sccm - SS67/project-docs GitHub Wiki

Two communicating Windows servers configured as a Domain Controller and a domain-joined SCCM server with adequate disk space.
Active Directory accounts and groups including an SCCM admin account, a SQL Server Engine service account, an SCCM network access account, and an SCCM admin group.
Local administrator group configurations on the SCCM server, ensuring the SCCM admin user and the SCCM computer object are added.
A System Management Container created in Active Directory with full control permissions delegated to the SCCM computer object.
An extended Active Directory schema performed on the Domain Controller using the extad.exe tool.
Inbound Windows Defender Firewall rules configured on the SCCM server to open ports 1433 and 4022 for SQL communication.
The Web Server (IIS) role and required features including Remote Differential Compression and common HTTP features.
SQL Server 2019 (Standard, Developer, or Enterprise) installed using the SQL Server Engine service account.
SQL Server Management Studio (SSMS) downloaded and installed to manage the database engine.
Custom SQL Server memory limits configured within SSMS properties to allocate specific memory limits.
The Windows Assessment and Deployment Kit (ADK) and the Windows PE add-on installed on the server.
The Windows Server Update Services (WSUS) server role installed on the SCCM server.
SCCM 2203 installation files downloaded and extracted to the server's drive.
The required .NET Framework installed via the Server Manager interface prior to running the setup launcher.
A Standalone Primary Site installation setup completed through the SCCM installer after downloading prerequisite files and passing the prerequisite check.

🛠️ I can help you draft a detailed PowerShell script template to automate the deployment of some of these local Windows features and IIS roles if you would like to speed up your lab setup.

Since you have already set up and domain-joined your SCCM server (devsccmlab01) to your domain controller (dev.example.com), you must finish some vital preparation tasks on the domain controller before turning your full attention to configuring the SCCM server.

Here is exactly what you need to do on each server based on your lab guide:

1. What You Need to Do on the Domain Controller (DC)

Before installing anything on the SCCM server, you must prepare Active Directory to support SCCM.

Create Active Directory Accounts & Groups:
- Create an Organization Unit (OU) named SCCM to house your lab accounts.
- Create the sccm admin domain user and make it a member of the following groups: Administrators, Domain Admins, Domain Users, Enterprise Admins, Group Policy Creator Owners, and Schema Admins.
- Create a SQL Server Engine domain service account (e.g., SQL_Engine_Svc).
- Create an SCCM Network Access Account.
- Create a security group named SCCM admin group.
Create and Delegate the System Management Container:
- Open ADSI Edit on the DC, right-click to connect to the default naming context, navigate down to the System container, right-click it, and create a new container object named exactly System Management.
- Open Active Directory Users and Computers and enable Advanced Features under the View menu.
- Locate the System Management container under the System folder, right-click it, and choose Delegate Control.
- Add your SCCM computer object (devsccmlab01$) as the user/group (making sure "Computers" is checked under object types).
- Choose to create a custom task to delegate, and grant the computer object Full Control permissions over this container and its contents.
Extend the Active Directory Schema:
- Download and extract the SCCM 2203 installation files on the DC.
- Navigate to the extracted directory at SMSSETUP\BIN\X64.
- Right-click extad.exe and select Run as administrator.
- Verify successful expansion by checking that the generated log file C:\ExtADSch.log states the operation was successful.

2. What You Need to Do on your SCCM Server (`devsccmlab01`)

Once the Active Directory preparation on the DC is complete, switch to your SCCM server to configure its local roles, database, and prerequisites.

Configure Local Administrators Group: Run lusrmgr.msc to open local user management, open the local Administrators group, and add both your sccm admin domain user and the SCCM server's own computer object (devsccmlab01) as members.
Configure Windows Defender Firewall: Run wf.msc to open advanced firewall settings and create a new Inbound Port Rule allowing TCP ports 1433 and 4022 on the Domain profile (naming it something like "SQL Ports").
Install Web Server (IIS) & Features: Open Server Manager and add the Web Server (IIS) role. In the features section, select Remote Differential Compression. Ensure you include IIS role services for Common HTTP Features, Application Development, Security, Performance, and Health and Diagnostics.
Install the .NET Framework: Before attempting the SCCM setup, ensure the required .NET Framework features are installed via the Server Manager "Add Roles and Features" wizard.
Install SQL Server 2019: Mount the SQL Server 2019 installation ISO, run the setup, and select the Database Engine Services feature. Keep the instance name as the default instance, configure the Database Engine service to use your SQL Server Engine domain service account (configured for Automatic startup), and add your active administrator user as a SQL administrator.
Install and Configure SSMS: Download and install SQL Server Management Studio (SSMS). Open it, connect to your database instance, open server properties, and navigate to Memory to configure custom minimum (2048 MB) and maximum (4096 MB) memory allocations. Restart the SCCM server after this step.
Install Windows ADK & WinPE Add-on: Download the Windows ADK installer. Run it and check only Deployment Tools, User State Migration Tool (USMT), and Imaging and Configuration Designer (ICD). Afterward, download and install the Windows PE add-on.
Install WSUS: Open Server Manager and install the Windows Server Update Services role. Once complete, launch the post-installation tasks and verify configuration success.
Run the SCCM 2203 Installer: Download/extract the SCCM setup files onto the local drive, run splash.exe, and select Install. Select Standalone Primary Site, designate a folder to download the required prerequisite files, configure your unique Site Code/Name, and proceed past the prerequisite check to install.

📊 I can help you draft a PowerShell automation script to quickly configure the Windows Defender Firewall, IIS roles, and local administrator group members directly on devsccmlab01 so you can skip those manual GUI steps.

Your sources focus exclusively on setting up an isolated lab environment and do not cover production environments or the implications of sharing Active Directory OUs and service accounts between production and lab setups.

However, based on what the guide instructs for a clean lab deployment, you should use separate, dedicated accounts and OUs for your lab rather than attempting to share them with a production setup.

What the Lab Guide Recommends

Dedicated OU: The guide demonstrates creating a brand new, dedicated Organizational Unit (OU) called SCCM on your domain controller to house the lab accounts separately.
Dedicated Lab Service Accounts: It outlines creating fresh, individual accounts specifically for the lab, including sccm admin (with elevated privileges), a SQL Server Engine domain service account, and a dedicated SCCM Network Access Account.
Computer-Specific AD Delegation: You must delegate Full Control of the System Management container in Active Directory to your specific lab computer object (devsccmlab01$).

Why You Should Not Reuse Production OUs or Accounts

Reusing production Active Directory structures or service accounts for an SCCM lab introduces several technical and security issues:

Domain and Forest Boundaries: You mentioned that you joined your lab server to a dev domain controller (dev.example.com). If your production SCCM environment resides on a separate production domain or forest (e.g., prod.example.com), devsccmlab01 physically cannot access or use those production domain accounts because they belong to an entirely different directory database.
Active Directory System Management Conflicts: SCCM publishes critical, site-specific data (such as boundaries, site codes, and management points) directly to the System Management container in Active Directory. If you run a lab in the same forest as production and attempt to reuse containers or share service accounts, you risk severe site code overlaps, boundary conflicts, and production clients accidentally trying to register with your lab server.
Security and Least Privilege Risks: The sccm admin account used for setup requires highly elevated privileges, including Domain Admin, Enterprise Admin, and Schema Admin. Using production accounts with these levels of authority in a lab environment represents a critical security risk.

To keep your production environment completely safe and ensure your lab functions properly, you should follow the video's instructions to create a dedicated lab OU and fresh lab-specific service accounts on your development domain controller.