Any process or user that is able to write directly to the Configuration Manager database can modify existing objects in Configuration Manager (e.g. This blog identifies 8 best practices to make your Configuration Manager infrastructure secure and also reduce the scope and severity of accidents and operator error.ġ: Restrict access to the Configuration Manager DatabaseĬonfiguration Manager is the only thing that should be writing to the Configuration Manager Database.

These are all built in defenses against ‘man-in-the-middle’ type attacks, but securing the Configuration Manager infrastructure – especially the Site Server, which should be considered the ‘crown jewels’ – is also necessary to reduce the risk of unauthorized or malicious use from the core. Configuration Manager uses certificate-based signing of client policy, mutual certificate-based authentication of communication between clients and servers, and SHA-256 hashing for integrity-checking of content that has been downloaded before it is executed. It provides IT administrators and operators with visibility of desktop and server system configurations and the ability to change configurations, install software and security patches, execute any code on clients with elevated privileges and even replace or upgrade the operating system on hundreds of thousands of devices, all from a single management console.Īny system that has such power and reach in your environment needs to be protected from unauthorized or malicious use and, as far as possible, operator error and accidents.

Microsoft System Center Configuration Manager is an incredibly powerful tool.

Sccm configuration manager