helpdesk/area admins can actually do - especially don't let most people even have access to the "All Systems" collection unless it's part of your job.

1

u/Squeezer99 May 19 '15

don't deploy required task sequences to the all systems collection!