Below are some procedures for excluding SQL database engine instances, SQL databases and SQL Agent jobs from discovery and/or monitoring. To exclude these components from monitoring, we need to:

1. Override the Object Discoveries
2. Delete any existing discovery data

1. DB Engine Instances:

If you want to exclude specific DB Engine instances by name then one or more overrides can be applied to the “Discover SQL 2005 Database Engines (Windows Server)” (SQL 2005) or “Discover SQL 2000 Database Engines (Windows Server)” (SQL 2000) discoveries to provide an “Exclude List”.

Exclude List is a comma-delimited list of SQL DB Engine instance names as shown in figure 1 below. If you want to exclude whole servers entirely from having their DB Engine instances discovered then you could right-click on the discovery select “Overrides” -> “Disable the object discovery” -> “For a specific object of type: Windows Server” and select the systems they want excluded.

Figure 1 Override for Exclude List on “SQL 2005 Database Engine”.

2. SQL Databases:

The process for SQL databases is quite similar to that of the SQL DB engine. One or more overrides can be applied to the “Discover Databases for a Database Engine” (SQL 2005) or “Discover SQL 2000 Databases” (SQL 2000) discoveries to provide an Exclude List which is a comma-delimited list of DB names to exclude, which is shown in figure 2 below.

Likewise if you wanted to exclude whole SQL DB engine instances from having their databases discovered then they could right-click on the discovery select “Overrides” -> “Disable the object discovery” -> “For a specific object of type: SQL 2005 DB Engine” and select the DB Engine instances they want excluded.

Figure 2 Override for exclude list on “Discover Databases for a Database Engine”.

3. Long Running Jobs:

There are two (technically three) ways this monitoring is provided: On a per-SQL agent basis (SQL 2005 only) and on a per-job basis (SQL 2000 and SQL 2005).

On a per-”SQL agent instances” basis (SQL 2005 only):

This is the only monitoring that is “turned on” by default and it’s only provided in the SQL 2005 MP. I put turned on in quotes because all of the monitors are enabled but the job specific monitors are targeted at classes which are not discovered by default in the MP. The behavior of this monitoring is that every so often a script runs against each SQL agent and identifies of all the jobs that are run by that agent, what the duration of the longest job was. That value is then compared against the threshold (defaults to 120 minutes) and an alert is raised is the threshold is exceeded.

So regardless of how many jobs are hosted on an instance of SQL agent, if one or more of them deviate from the threshold then an alert will be raised for the given SQL agent by the “Long Running Jobs” monitor. Exclusions here are handled by standard overrides on the “Long Running Jobs” monitor as shown in figure 3 and should consist of instances of the “SQL 2005 Agent” class.

On a “per-job basis” (SQL 2000 and SQL 2005):

This monitoring is available in both the SQL 2005 and SQL 2000 MPs via the “Job Duration” monitor associated with the “SQL 2005 Agent Job” and “SQL 2000 Agent Job” classes respectively. In order to get this monitoring the user needs to enable the discovery of individual jobs, which can be done via overrides on the “Discover SQL 2000 Agent Jobs” and “Discover SQL 20005 Agent Jobs” object discoveries. Once jobs are being discovered, then each job will have this monitor associated with it. The behavior of the monitor is rather straight forward in that it looks at the most recent duration for a given job and will evaluates that duration against two values; a lower threshold and an upper threshold. If the duration is below the lower threshold then the state of the monitor for that job is set to green. If the duration is above the lower and below the upper then state is turned to yellow/warning. If the duration exceeds the upper threshold then the state changes to red/error.

Exclusions for the “Job Duration” monitor would be done via standard overrides to that monitor, providing a list of “SQL 2005 Agent Job” or “SQL 2000 Agent Job” instances that the override would apply to.

Figure 3 Configuring overrides on the “Long Running Jobs” monitor for specific SQL 2005 agent instances.

To Delete Discovery Data

Instructions for deleting discovery data using the remove-disabledmonitoringobject cmdlet can be found HERE.

Savision Maps just announced version 2.0 of their popular add-on for Operations  Manager 2007. I spent some time with these guys at MMS learning about their product. The product and it’s architects are brilliant for. I wish MS would just write these guys a big check and integrate this functionality into SP2!

Announcement: 

After a successful launch of Live Maps 1.0 for Operations Manager 2007 we are proud to announce Live Maps version 2.0. Live Maps 2.0 comes with a number of new features that enable you to get even more out of your System Center Operations Manager investment.

So what’s new in Live Maps 2.0?

• Web console - share your maps over the web
• Audible alarms - never miss a critical alert anymore
• Improved performance - solve your problems faster
• New editions and prices - more value for money

Live Maps 2.0 is available for download today and will be on display at the Teched IT Pro in Orlando (booth 1530). The new features can also be watched in this webcast.

Kind Regards,

Douwe van de Voort & Dennis Rietvink, Founders

When CPU and memory resource consumption are running at or near 100%, the first thing an administrator wants to check is what processes are running at the time the excess resource consumption took place. The problem is that by the time you can get to a machine and retrieve a list of running processes, the condition has improved and the evidence gone.

This problem can be easily overcome in Operations Manager or Essentials 2007 using a new feature called a diagnostic to automatically perform data collection tasks at the time a condition is encountered. However, you will not find the appropriate diagnostic in place out of the box.

The diagnostics in this sample Retrieve Running Processes MP (link provided at the end of this article) , which automatically retrieve a list of running process the moment the alert threshold is breached, ensure the offending process information is captured. Simply download and import into your environment to make immediate use of this feature (no configuration required).

If you are looking in the Management Packs area of the Administration name, you will see the name of this sample MP is named Custom Diagnostics and Recoveries, which is so named so as to allow you to save your own diagnostics you create to this MP. The monitors shown in figure 1 represent the monitors in the Windows 2003 Base OS Management Pack that will alert when CPU and/or memory utilization break MS recommended thresholds.

How it Works

This management pack creates a diagnostic on each of the five monitors in the Windows 2003 Base OS Management Pack (shown in figure 1) that automatically dumps a list of running processes on the target machine when the threshold of the monitor is breached. The output can then be viewed in the Health Explorer for the target machine for the monitor in critical condition, as shown in figure 2. The settings of the diagnostic itself can be seen on the Diagnostics and Recoveries tab of the monitor.

Figure 1 - Monitors affected by diagnostics in the Retrieve Running Processes Sample MP. 

Figure 2 - Output of the Retrieve Running Processes Diagnostic

Settings of the Dump Process Diagnostic

The dump process diagnostic is configured with the following characteristics:

• Executes when the monitor is in a critical state
• Executes automatically
• Executes tasklist.exe to dump the list of running processes.

Figure 3 - Retrieve Running Processes Diagnostic Settings(1)

Figure 4 - Retrieve Running Processes Diagnostic Settings(2)

Conclusion

Hopefully this has increased your awareness of the usefulness of diagnostics in Operations Manager 2007. Download the Retrieve Running Processes Sample MP HERE:

Have a cool script, MP or other System Center Solution you’d like to share? Submit an entry in the System Center Solutions Contest for a chance to win an Xbox, Zune 2 and other great prizes! Visit the System Center Virtual User Group website for more information today!

There is a new MP added to the downloads section called Alert on Pending Actions that create an alert when there is a pending action in the Ops Mgr 2007 Console. The script that performs the SQL query is “parameter free” and is scoped to run from the Root Management Server only. The MP contains a rule to run the script and another rule to alert on a specified event.

You can find the download here.

On any Operations Manager administrators daily to-do list should be alert review and rule tuning.

Effective alert tuning means that every alert should ideally have its place. This does not always work out, but you definitely want to have a bucket for classifying most common possibilities. Generally this is done with custom alert resolution states (only NEW and CLOSED exist by default).

The underlying philosophy is that consistent evaluation of alerts, and appropriate disposition leads to 1) a higher percentage of actionable alerts over time, 2) remediation of lingering service issues in the environment and 3) greater respect for Operations Manager and the importance of the monitoring function by IT support staff and service owners 4) and theoretically, better tuned (and thus better performing) IT services.

Here is an example of a very basic, yet effective system for daily processing alerts. For each active alert:

1. Resolve alert if condition no longer exists (transient failures)
2. Remediate the issue represented in the alert
3. Escalate to next support tier or SME (using custom resolution state)
4. Tune the source rule or monitor as appropriate if the alert is not actionable. This may involve threshold or disable overrides.
5. Bug - I have a custom resolution state I use flag potential bugs to investigate and/or report back to MS.
6. Other - Some alerts I have to flag with a resolution state for later investigation on my part, such as with runtime script failures.

Some organizations use custom resolution states to assign alerts to service owners or teams (e.g. - a resolution state of ‘Assign to Exchange team’). This is fine, but at the end of the day, this method does not prompt immediate action from the service administrator - and let’s face it, occasionally a more direct approach is warranted.

That’s why I love the Alert Forward Task MP (from Cameron Fuller), which is the MP that allows you to forward an alert via e-mail to an address you supply when you launch the task.

I have modified the version I use just a bit. I modified the script to include Please Investigate: in front of the alert name in the subject line. The From: address is a shared mailbox for the Opsmgr admin team. When I find a legitimate alert that needs to be investigated (particularly one that has been ignored or missed by service administrator for several days, weeks or months), I simply click the forward alert via e-mail task and send a friendly reminder. (Hey, what’s up? It’s me. You know, that alert you’ve been ignoring?)

I find this action always launches discussion, and frequently leads to collaboration between myself and the service administrator, and often quick resolution of important issues. If you don’t use custom resolution states and the Alert Forward Task MP today, I definitely encourage you to consider how these tools can improve both the effectiveness of your monitoring initiatives and have a positive impact the quality of your IT service delivery.

For my own reference, I put together a collection of several of the original and known functional maintenance mode scripts, utilities and MPs.

Revisions:

• 5/7/2008 - Added link to Andrzej version of group maintenance mode that provides up to 10 maintenance schedules through the rules in the console UI.

1. Put a computer in maintenance mode - To truly silence an agent management computer, you must put the computer, health service and health service watcher in maintenance mode. This script does exactly that. Boris put some Powershell together to make that happen, and then Timothy quickly packaged it into a .ps1 file with the appropriate connection string.

Get the classic maintenance mode Powershell script HERE.

2. Put a group of computers in maintenance mode - Putting a group of computers into maintenance mode is an obvious timesaver. Timothy McFadden put a nice script together to put a group of computers into maintenance mode, and Boris created a similar script several months later.

• Get Timothy’s group maintenance mode script HERE.
• Get group maintenance mode, Boris flavor HERE
• However, Brian Wren’s treatment of group maintenance mode (wrapped in an MP) is not to be missed when you’re learning about maintenance, Powershell or MP authoring. Check it out HERE.
• May 7th, 2008 - Andrej posted an updated version of Brians MP that allows up  to 10 maintenance mode schedules for groups of computers, configurable through the UI. It can be found HERE.

Target this to the ‘Agent Managed Computer Group’ and you can put just about everything Windows into maintenance mode all at once.

3. Put an object type (other than a computer) in maintenance mode - This puts an instance of any object type you specify into maintenance mode. This allows you to put an object, such as a web application, into maintenance mode while monitoring of the computer and its other components remains active.

See the code snippet for maintenance mode for any object class HERE or HERE.

4. AgentMM Command Line Utility - Written by Clive Eastwood, this command line tool puts Ops Mgr 2007 agents into maintenance mode (all 3 object classes necessary).

 Download Clive’s tool HERE.

5. Putting agents in maintenance mode remotely - Andrzej has a nice walkthrough incorporating Clive’s AgentMM.exe maintenance mode CLI tool for a scheduled batch job or ad-hoc execution.

Find a description and link HERE.

We revealed to you shortly after SP1 that the MOMCertImport tool had a new GUI, which is used to read the certificate serial and write it to the registry so the Health Service knows which certificate to use. But what if we told you that exporting the certificate was no longer necessary?

That’s right! The MOMCertImport tool now actually reads certificates right out of the certificate store. And in our tests, the MOMCertImport UI only displays certificates capable for use in certificate authentication. If you export your cert and delete from the store, and then launch MOMCertImport, the UI comes up empty.

This is great for two reasons - 1) We know longer risk export of the certificate private key to disk and 2) Fewer steps in implementation (which is positive for TCO).

——————

Has your brilliance gone unrecognized? Why not show off your System Center skills? Check out the System Center Solutions Contest now in progress at the System Center Virtual User Group for a chance to win an Xbox 360, Zune 2 or other great prizes.

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

Occassionally, a resource comes along that changes my operational processes (for the better) with regard to Operations Manager 2007. I think this is one of them.

Silect started with the release of MP Studio Lite for free MP reporting and browsing. I’m already using this to explore my unsealed MPs where I store overrides.

Now, the Silect Software team has done it again! The group created a Wiki with MP reports on the various MP versions. Additionally, they have zip file downloads illustrating the differences between MP versions. Very convenient to be sure.

Check it out at the URL below:

http://www.silect.com/wiki/doku.php?id=mps:latestreleasedmps

It is a few days later than we would have liked, but the System Center Solutions Contest is officially underway. By submitting your custom scripts, add-ons and other solutions for any System Center product, you can win great prizes including an Xbox 360!

But you better get started. Deadline for entry is June 20^th, 2008! For more information, visit the links below!

Contest Homepage

http://www.systemcenterusergroup.com/content/ContestHome.aspx

Official Contest Rules

http://www.systemcenterusergroup.com/content/SCVUGContest.aspx

Contest Support Forum

Questions about the contest?  Ask them here!

http://www.systemcenterusergroup.com/forums/19.aspx

Thanks again to our contest sponsors: Savision, Redynamics, Inovativ and AKOS Technology Services!

A few weeks ago here on System Center Forum, I descibed (at least in part) the role of Operations Manager 2007 in virtualization initiatives.

Recently, I ran across a good deep dive on how Quick Migration (Hyper-V) and Vmotion (VMware) actually work under the hood I think will be of interest to many of you.
While the technical bits in these articles are great, take the business case in part 2 with a grain of salt. While Vmotion definitely has the advantage over Quick Migration in terms of downtime, I think one could plausibly develop some alternate strategies for maintaining high availability at the application layer that could offset some or all of the disadvantages of Quick Migration shown in the scenario described.

• Vmotion versus Quick Migration - Part 1
• Vmotion versus Quick Migration - Part 2

As you may be aware, Virtual Machine Manager 2008 beta was announced at MMS. VMM 2008 provides management of not only Hyper-V and VS 2005 R2, but VMware ESX as well. With this release and the Operations Manager 2007 integration with VMM, it is clear MS plans to fight its next battles in the virtualization war on the front-end, providing effective management tools with broad heterogeneous management capabilities.

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

When installing the Xerox CentreWare MOM 2005 MP on a management server, it will require a SQL database and login to create two databases to support discovery and configuration. The setup program uses the DTSRUN executable to create the required databases and default configuration required by the discovery program.

Where you might run into issues is when the SQL service specified during setup is on a remote server. I ran into this issue recently and I wasn’t able to get much information because the DTSRUN command window(s) were flashing on/off the screen too fast. The resolution to my issue was installing the SQL 2000 client component prior to installing the Xerox MP.

Here were some of the week’s highlights for me personally:

I presented for the first time at MMS this year in a session on the Gateway Server Role in Operations Manager 2007. There were lots of questions after the session, as well as some requests for details on the order of operations in the Gateway demo, which will spark some additional blogging on Gateway bits that are as yet largely unknown.

My co-presenter, the brilliant Ian Jirka (pronounced Yerka) from the Opsgmr Product Team at MS, fell ill and was unable to present, but kindly still came to answer questions.

Introductions

I met some of my fellow Opsmgr enthusiasts from the community, including Derek Harkin, Scott Moss and Kevin Holman.

Partner Announcements

The really big announcements for the week were really the Cross-platform monitoring for Opsmgr and VMM 2008 beta, for which I’ve provided some details below.

The announcement I thought was most promising was the one by Solarwinds of the Orion Management Pack for System Center Operations Manager 2007 and System Center Essentials 2007. The Orion Management Pack will be available at no charge and will connect SolarWinds’ Orion network management platform to Microsoft System Center products. I was beginning to wonder if they were going to provide an equivalent to the MOM 2005 version.

Ian Blyth put some details together on the partner announcements if you want to read through the list HERE.

Cross-platform Monitoring

Native cross-platform monitoring was announced officially at the Tuesday keynote. The following are the planned supported platforms:

• HP-UX 11i v3 PA-RISC
• HP-UX 11i v3 IA64
• Red Hat Enterprise Linux 5 Server
• Solaris 10 SPARC
• Solaris 10 x86 
• SUSE Linux Enterprise Server 10 SP1

NOTE:  I think the underlying architecture is still NDA, but let me just say, you will be impressed - and I think *IX administrators will be too!

Follow events as they develop at the Opsmgr Cross-platform Team Blog.

Virtual Machine Manager 2008

Virtual Machine Manager 2008 has the same look and feel as the VMM 2007 but under the hood the are some significant changes, specifically the ability to manage not only Virtual Server 2005 R2, Hyper-V and VMware ESX.

If you’re not familiar with Performance and Resource Optimization (PRO), which provides integration with System Center Operations Manager 2007 to address alerts from hardware, operating systems and applications allowing for dynamic rebalancing of virtual machine resources using knowledge-based policies and rules.

PRO leverages the Operations Manager framework. This makes Operations Manager 2007 a mission critical component of a heterogeneous environment for virtualization.

That’s all for now….more highlights a bit later.

If you’ve ever had trouble implementing the Gateway Role in Operations Manager 2007, questions about when and where to use a Gateway role or wanted a good process for troubleshooting Gateway issues, then this is your session.

I worked on this session with a key member of the product team (identity concealed until the session) who knows more about this role than almost anyone. Material covered in this session will include information never before revealed anywhere. And I mean ANYWHERE. Not in product documentation, not in my favorite book, Operations Manager 2007  Unleashed.

Perhaps Microsoft felt the secrets were just too powerful? I guess you’ll just have to come and find out for yourself.

I look forward to seeing you there!

Kuala Lampur is a long way from the States, but you can catch the highlights online via the blog of  Opsmgr MVP, Raymond Chou of Malaysia, who is blogging on his Operations Manager experience from Malaysia at http://mymomexperience.blogspot.com/.

Raymond is someone with great insights into the product and the process for whom I have a great deal of respect. Definitely one to bookmark.

While you’re there, check out his run through of System Center Interop Connectors from MMS 2008.

Question: How can I verify my device supports SNMP, and test device response before using in Operations Manager 2007 or Essentials 2007?

Answer: There are a number of resources you can use to detemine what version of SNMP your device supports. You’ll need device IP and SNMP community string.

Checking SNMP version support

You can verify verify a device supports SNMP version 2c with the open source snmpget utility, which is part of the net-snmp tools. Download snmpget.exe and the accompanying mibs.zip file from the following URL and unzip to a local directory. Download URL: http://www.elifulkerson.com/articles/net-snmp-windows-binary-unofficial.php

If you are not successful discovering your target network device, verify your device supports SNMP version 2c. To check, you’ll need the SNMP community string for your device, and the IP address with that of your target. Remember to replace IP and community string in the command below with those applicable to your environment.

snmpget -v2c -M D:\utilities\mibs -c public 192.168.240.250 1.3.6.1.2.1.1.1.0

Assuming the device has the required SNMP support, you should see output similar to the following:

SNMPv2-MIB::sysDescr.0 = STRING: 24-Port 10/100/1000 Gigabit Switch w/WebView

Note that the output will very by the device you are querying, change -v2c to -v1. If you still get no response, verify the criteria above and check with the device manufacturer to ensure your network device has the required SNMP support.

Reading the mib

I get the mib from the hardware vendor. I then use MIB Browser 1.0 to view the OID tree. MIB Browser can be found here.
http://www.freedownloadscenter.com/Network_and_Internet/Network_Management_Tools/MIB_Browser_Download.html

If vendor cannot be reached

If the vendor cannot give me a mib, I check mibdepot.com to find the MIB for my device.
www.mibdepot.com

Polling a device for expected response

I then use bpsnmputil GUI utility to perform a get on the OID to make sure it returns values as expected.
http://www.bestsoftware4download.com/download/t-free-bpsnmputil-download-gvymodba.html

I occassionally also use the snmpwalk utilities, which is part of the same tool set as snmpget.

Silect Studio has delivered for the Operations Manager community in a big way with MP Studio 2007 Lite, a scaled down version of MP Studio designed primarily for MP reporting (in HTML format). Much needed add-on for the Operations Manager community.

Did I mention it’s free?!

Download at the URL below and request your license

http://www.silect.com/downloads/MPStudio2007Lite.zip

By now you’ve likely heard that native cross-platform monitoring in SP2. SP2 will mark the beginning of Operations Manager 2007 as  a true multi-platform monitoring solution out of the box. With a nice dashboard and continued improvements in the connector space, I think we’ll have a winner here.

While I can’t reveal all due to NDA, I will say I believe Linux and UNIX admins will be surprised and pleased with the route the team has chosen to implement the solution.

To keep up with the latest on the xplat changes, follow the Opsmgr cross-platform blog at http://blogs.msdn.com/scxplat

 .

Even with the keynote still in progress, good things are coming from the face-to-face contact with fellow System Center community members at MMS 2008.

After a lengthy discussion last night, some members of the System Center User Group decided to launch a community development effort to develop a proper, model-based File System Management Pack for Operations  Manager 2007. The group is asking for your input into the design phase of the effort.

Read more and offer your feedback on the System Center User Group site HERE.

There is another addition to the downloads section that will check the availability of a DNS server by running a "nslookup" type test.  This MP uses a 3rd Party DLL called Simple DNS Resolver to make the DNS calls.  The VBscript that is included in this MP will test a FQDN using the nameservers specified and compares it to an IP address that is supplied as well.   Not only can you really test the availability of the target DNS service, you can also use it to verify that a DNS record is returning the proper IP address.

After importing the MP, you can view the sample rules by changing the scope of the Rules view in the Authoring pane to Management Server.  The two rules to look for is called DNS Check - Example and DNS Check Failure.  The DNS Check - Example contains the script that will check DNS availability and the DNS Check Failure rule checks for the event IDs logged by the DNS Check - Example rule.

You can download the Simple DNS Resolver from the author’s site at kartmann.org and you can download the sample MP located in our Downloads section called DNS Check MP.

I am flying in for the big show in the morning. Very excited to meet many of you in person for the first time. I’ll be in the community session briefly on Tuesday, presenting in a session on the Operations Manager Gateway role and Mutual Auth Friday morning, and in various Q & A capacities in the in between times as well.

 Remember, what happens in Vegas, stays in Vegas - usually ;)

See you  there!

I’ll be in Chicago from May 13th - 16th delivering the Operations Manager 2007 bootcamp.  The class is almost full, but there are a couple of seats left. I’d love to see some of my community friends join us for a deep dive into my favorite enterprise monitoring platform.

• For course syllabus, click HERE.
• For a list of dates and cities, click HERE.
• To request registration, click HERE.

See you at MMS 2008!

It’s not unusual for administrators to use rules in Opsmgr to monitor for significant configuration changes of concern in regulatory compliance, but this is generally not the most effective way to address the problem. ACS is a great tool for auditing significant security events in a variety of scenarios, but when trying to audit for “shift and drift” configuration changes related to compliance-related baselines, it is not a panacea.

That is where the sister product of Operations Manager, System Center Configuration Manager 2007, plays a role in augmenting ACS in the auditing process. I’d mentioned here on System Center Forum in the past that the Desired Configuration Management (DCM) feature of SCCM 2007 is perhaps the most significant addition to the MS systems management platform (read “Intro to DCM in SCCM 2007“). And now, there is a Security Compliance beta for SCCM that delivers configuration management functionality.

So you can catch configuration changes with DCM, and then leverage ACS reporting to put the paper trail together to prove who accessed the machine(s) when the change(s) were made.

While the final plan for integration between System Center offerings is not complete, I think the picture is getting clearer all the time. I expect at MMS 2008, we’ll hear a bit more about the integration road map.

Where to get the SCCM Security Compliance Beta: 

Beta Download Available: http://www.microsoft.com/securitycompliance. Feedback welcome!

Description: 

The Security Compliance Management toolkit provides customers with best practices from Microsoft about how to plan, set, get and remediate a security baseline, along with tools that you can use to verify the implementation of recommended security baselines from Microsoft for Windows Vista, Windows XP SP2, and Windows Server 2003 SP2.

The toolkit helps customers quickly and easily provide this compliance information to auditors to demonstrate how their organization is meeting important compliance regulations.

The toolkit helps customers manage the compliance process by enabling:

• Automated security checks in their environment.

• Verification of security baseline in their environment, and identification of baseline settings changes or “drift” from prescribed values.

• Implement regulatory compliance through security checks.

The verification process is performed by Configuration Packs that can be applied using the desired configuration management (DCM) feature of Microsoft® System Center Configuration Manager 2007

This book is REALLY big. And for the beginner to intermediate Operations Manager administrator, that is a good thing. Clearly this is the book by which all other Operations Manager 2007 books should be measured. I’d say this one compares quite favorably to the other option on the market

Haven’t yet ordered your copy? Amazon has great pricing and fast shipping on Operations Manager 2007 Unleashed!

There is a new MP added to the downloads section that will monitor file shares on a Windows Server.   The MP is designed to discover any file shares on the server (not including the hidden $ shares) and monitor the availability of the shares.  The monitors are initially disabled so you will need to override the monitor to activate it. 

We would like to thank and credit Jaime Correia for creating this MP and sharing it with Systemcenterforum.org!

You can retrieve this MP from the downloads section or from here.

I just don’t have the patience to wait for software deployment. As my grandpa used to  say, “Lord give me patience, but I want it right now!”

But did you know it’s possible to force near immediate software deployment to agent managed computers with Essentials 2007?

1. Go to the Software space 

2. Set a deadline date in the past for the program package.

3. Run the command “wuauclt /detectnow” on the client machine.

To check for success: 

To check that the client recognizes the package install request, check the System Event Log for event ID: 18, as shown below:

Event Type: Information
Event Source: Windows Update Agent
Event Category: Installation
Event ID: 18
Date:  4/23/2008
Time:  12:06:20 AM
User:  N/A
Computer: XP
Description:
Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on Wednesday, April 23, 2008 at 12:06 AM:
- MS GIF Animator

I have created a MP that will check a target server’s SMTP service by using telnet.  The script included in the sample MP will require a command (to run on the target server) and an expected response (usually a string).  The VBscript part of this MP uses the Toolsack Baseline dll (from Toolsack Software) to perform the telnet functions.  When you import this MP, can you find the example rules by changing the scope of the Rules View in the Authoring pane to Management server.  You can implement this MP in a SCE environment as well. 

This is better than a port check, as it allows you to send an SMTP command (like EHLO) and check the string returned to make sure the server is open for business. A readme is included with the MP download.

Note: Which ever server you pick to run the scripts/rules from this MP, it must have the Toolsack baseline package installed.  You can visit the site www.toolsack.com to download the DLL.

You can find the MP in the downloads section called “SMTP Check for Ops Mgr 07″ or you can download it from here.

There are a couple of tools for Powershell scripting that if you try, I don’t think you will ever want to be with out. You pretty frequently hear about PowerGUI, which is a pretty nice tool, especially for Powershell newbies, but I wanted to share with you my favorite toolset I use when working really rolling up my sleeves for some serious work in the shell. I’ll give you some quick tidbits on features, but you really need to give these a trial run.

Powershell Analyzer -  This was the first editor I picked up prior to Powershell 1.0 RTM. You get a SQL Query Analyzer type interface, allowing you to highlight a snippet for code and press F5 to run. What’s more, you get the big white space for scripting with a Powershell window in the upper pane. It has better intellisense than the native shell as well.  I keep a file with all my most common code snippets, such as connecting to my management group. It makes scripting so much more convenient because I can highlight and execute snippets at will.

• The visual provider explorer lets you visually browse the Powershell drives in an expandable tree view.

• The vistual results  explorer lets you drag result properties to a toolbar for sorting (much like Silect MP Studio if you’re familiar).

By Powershell Analyzer is just the beginning. You can kick your environment up another notch with Powershell Plus. Powershell Plus turbo-charges your intellisense by indexing all the providers on your machine, and provides advanced intellisense for WMI providers - no need to memorize all those WMI proviers anymore!  The code editor is similar to the white space you see in Powershell Analyzer, but it pops out in a separate floating window. You can save your code snippets in a library for easy retrieval into the editor, and it has a nice debugger.

You really must give these a try. I think I paid about $79 at http://www.powershell.com/analyzer/

The development team reports that while making some WMI-related improvements in preparation for Windows 2008 and Vista, they were also able to take time to resolve the performance issues common to running their virtual agents on a virtual guest. Thus, they now support Quest Extensions for Operations Manager 2007 running in a virtual machine.

NOTE: This  includes support for guests on VMware ESX, which should address the issue for most enterprise users.

If you haven’t read Satyas latest post, take a minute and checkout

In Satya Vels post title “Opsmgr 2007 Hardware Guidance (What hardware do I buy?)“, he provides some additional clarification in the following areas, which augment the hardware sizing data in the Operations Manager 2007 Design Guide. These provide additional specificity for specific configurations, and the attached spreadsheet provides more reasonable hardware recommendations versus those contained in the Opsmgr Design Guide.

In particular, Satya suggests:

• We do not recommend agents reporting to MS when there are GW Servers reporting to MS
• We do not recommend agents reporting to RMS when there are MS Servers reporting to RMS
• If you are having multiple Management Groups write into a single Data Warehouse then I would add the recommended RAM requirements for each configuration
• Several additional suggestions I’ll leave you to find in his post on the team site.

Additionally, you’ll find database growth estimates based on the number of agents attached to the post. Download the new Opsmgr hardware specifications spreadsheet HERE.

You’ll find an article on “What’s New in Essentials 2007 SP1?” that  I wrote a few weeks ago. But you’ll also find some really nice work on AD and Windows 2008, as well as an intro to the newest member of the System  Center family, Mobile Device Manager.

Check them out at the links below:

• Windows Administration: Active Directory Backup and Restore in Windows Server 2008
• Windows Administration: Designing OU Structures that Work
• Windows Administration: Extending the Active Directory Schema
• System Center: Introducing System Center Mobile Device Manager
• System Center: What’s New in System Center Essentials SP1

 Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

It’s process that raises questions in any software platform, and controlling your management pack deployment and tuning processes is one of th most important.

The Management Pack Lifecycle Whitepaper provides great insight and process guidance around effective tuning, deployment and release management of your Operations Manager and Essentials 2007 MPs. Although written by Silect Software (a 3rd party ISV for Opsgmr and SCE), this paper is full of excellent guidance (and I am not paid to say that).

 Download the Managment Pack Lifecycle Whitepaper from Silect HERE.

The Remote Operations Manager Deployment Guide for Essentials 2007 is now available for download from the Microsoft website. For those of you not familar with Remote Operations Manager, it is the Essentials add-on that allows managed services providers to remotely monitor Essentials environments at remote customer sites.

The deployment guide discusses best practices for deploying Remote Operations Manager 2007. The guide includes the following:
• Architecture
• Security
• Requirements
• Service Provider Site Deployment
• Customer Site Deployment
• Post-Deployment Tasks

 Download the guide HERE

I created a script for a customer to measure the response time of SMB file share (Windows File Share) to test new network equipment.  I thought that this script might be useful to someone in the community so I dressed it up a bit and created two versions of it.  You can download the scripts in a MP form here. 

The versions of the script are as follows:

• Single File Share - The script will copy the file to a single server share and log the response time.  The script will log an event if it succeeds or fails.
• Multiple File Share - The script will copy a file to multiple servers with the same share.  This script will also log an event if it succeeds or fails.   

Both sample scripts listed above and included with rules in the MP as an example on how to use it.  Included in the download is a readme file that explains the command line parameters.

I am fairly sure this can work in SCE but I haven’t tested it so I would really appreciate some feedback from anyone that tries it.

Question: What if I do not want to monitor an application or service for a particular server? How can I stop this without overriding every rule and monitor for that server?

Answer: In the RTM release there was no good answer for this all too common situation. Sometimes you may not want to monitor all applications on a computer. However, once the instance of an object-type has been discovered (such as an Active Directory domain controller), rules and monitors are active and running shortly thereafter. In the RTM release of Operations Manager, this meant creating a tremendous number of disable overrides for all rules and monitors to stop unwanted alerts (not fun) or digging into the SDK (also in the ‘not fun’ category).

This was rectified in Service Pack 1 for Operations Manager 2007. In Service Pack 1, the Remove-DisabledMonitoringObject cmdlet was introduced to the Command Shell.

 To remove the discovery data for an object you do not want to monitor, perform the following steps:

1. Create a disable override for the target computer (or group of computers) for each object discovery you do not wish to run on the target computer. For example, to prevent SQL monitoring on SERVER1, go the Authoring space in the Operations console and create a disable override for each SQL object discovery for SERVER1.
2. Run Remove-DisabledMonitoringObject with no parameters. This will remove discovery data from the object discoveries for any objects for which you’ve disabled discovery.

Unwanted monitoring should cease shortly after execution of these steps.

I was doing some research and testing on Windows 2008 security and audit logging capabilities and wanted to share these resources for you Opsmgr administrators that may be have need for some of this information for use with Audit Collection Services.

Here are some great resources to get you familiar with Windows 2008 security events and granular audit policy configuration.

• Windows 2008 Audit and Compliance - This TechNet Magazine article is a great introduction to auditing capabilities of Windows 2008 and configuration of Granular Audit Policies (GAP).

• Security Audit Events for Win2008 and Vista - Here’s a great list of Windows 2008 Security Event IDs and descriptions. You’ll notice that Win2008 events are nearly identical to Windows Vista, and you’ll see these in the EventSchema.xml

• Windows 2008 Security Guide - Downloadable version of the authoritative guide on Windows 2008 security

• SVT Audit Reference List - If you have interested in matching Windows 2008 event IDs to their legacy counterparts, Secure Vantage folks took some info from MS and ultimatewindowssecurity.com to reference some of the legacy event IDs next to their Windows 2008 equivalents.

Update your MOM skills to Operations Manager 2007 at the Operations Manager 2007 Bootcamp! Register in December for training in 2008 at SystemCenterForum and receive a free copy of Operations Manager 2007 Unleashed!

Check the 2008 Bootcamp Schedule and request pricing and availability HERE.

A couple of articles showed up as new or updated this week.

946428 - The Health Service does not process configuration files, and events 7022 and 1220 are logged every 30 minutes on a domain controller on which you installed the Operations Manager 2007 agent

945312 - The OpsMgr Health service may incorrectly display the health state of the cluster nodes in System Center Operations Manager 2007

949875 - When you run a task in the System Center Operations Manager 2007 Operations Console on a Russian version of Windows Server 2003, the task outputs are displayed in corrupted text

There seems to be a  small bit of errata in the TechNet documentation for the Set-ManagementServer cmdlet, used in setting primary and failover management servers for the Gateway.

URL: http://technet.microsoft.com/en-us/library/bb381392.aspx

Issue: The -ManagementServer parameter should be -PrimaryManagementServer.

I suspect this may have changed somewhere between Beta 2 and SP1, as my notes show I used this successfully as well, (and saw no complaints until recently), but hard to be sure. I’ll also update the PKI and Gateway document also to reflect this shortly. 

Its finally here! Operations Manager 2007 has been unleashed, and Network World is doing a giveaway for a free copy of System Center Operations Manager 2007 Unleashed! 15 copies of the book are available in the contest - find out more about it at http://www.networkworld.com/subnets/microsoft/microsoft-book-competition-jump.html. You can also read an excerpt of one of the chapters in the book, Chapter 3, at http://www.networkworld.com/subnets/microsoft/032408-ch3-system-center-operations-manager.html.

 (More at the source)

I was too busy to post this on April Fools day, but I don’t want to let this issue slide entirely. 

It’s time to address the longest running bug since the RTM of Operations Manager 2007. It’s a bug I have dubbed the “lame acronym bug“.

By the way, if you are Stefan Stranger’s boss at Microsoft, please stop reading immediately.

Now, for the rest of you who are NOT  Stefan’s boss at Microsoft, I had to laugh when Stefan Stranger posted about MS employees getting in trouble for calling Opsmgr “SCOM”. Of any issues that have surfaced with the new platform, the “lame acryonym bug” is the longest running issue with the product to date. Sadly, nobody has logged this bug to the connect site…yet.

But you know what? I have a solution.  My own “Community KB article” if you will. A proposed permanent workaround for the lame acryonym bug. A workaround that imposes something we stopped hoping for  so many months ago, we forgot that it was even an option.

Background

But first, let us revisit the sad and shameful history of the lame acryonym bug. It has gone through a strange metamorphysis. Kind of a like a new strain of the flu. One that doesn’t go away, but simply changes form. All strains of this bug share common traits in that they are either 1) more syllables than “MOM” 2) sound close to a certain unsavory word (which I shall not repeat out of respect for “MOM” and 3) Don’t sound as good as “MOM”.

If  memory serves, the metamorphysis went something like this:

• Early beta - MS stops saying MOMv3 and start saying SCOM (alright, so this one does not sound so good)
• Later beta - SCOM is replaced by OpsMgr or OM2007 (This second one looks fine on paper, but what do I say here? “Ommmmm”)
• Last couple of trips to Redmond I’ve heard S-COM (SCOM pronounced “Ess COM“). A thinly veiled “workaround” for SCOM, the root cause of the lame acronym bug.
• OpsMan is another recent variant…this one is growing on me. I think I like it

Well, my nose is runny, my throat is sore, and I am ready for a cure! Microsoft, I have an acryonym we can all live with (outside of Redmond anyway):

 M O M

Consider the facts

• She’s a version older (”39 and holding” as Emily Post would say)
• A whole lot smarter (Though she does frequently ramble in a foreign language - XML).
• A little bigger than in her younger days (Hey, you stuff yourself with all that sweet XML and see what happens!)
• Somehow much sexier (Most agree her facelift was quite successful)
• But she’s still the same girl. (I recognize her by her sweet views, runtime scripts, and Web Console, surgically…ur,  programmatically enhanced in v3)

So here is the unofficial KB:

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

KB999999: Fix for the “Lame Acronymn Bug” in System Center Operations Manager 2007

SYMPTOMS:
When referring to Operations Manager 2007, engineers stutter or stammer uncomfortably, look sheepishly at the Microsoft re