System Center Mobile Device Manager 2008: Best Practices Analyzer Tool — Deployment Checklist

System Center Mobile Device Manager 2008: Best Practices Analyzer Tool — Deployment ChecklistSystem Center Mobile Device Manager (SCMDM) 2008 was Microsoft’s on-premises solution for managing Windows Mobile devices at scale. While SCMDM is an older product, organizations that still run it or manage legacy devices benefit from ensuring deployments follow proven configuration, security, and operational practices. The Best Practices Analyzer (BPA) tool for SCMDM 2008 helps identify common configuration issues, missing prerequisites, and deviations from recommended settings. This article provides a detailed deployment checklist organized around preparation, installation, configuration, validation, and ongoing maintenance — using the BPA tool at key steps to reduce risk and improve reliability.

Why use the Best Practices Analyzer (BPA)

The BPA automates checks against Microsoft-recommended configuration rules.
It identifies missing dependencies (roles, features, services, patches).
It highlights potential security, performance, and scalability issues.
Running the BPA before, during, and after deployment helps catch misconfigurations early and documents remediation steps.

Preparation

1. Inventory and scope

Inventory existing Windows Mobile devices, OS versions, and firmware.
Identify which device groups will be managed by SCMDM 2008.
Catalog servers and network components that will host SCMDM roles (management server, database server, OTA servers, Active Directory integration points).
Determine high-availability, disaster recovery, and scalability requirements.

2. System requirements and prerequisites

Verify server hardware and OS versions meet SCMDM 2008 requirements.
Confirm supported SQL Server version for the SCMDM database.
Ensure Active Directory schema and forest functional levels are compatible.
Verify required Windows roles and features (IIS, ASP.NET, etc.) are present or prepared for installation.
Confirm network requirements: firewall ports, NAT/DMZ configuration, DNS records, and certificates for secure communications (PKI if used).

3. Patch and update baseline

Build a baseline: fully patch OS and SQL servers to supported service pack and update levels.
Apply any vendor firmware updates to managed devices where feasible (test first).
Obtain the latest SCMDM 2008 service packs/hotfixes from Microsoft; plan their deployment.

4. Backup plan and rollback strategy

Ensure backups for SQL databases and system state are in place.
Create snapshots or backups of critical servers before major changes.
Document rollback steps if deployment or updates fail.

Installation and initial configuration

5. Install required services and roles

Install IIS and required role services (ASP.NET, Windows Authentication, etc.).
Install .NET Framework and other prerequisites per SCMDM documentation.
Configure IIS with recommended application pool settings (identity, .NET version, recycling).

6. Database setup

Install and configure SQL Server instance with recommended collation and service accounts.
Create and configure the SCMDM databases with proper file placement and sizing strategy.
Grant required permissions to SCMDM service accounts.

7. Install SCMDM components

Install the SCMDM management server and configure it to use the SQL databases.
Install other SCMDM roles (OTA server, enrollment server, certificate server integration) according to design.
Configure service accounts with least privilege: separate accounts for administration, application pool identities, and database access.

Using the BPA during deployment

8. Run BPA before finalizing installation

Run the Best Practices Analyzer immediately after installing core components but before opening production enrollment.
Address high- and critical-priority findings first (missing services, misconfigured permissions, certificate problems).
Track remediation steps and re-run BPA until major issues are resolved.

9. Common BPA checks to prioritize

Service and process checks: Ensure SCMDM services are running under intended accounts.
IIS and web application checks: Authentication modes, SSL bindings, certificate validity.
Database connectivity and permissions: Verify the SCMDM server can connect to SQL and perform expected operations.
Active Directory integration: Confirm group policy links, permissions, and user/device object creation rights.
Patch level and hotfix verification: Ensure required updates are installed.

Configuration best practices

10. Security hardening

Use SSL/TLS for all server-to-device and server-to-server communication; use valid PKI certificates.
Enforce strong service account passwords and rotate them periodically.
Isolate management servers in a secure network segment; limit access via firewall rules and jump boxes.
Follow least-privilege for accounts and disable interactive logon where not needed.

11. Enrollment and authentication

Test enrollment flow end-to-end with representative device models and OS versions.
Configure enrollment policies and templates for different user groups (corporate, contractor, kiosk).
Integrate with Active Directory appropriately; consider using certificate-based authentication for automated enrollment.

12. Policy and configuration management

Create baseline device policies for security settings (password complexity, encryption, lock timeout).
Use configuration groups to apply policies selectively and test changes in a staging group before broad rollout.
Document policy rationales and expected device behavior.

13. Scalability and performance tuning

Review BPA recommendations for resource allocation (CPU, memory) and database file placement.
Configure SQL Server maintenance plans: index maintenance, backups, and growth settings.
Load test with representative enrollment and management operations to validate throughput.

Validation and testing

14. Functional testing

Validate enrollment, policy push, remote wipe, inventory collection, and application deployment.
Test certificate enrollment and renewal processes.
Verify reporting and audit logs capture expected events.

15. User acceptance testing (UAT)

Run a UAT phase with pilot users covering varied device types and usage patterns.
Collect feedback on enrollment UX, policy side effects, and app availability.
Adjust policies/presets based on real-world results.

16. Run BPA post-deployment

Run the Best Practices Analyzer after pilot and again after full production roll-out.
Address any remaining warnings or informational items where feasible.
Keep a record of BPA runs and remediation actions as part of change management documentation.

Ongoing maintenance

17. Patch and update management

Subscribe to Microsoft advisories for SCMDM and related components; apply security updates promptly.
Test patches in a staging environment and re-run BPA after updates.

18. Monitoring and alerting

Monitor SCMDM services, SQL health, disk space, and certificate expiry.
Configure alerts for critical conditions (service down, DB inaccessible, enrollment failures).

19. Regular BPA cadence

Schedule BPA runs quarterly or after significant changes (patches, configuration changes, new device types).
Treat BPA as part of the standard audit checklist.

20. Documentation and change control

Maintain runbooks for enrollment, certificate renewal, backup/restore, and disaster recovery.
Record configuration baselines and track deviations.
Use change control for policy updates and major system changes.

Common issues and remediation examples

Issue: Enrollment fails due to certificate trust errors. Remediation: Verify PKI chain, install intermediate CA on devices/servers, ensure certificate templates and validity periods meet SCMDM expectations.
Issue: SCMDM cannot connect to SQL. Remediation: Check firewall, SQL service status, network connectivity, and service account permissions; verify SQL Browser/configured ports.
Issue: Policies not applied to devices. Remediation: Confirm device is in correct configuration group, check device communication logs, and ensure policy size/complexity is within supported limits.

Checklist (quick reference)

Inventory devices and servers — done
Verify OS/SQL/AD prerequisites — done
Patch baseline applied — done
Backups and rollback plan — done
Install IIS/.NET and SQL — done
Configure SCMDM roles and service accounts — done
Run BPA and remediate critical findings — done
Configure SSL/PKI and security policies — done
Pilot/UAT enrollment and testing — done
Run BPA post-deployment and schedule regular runs — done
Implement monitoring, maintenance, and documentation — done

The Best Practices Analyzer is a practical tool to validate your SCMDM 2008 deployment against Microsoft recommendations. Use it at multiple stages: pre-deployment, during rollout, and in production maintenance. While SCMDM 2008 is legacy software, following this checklist reduces downtime, strengthens security, and improves manageability for any remaining deployments.