SCCM Advanced Security Settings

Just a quick post here...

I just found something that I would've thought that SCCM would do automatically but it doesn't, DCOM and WMI permissions. You need to set them manually on the site server for every user that has the administration console installed on their PC. For example, since I have the administration console installed on my PC to manage my two site servers, I need to give myself permissions in both DCOM and WMI on both site servers. Who would've guessed? The console will work ok without doing this, but I'm guessing it might work better after doing this? Follow the below to set the permissions...

DCOM

1. Go to Start -> Run and type dcomcnfg.exe
2. Select the console root and expand component services
3. Expand computers, then click My Computer
4. Click Action along the top, then Properties
5. Click the COM Security tab
6. In the launch and activation section, click Edit Limits
7. Click Add, and add a group that your SCCM administrators are a member of, or just add your username
8. Give that group or user you just added Local Launch and Remote Activation permissions

WMI

1. Go to Start -> Run and type wmimgmt.msc
2. Right click the WMI Control node, and click Properties
3. Select Security
4. Go to the SMS folder
5. Add the same groups as you did for DCOM and set allow for Enable Account and Remote Enable

Maybe by setting these, the Administration Console will be less buggy??

Enjoy