What Does Configuration Manager Mean?
On This Page
Quick Definition
Configuration Manager is a tool used by IT teams to manage many computers and devices from one central place. It helps install software, apply security updates, and make sure all devices follow company rules. Think of it like a remote control that can set up, update, and fix every computer in an office without having to visit each one. It works best for large organizations and is often used together with Microsoft Intune for cloud management.
Commonly Confused With
Configuration Manager is an on-premises or hybrid tool that manages devices from your own servers, while Intune is a cloud-only service that manages devices from Azure. They can be used together via co-management, but they are not the same. Configuration Manager gives you deeper control over OS deployment and third-party app packaging, while Intune excels at modern management with conditional access and mobile device management.
If you need to deploy a full Windows 10 image with custom drivers to a new laptop, you use Configuration Manager. If you need to enforce that users must have a PIN to access email on their phone, you use Intune.
Group Policy is a feature of Active Directory that applies settings to computers and users based on organizational units. Configuration Manager can also apply settings through configuration baselines, but it is more flexible and can target dynamic collections based on inventory data, not just static OUs. Group Policy does not handle software deployment as robustly as Configuration Manager, especially for complex packages or large environments.
Use Group Policy to set the desktop wallpaper and folder redirection for all users in the Sales OU. Use Configuration Manager to deploy a new accounting software that requires a SQL database and multiple configuration steps.
Windows Update for Business allows you to manage feature and quality updates directly from Microsoft's update servers using Group Policy or MDM policies. Configuration Manager gives you more granular control over which updates are approved, when they are installed, and allows you to deploy third-party patches. WUfB is simpler but less flexible.
Use WUfB if you only want to manage Windows quality updates and feature updates on a small set of devices. Use Configuration Manager if you need to also manage updates for Office, third-party applications, and drivers.
Must Know for Exams
The MD-102 exam, titled Endpoint Administrator, heavily emphasizes the coexistence of Configuration Manager with Microsoft Intune. Configuration Manager appears in several exam objectives, particularly under the 'Deploy and manage devices' and 'Manage security and compliance' sections. Understanding Configuration Manager is not optional; it is a core component because many enterprise environments still use it.
The exam tests how to plan and implement co-management, which is the process of attaching existing Configuration Manager devices to Intune. You will need to know the prerequisites for co-management, such as Azure AD hybrid join, and the steps to enable it via the Co-management Configuration Manager console. The exam also covers client deployment methods.
Expect questions about how to install the Configuration Manager client manually, via Group Policy, via software update point, or through client push installation. You must understand the differences and when to use each. Boundary groups are another frequent topic.
Questions often give a scenario where a client is not downloading content efficiently, and you must identify that the boundary group is misconfigured or that distribution points are not assigned. Software update management is tested heavily. You need to know how to configure the software update point, synchronize updates, create automatic deployment rules (ADRs), and deploy updates to collections.
Exam questions may ask you to troubleshoot why a specific update is not appearing or why a client is not reporting compliance. Task sequences for operating system deployment appear as scenario-based questions. You may be asked to design a task sequence that includes driver packages, application installations, and state migration.
The exam also tests compliance settings and configuration baselines. You might get a question where a device is non-compliant for BitLocker or Windows Defender settings, and you must identify which configuration item or baseline needs adjustment. The exam includes questions about content distribution, such as why a client cannot find a distribution point or why content is stuck in a distribution point status.
Overall, Configuration Manager questions in MD-102 are practical and scenario-driven. They test your ability to troubleshoot real-world issues, not just memorize steps. You must understand the flow from creating a package, distributing it to distribution points, creating an advertisement or deployment, and verifying client receipt.
Co-management is especially tricky because the exam expects you to know which workloads can be moved to Intune and the impact on Configuration Manager policies.
Simple Meaning
Imagine you work in a large office with hundreds of computers. Every computer needs to have the same antivirus software, the same word processor, and the same security settings. If you had to walk to each desk and install everything manually, it would take days or even weeks.
Configuration Manager is like a smart assistant that does all that work for you from a single computer at your desk. You tell it which software to install and which rules to apply, and it pushes those instructions out to every computer on the network. It can also make sure no one disables important security features or installs unauthorized programs.
The tool works by using a central server that communicates with a small program installed on each device. That small program, called the client, listens for instructions and carries them out, like installing a new update or running a security scan. You can schedule tasks to happen overnight so users are not interrupted during work hours.
Configuration Manager also keeps a detailed log of everything that happens, so you can see which devices are compliant and which ones need attention. This kind of automation is essential for keeping a large organization safe and efficient, because doing it all manually would be impossible. It is like having a conductor who leads every musician in an orchestra, making sure they all play the same song at the same time, without missing a beat.
Full Technical Definition
Configuration Manager, formerly known as System Center Configuration Manager (SCCM), is a Microsoft enterprise systems management solution that provides remote management, software distribution, patch management, operating system deployment, and compliance settings enforcement across a network of Windows, macOS, Linux, and mobile devices. It operates using a client-server architecture. The central component is the Configuration Manager site server, which hosts the site database, typically running on Microsoft SQL Server.
The site server manages all configuration data, software packages, and policies. Management points are site system roles that clients communicate with to discover settings and locate content. Distribution points store software packages and updates for clients to download locally, reducing WAN bandwidth usage.
Software update points integrate with Windows Server Update Services (WSUS) to synchronize and deploy patches. The Configuration Manager client agent is installed on each managed device and communicates with the management point via HTTPS or HTTP. Policies are delivered through machine or user policy polling, where clients check in periodically to retrieve assignments.
Clients evaluate policy and report status back to the site server through state messages. Configuration Manager supports boundary groups, which define network locations and help direct clients to the most appropriate distribution points. It uses a hierarchy model, allowing a central administration site to manage multiple primary sites, each with its own child sites, suitable for large distributed organizations.
Task sequences are used for operating system deployment, allowing automated build and capture processes. For modern management, Configuration Manager can be co-managed with Microsoft Intune, enabling a hybrid approach where workloads like compliance policies and device configuration can be shifted to the cloud while maintaining on-premises control for others. It integrates with Azure Active Directory for identity and with Windows Analytics for upgrade readiness.
Inventory collection, both hardware and software, is gathered regularly and stored in the site database for reporting and querying. Desired Configuration Management (DCM) evaluates compliance against baselines, such as requiring BitLocker encryption or specific firewall settings. Configuration Manager uses the Background Intelligent Transfer Service (BITS) for throttled content downloads and supports peer caching to reduce server load.
It also integrates with Windows Defender for endpoint protection management. In the context of the MD-102 exam, candidates must understand how to deploy the client, configure boundaries and boundary groups, distribute content, manage software updates, and implement co-management with Intune.
Real-Life Example
Think about a large hotel chain that has hundreds of hotel properties spread across different cities. Each property has a front desk computer, a housekeeping tablet, and a manager laptop. All these devices need to have the same booking software, the same antivirus program, and the same security settings.
Without a central management tool, the IT team would have to fly to each hotel or send technicians to update each device one at a time. Configuration Manager works like a central command center for that hotel chain. Imagine the IT manager sitting in the headquarters and clicking a button that says 'install the new booking system version 5.
2.' That command goes out to every registered device at every hotel. Each device receives the instruction and downloads the new software from a local distribution point, which is like a supply closet located at each hotel.
The installation happens automatically, often during the night when no one is using the computer. The next morning, every front desk clerk opens the same updated booking program. If a hotel in another city has a computer that did not get the update because it was turned off, Configuration Manager notes that and tries again later.
It also reports back to the IT manager, who can see a dashboard showing that 98 percent of devices are up to date. This whole process is similar to how a smart home system can lock all doors, adjust the thermostat, and turn off lights with a single command, but on a much bigger scale. The hotel chain saves time, money, and avoids security risks by using Configuration Manager to keep every device uniform and compliant.
Why This Term Matters
In any organization with more than a handful of computers, managing devices manually quickly becomes impossible. Configuration Manager matters because it provides a single pane of glass to control thousands of devices across multiple locations. This centralization saves enormous amounts of time.
Instead of an administrator spending hours visiting each workstation to install a critical security patch, Configuration Manager can deploy that patch to every device in minutes. That speed directly reduces the window of vulnerability to malware or ransomware attacks. Security compliance is another major reason.
Organizations must often follow regulations like HIPAA or GDPR, which require specific security settings on every device. Configuration Manager enforces these settings automatically and generates reports to prove compliance during audits. Without it, an administrator would have to manually check each machine, which is impractical and error-prone.
Cost savings are also significant. Automated software deployment eliminates the need for expensive third-party installation tools and reduces the number of IT staff required for routine tasks. Operating system deployment using task sequences allows organizations to refresh or replace computers quickly without manual interaction.
Configuration Manager also improves user productivity. Updates and software installations can be scheduled for off-hours so users are not interrupted. If a device breaks, a technician can reimage it remotely using a boot image from the network, getting the user back to work faster.
For the MD-102 exam, Configuration Manager is crucial because it is the foundation for on-premises device management. Candidates must understand how it interacts with Intune in a co-management scenario, because many organizations are transitioning to the cloud but still rely on Configuration Manager for legacy applications and deep control. Knowing Configuration Manager helps IT professionals design a realistic management strategy that balances on-premises control with modern cloud capabilities.
How It Appears in Exam Questions
In the MD-102 exam, Configuration Manager questions appear primarily as scenario-based multiple choice or case studies. A typical question might describe a company with 500 Windows 10 devices managed by Configuration Manager. The company wants to enable modern management using Microsoft Intune.
You are asked which prerequisites must be met before co-management can be configured. Answer options may include enabling Azure AD Hybrid Join, deploying the Intune client, or upgrading the Configuration Manager version. Another common pattern involves troubleshooting client communication.
For example, a client is not receiving policy updates. The question will list several possible causes, and you must select the correct one, such as that the client is not in a boundary group, the management point is unreachable, or the client certificate has expired. Software update questions often present a scenario where a critical security update is not being deployed to clients even though it appears in the console.
You must identify that the automatic deployment rule is not configured to run at the right time, or that the software update point has not synchronized with WSUS. Content distribution scenarios are also frequent. One question might show that a client cannot download a software package, and you must locate the issue: the client is in a boundary group that has no assigned distribution point, or the distribution point content is not validated.
Configuration baseline and compliance questions ask you to evaluate a device that is showing as non-compliant. You must determine which configuration item is failing, often related to a registry key or script. Some questions require you to interpret console screenshots.
For exam, a screenshot might show the state of a deployment and you must decide why it is stuck at 'In Progress' or 'Unknown.' The answer could involve the client not checking in, the distribution point missing content, or the deployment being set to a future date. Co-management case studies are particularly detailed.
You may be given a full company scenario with multiple sites, hundreds of users, and different device types. You must choose the correct co-management settings for each workload, such as whether to pilot Intune for compliance policies while keeping software updates in Configuration Manager. Questions may ask about transitioning from a legacy on-premises management to a modern cloud approach, requiring you to know which features Configuration Manager still handles better, like operating system deployment and third-party application packaging.
Study MD-102
Test your understanding with exam-style practice questions.
Example Scenario
Contoso Pharmaceuticals uses Configuration Manager to manage 1200 Windows 10 devices across three locations. The IT security team discovers a critical vulnerability in a commonly used business application. They need to deploy an emergency patch to all devices within 24 hours.
The patch is packaged as an .msi file. The Configuration Manager administrator, Priya, creates a new application in the Configuration Manager console. She sets the deployment type to point to the .
msi file on a network share. She then distributes the content to all distribution points located at each site so that clients can download the patch locally, avoiding slow WAN links. Priya creates a collection that includes all Windows 10 devices and deploys the application as 'Required' with a deadline of midnight.
She sets the deployment to run with administrative rights and allows installation outside of maintenance windows because this is a critical security fix. She also enables a notification that alerts users to save their work before the installation. By 6 AM the next morning, the console shows that 1150 devices have successfully installed the patch.
The remaining 50 devices are either turned off or offline. Configuration Manager will automatically retry the installation during the next client policy check. Priya can also send a wake-on-LAN packet to those powered-off devices if they support it.
If any device fails to install, she can look at the client log files, like AppEnforce.log, to see the error. This scenario shows the power of Configuration Manager in a real emergency.
Without it, Priya would have to manually visit each device or distribute a USB drive, which would take days. The automation ensures that the patch reaches almost every device within hours, drastically reducing the risk of a security breach. This scenario is exactly the type of question that appears in the MD-102 exam, where the candidate must understand each step from content distribution to deployment verification and troubleshooting.
Common Mistakes
Confusing Configuration Manager with Intune and thinking they are completely separate tools.
Configuration Manager and Intune are complementary. They can work together via co-management, and MD-102 expects you to understand that integration. Treating them as purely separate ignores the hybrid scenarios tested in the exam.
Remember that co-management allows you to attach your Configuration Manager deployment to Intune, shifting specific workloads like compliance or device configuration to the cloud while keeping others on-premises.
Forgetting to configure boundary groups when setting up a new site.
Without properly configured boundary groups, clients may not find the closest distribution point, leading to large downloads over slow WAN links or failed content retrieval. The exam frequently tests boundary group configuration as a cause for client issues.
Always create boundaries based on IP subnets or Active Directory sites, then assign those boundaries to a boundary group that includes the appropriate distribution points and site systems.
Assuming all clients automatically receive policy without checking client communication settings.
Clients must be able to communicate with the management point, and they need to be in a boundary group or configured for internet-based management. If the client cannot find a management point, it will never receive policy or deploy software.
Verify that the client is installed, that it can reach the management point via the correct port (usually 443 or 80), and that the client certificate is valid if using HTTPS.
Overlooking the need to configure a software update point and synchronize updates before deploying patches.
Many candidates think they can deploy updates immediately after installing Configuration Manager. In reality, the software update point must be configured, synchronized with WSUS, and then updates must be discovered before they can be deployed.
Go through the full setup: install the software update point role, configure the product and classification settings, synchronize with WSUS, then wait for the synchronization to complete before creating an automatic deployment rule.
Making the distribution point that do not have enough disk space for content packages.
When content distribution fails because the distribution point is full, administrators often troubleshoot network issues instead of checking disk space. The exam may present a scenario where content is pending distribution or stuck, and the answer relates to disk space.
Always monitor distribution point disk space and configure content validation to ensure the integrity of packages. Set up alerts for low disk space on distribution points.
Exam Trap — Don't Get Fooled
{"trap":"The exam often presents a scenario where a client is not receiving a required application deployment, and the answer options include 'the deployment is set to Available instead of Required' and 'the client is not in the collection.' Many learners choose the collection option because they assume the client is not targeted. However, the real cause is often that the deployment deadline has not yet passed, or the deployment is set to 'Available' which does not force installation."
,"why_learners_choose_it":"Learners focus on the immediate idea that if a client is not getting something, it must be because it was left out of the collection. They forget that a collection membership is checked first, but an 'Available' deployment only allows user-initiated install, not automatic install.","how_to_avoid_it":"Always check the deployment purpose first.
If the question says the application is listed in Software Center but does not install automatically, the purpose is likely 'Available.' If the question says the user never sees the application, then the collection membership might be the issue. Read the scenario carefully for clues about whether the user sees the deployment in Software Center or not."
Step-by-Step Breakdown
Plan and prepare
Before installing Configuration Manager, you must plan the hierarchy. Determine if you need a central administration site, primary sites, and secondary sites. Assess network bandwidth, server hardware, and SQL Server requirements. Also plan boundary groups to define network locations for clients.
Install site server
Install the Configuration Manager site server role on a Windows server with SQL Server. This creates the site database that stores all configuration data. You must use a service account with appropriate permissions. This is the core of the management infrastructure.
Configure site system roles
Add roles like the management point (clients talk to this), distribution point (stores content for clients), and software update point (connects to WSUS). Each role has specific prerequisites and must be installed on the right servers, ideally close to clients for performance.
Deploy the client
Install the Configuration Manager client on every managed device. This can be done via client push, Group Policy, manual installation, or a software update point. The client communicates with the management point to receive policy and download content from distribution points.
Create and distribute content
Create applications, packages, or software updates. Distribute the content to the appropriate distribution points so clients can download locally. This ensures fast and reliable content delivery without clogging the WAN.
Create collections and deploy
Create device collections based on criteria like operating system, IP subnet, or Active Directory OU. Deploy the content to these collections with a purpose (Available or Required) and a schedule. Clients will then apply the deployment as per the policy.
Monitor and maintain
Use the Configuration Manager console to monitor deployment status, client health, and content distribution. Regularly run reports to ensure compliance. Maintain the environment by updating the site, backing up the database, and checking distribution point health.
Practical Mini-Lesson
Configuration Manager is a powerful tool, but it requires careful planning and ongoing maintenance. One of the first decisions you make is the hierarchy design. In a small organization, a single primary site is enough.
For a large enterprise with many locations, you might use a central administration site that manages multiple primary sites, each with its own child secondary sites. This allows you to segment management and reduce replication traffic. Clients discover their assigned site based on boundaries.
Boundaries can be IP subnets, Active Directory sites, IPv6 prefixes, or IP address ranges. You must assign these boundaries to boundary groups, and then associate each boundary group with site systems like distribution points and management points. If a client falls into a boundary group that has no assigned distribution point, it will not be able to download content and will show errors in the console.
Content distribution is another critical area. When you create a package or application, you must distribute it to distribution points. The content is transferred using SMB or HTTP/HTTPS.
You can schedule content distribution to happen during off-peak hours to reduce network congestion. Distribution points can also be configured as pull-distribution points, meaning they don't wait for the site server to push content but instead pull it from another distribution point, which is useful for branch offices with limited connectivity. Client installation is often the first challenge.
The client must be installed with the correct site code and must trust the management point's certificate if using HTTPS. Client push installation requires the site server to have administrative access to the target devices. If those devices are not domain-joined or have different local admin credentials, client push fails.
In that case, you can use Group Policy to install the client or use a startup script. Once the client is installed, it starts to receive machine policy and user policy. The default policy polling interval is 60 minutes, but you can reduce it for critical deployments.
However, be careful because frequent polling increases server load. Software update management is often the most used feature. You configure the software update point to connect to Microsoft Update via WSUS.
You select which products and classifications to synchronize. After synchronization, updates appear in the console. You can then create automatic deployment rules (ADRs) that run on a schedule to approve and deploy updates.
ADRs are a huge time saver. For example, you can create an ADR that runs every second Tuesday of the month to deploy all critical security updates for Windows 10 to the 'All Windows 10 Workstations' collection. Co-management is the modern evolution.
By enabling co-management, you can start using Intune for some workloads while keeping others in Configuration Manager. This is ideal for organizations that are migrating to the cloud but are not ready to fully give up on-premises control. The MD-102 exam expects you to know the three ways to enable co-management: via the Configuration Manager console, via Azure AD enrollment, or via Intune automatic enrollment.
You also need to know which workloads are movable, such as device configuration, compliance policies, Windows updates, and endpoint protection. When a workload is moved to Intune, the Configuration Manager policies for that workload are no longer applied to the device. This can be a source of confusion if an administrator does not realize that a policy they set in Configuration Manager is being overridden by Intune.
In practice, professionals often use Configuration Manager for operating system deployment and third-party application packaging, while using Intune for mobile device management, conditional access, and modern device management. The two tools complement each other, and knowing how to integrate them is a key skill for any endpoint administrator.
Memory Tip
Think 'Config Man is the Backbone' – it handles the heavy lifting for on-premises management, while Intune handles the cloud front.
Covered in These Exams
Current Exam Context
Current exam versions that test this topic — use these objectives when studying.
Related Glossary Terms
A 2-in-1 laptop is a portable computer that can switch between a traditional laptop form and a tablet form, usually by detaching or rotating the keyboard.
The 24-pin motherboard connector is the main power cable that connects the computer's power supply unit (PSU) to the motherboard, supplying electricity to the motherboard and its components.
Two-factor authentication (2FA) is a security method that requires two different types of proof before granting access to an account or system.
A 3D printer is a device that creates physical objects by depositing layers of material based on a digital model.
5G is the fifth generation of cellular network technology, designed to deliver faster speeds, lower latency, and support for many more connected devices than previous generations.
The 8-pin CPU connector is a power cable from the power supply that delivers dedicated electricity to the processor on a computer's motherboard.
802.1Q is the networking standard that allows multiple virtual LANs (VLANs) to share a single physical network link by tagging Ethernet frames with VLAN identification information.
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
Frequently Asked Questions
Do I need to know Configuration Manager for the MD-102 exam if I only plan to use Intune?
Yes, you must know Configuration Manager because the MD-102 exam covers co-management and on-premises management. Many enterprises still rely on Configuration Manager, so the exam tests your ability to integrate both tools.
Can Configuration Manager manage devices that are not on the corporate network?
Yes, through internet-based client management (IBCM) or by using a cloud management gateway (CMG). The CMG allows clients on the internet to communicate with Configuration Manager via Azure without needing a VPN.
What is the difference between an application and a package in Configuration Manager?
An application is more modern and supports detection methods that check if software is already installed, while a package is legacy and simply runs a script or program. Applications also support dependencies and replacement relationships.
How often do Configuration Manager clients check for policy?
The default policy polling interval is 60 minutes. You can change it in the client settings, but frequent polling increases load on the management point.
What is a task sequence in Configuration Manager?
A task sequence is a multistep process that automates tasks like deploying an operating system, installing applications, and migrating user data. It is commonly used for OS deployment via PXE or media.
What happens if a client cannot contact the management point?
The client will not receive new policy or be able to download content. It will continue using the last policy it received. You can check the client's log files like CCMExec.log to diagnose communication issues.
Summary
Configuration Manager is a foundational tool for any IT professional managing enterprise devices, especially in environments that are not fully cloud-native. It enables automated software deployment, patch management, operating system imaging, and compliance enforcement at scale. While modern tools like Intune are gaining traction, Configuration Manager remains critical for deep control and legacy system management.
The MD-102 exam tests your ability to work with Configuration Manager both alone and in co-management with Intune. You must understand client deployment, boundary groups, content distribution, software update management, and configuration baselines. Common mistakes include confusing Configuration Manager with Intune, neglecting boundary groups, and not understanding the client communication flow.
To succeed in the exam, focus on scenario-based troubleshooting and the specific steps for enabling co-management. Configuration Manager is the backbone of on-premises endpoint management, and mastering it will serve you well in real-world IT roles and certification exams alike.