Module execution failure. Error: 0×80004002 Details: No such interface supported One or more workflows were affected by this. Workflow name: Collect_Mailbox_Statistics.AverageMailboxMessageCount.PerformanceCollection Instance name: Exchange Storage Instance ID: {EA38268C-2ECD-0282-A844-EB4ECC833651} Management group: MGMTGROUP

Resolution:

• Under Administration in the SCOM console goto Run As Profiles
• Select Default Action Account
• Right Click, Select Properties
• Click Run As Accounts tab
• Select an Exchange server under target computer
• Clcik on the Edit button and change it to Local System Action Account, click
• OK
• Repeat for all Exchange servers.
• Click OK
• Restart health service on the Exchange server errors should be gone.’

Submitted By: Brett Wickenden

In the days of MOM 2005, there was a daily process to discover computers and deployment the MOM agent. This was configurable, but allowed MOM administrators to put discovery on auto-pilot, so to speak.  How this works in current versions today depends on whether you are using Operations Manager 2007 or Essentials 2007. In this post, I’ll briefly discuss how this process works, and how you can control its behavior.

Operations Manager 2007 

Scheduled computer discovery and agent deployment is no longer a core features in Operations Manager 2007. The new Active Directory Integration feature is more or less a replacement for this. This leads to a problem if you do not have an agent embedded in your OS image, or if you have not otherwise configured an automated method (like ConfigMgr software deployment or AD Group Policy) to push the OpsMgr agent to new computers in the Active Directory.

However, through the OpsMgr Command Shell, we can work around this limitation by performing computer discovery and agent deployment on a schedule. I have already discussed this process and  provided a fully functioning Powershell script in the following article:

Scheduled DIscovery and Agent Deployment in Large Environments for OpsMgr 2007

http://www.systemcenterforum.org/news/scheduled-discovery-and-agent-deployment-in-large-and-complex-environments/

Essentials 2007 

Scheduled computer discovery and agent deployment is controlled by a rule in System Center Essentials. It can be configured in the Feature Configuration Wizard when you first configure Essentials. However, it can also be configured and tuned by overriding the rule directly. The rule is targeted to the Root Management Server object class (Essentials is the RMS) and the rule name is Scheduled Agent Discovery and Installation. Simply enabling this rule (setting Enabled=true) will turn on a daily run of computer discovery and agent deployment. 

However, the default values may not be what you want. If you look at the overridable parameters in this rule, you will see you can control the interval and time of day at which the process is carried out. This can be done through two additional 

• IntervalSeconds - Controls how often the rule runs. This is 86400 seconds (1 day) by default.
• SyncTime - Controls the time of day during which the rule runs. This is 1am by default. If computers are not running overnight, you may want to adjust this value so agent installation can be carried out successfully. 

Error Reporting 

This is something I wanted for my lab, so I set out to update an existing OpsMgr maintenance mode script to meet the following criteria

• Launch from a desktop shortcut
• Prompt the user for the display name of the group to put into OR remove from maintenance mode
• Prompt for number of hours maintenance mode should be set
• When needed data is supplied, put computer, health service and health service watcher into maintenance mode.

HOW TO CONVERT POWERSHELL SCRIPT PARAMETERS INTO PROMPTS FOR INPUT

Step 1: It starts with a couple of syntax changes. We take the cmd line parameters accepted by the script (contained in line 1 shown below:

param($groupName,$hours,$rmsServerName,$startMM)

and change it to the syntax you see below, which uses the read-host cmdlet to collect user input. Make sure to replace the FQDN with that of your Root Managemnet Server.

#Set name of RMS server

$rmsServerName = “nocms01.noc.systemcenterforum.org”

#Prompt user for input

$groupName = read-host -prompt “Enter Group Name:”

$hours =  read-host -prompt “Enter Number of hours in maintenance mode:”

$startMM =  read-host -prompt ‘Starting maint mode? Enter true to start, false to stop’

Step 2: Save script to a folder on local machine. Any machine with the Operations Console and OpsMgr Command Shell installed will do.

In this example, I’ll save the script to c:\scripts\groupMM.ps1

Step 3: Create a Desktop Shortcut for the script. Right click on your Windows Desktop and select New –> Shortut. Enter the following in the “Type the location of file” textbox

%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe C:\scripts\groupMM.ps1

Click Next and Finish to create the shortcut.

Step 4: One more tweak for usability. While the script is ready to run at this point, I’ve used the start-sleep cmdlet with the -s (second) parameter to specify a 3 second pause after the script sets maintenance mode. This gives you time to read the result of the script.

Download Location

Original Group Maintenance Mode Script

http://blogs.msdn.com/boris_yanushpolsky/attachment/8034871.ashx

Updated Group Maintenance Mode Script with User Prompt

http://www.systemcenterforum.org/downloads/opsmgr-group-maintenance-mode-with-prompt-for-input/

If you dwonload this script, all you need to do is set your RMS name, save the script and create the shortcut.

Instructions for use:
http://www.systemcenterforum.org/news/opsmgr-powershell-tip-desktop-shortcut-for-enabling-group-maintenance-mode

Based on “One more group maintenance mode script” from Boris Y at http://blogs.msdn.com/boris_yanushpolsky/attachment/8034871.ashx

GroupMM.txt (4 KB)

So a couple of weeks ago, I thought I’d give this a try and share my results.

As it turns out, the process was successful just as expected with no really unexpected issues. I’ve noted a couple of hurdles to be aware of that will make your journey a bit faster. These suggestions are equally applicable to OpsMgr 2007. 

INSTRUCTIONS:

The instructions I followed were those documented by Alan Goodman of the SCVMM team at the following URL: http://blogs.technet.com/rakeshm/archive/2008/08/22/configuring-scvmm-2008-s-pro-feature-with-ops-manager.aspx

These are now posted on TechNet in almost exactly the same format, but without the screenshots.

ITEMS OF NOTE:

• Make sure you put the WIndows 2008 hotfixes required for OpsMgr / Essentials support on your SCVMM server. You have to load the Essentials / OpsMgr console (and ultimately an agent) on this server, so you’ll need these fixes in place. That’s documented in this KB - http://support.microsoft.com/kb/954049
• Make sure your SCE server’s action account has local admin rights on the SCVMM server.
• Don’t bother looking for the SCVMM 2008 MPs - they are included on the SCVMM media and imported automatically when you run the installer from the SCVMM media
• Remember when adding the SCE ReportServer URL that it is a named instance if you installed SCE with included SQL Express instance, so your URL will be http://sceserver/reportserver$SCE 

The SCVMM Admin console is layered on the SCVMM Powershell cmdlets, and every task you performed in the GUI has a Powershell equivalent. using the “View Script” control in the SCVMM GUI, you can actually perform the task in the interface and then view the underlying script.

Fig 1 - View Script control in SCVMM 2008 Console

When you run the New Virtual Machine Wizard, the last screen of the wizard has the “View Script”. Clicking this script exposes the Powershell script that will perform the task according to your specifications selected by you in the wizard. A few tweaks and you have a reusable script for next time.

Retrieving a List of SCVMM Cmdlets

If you want to venture out and write some scripts on your own, your first step will likely be to retrieve a list of the SCVMM-specific cmdlets. So how do we do this? Well, I googled a bit, and found articles that involved multiple wildcard searches with get-command to retrieve partial lists (SCVMM does not have an equivalent to get-operationsmanagercommand).

However, I did a bit of looking with get-help, and found the answer. If you run get-command with the -PSSnapin parameter, you can pass the name of the snapin and returned to the screen will be a list of all cmdlets contained in the specified snapin. to retrieve a list of SCVMM cmdlets, perform the following steps:

• Launch the SCVMM Powershell shortcut from the Start Menu
• Run the  get-command cmdlet with the -PSSnapin parameter as shown below - microsoft.systemcenter.virtualmachinemanager is the name of the Powershell snapin for SCVMM.

 Get-Command -PSSnapIn “microsoft.systemcenter.virtualmachineManager” | write-host

The output is a list of  approximately 160 SCVMM Powershell cmdlets:

Add-LibraryServer
Add-LibraryShare
Add-Patch
Add-VirtualizationManager
Add-VMHost
Add-VMHostCluster
Add-VMHostNetworkAdapter
Associate-VMHost
Backup-VMMServer
Compress-VirtualDiskDrive
Convert-VirtualDiskDrive
Copy-HardDisk
Copy-VMDK
DisableUndoDisk-VM
DiscardSavedState-VM
Discover-Cluster
Discover-Computer
Discover-LibraryShare
Dismiss-PROTip
Expand-VirtualDiskDrive
Get-Certificate
Get-CPUType
Get-DependentLibraryObject
Get-DirectoryChildItem
Get-GuestOSProfile
Get-HardwareProfile
Get-ISO
Get-Job
Get-LibraryRating
Get-LibraryServer
Get-LibraryShare
Get-MachineConfig
Get-NetworkLocation
Get-OperatingSystem
Get-PROTip
Get-Script
Get-SshPublicKey
Get-Step
Get-Template
Get-VirtualCOMPort
Get-VirtualDiskDrive
Get-VirtualDVDDrive
Get-VirtualFloppyDisk
Get-VirtualFloppyDrive
Get-VirtualHardDisk
Get-VirtualizationManager
Get-VirtualNetwork
Get-VirtualNetworkAdapter
Get-VirtualSCSIAdapter
Get-VM
Get-VMCheckpoint
Get-VMHost
Get-VMHostCluster
Get-VMHostDisk
Get-VMHostGroup
Get-VMHostNetworkAdapter
Get-VMHostRating
Get-VMHostVolume
Get-VMMManagedComputer
Get-VMMServer
Get-VMMUserRole
Get-VMPerformance
Get-VMwareResourcePool
Get-VMXMachineConfig
Invoke-PROTip
Merge-VMCheckpoint
Move-VirtualHardDisk
Move-VM
Move-VMHost
Move-VMHostCluster
Move-VMHostGroup
New-GuestOSProfile
New-HardwareProfile
New-MachineConfig
New-P2V
New-PhysicalAddress
New-Template
New-V2V
New-VirtualDiskDrive
New-VirtualDVDDrive
New-VirtualNetwork
New-VirtualNetworkAdapter
New-VirtualSCSIAdapter
New-VM
New-VMCheckpoint
New-VMHostGroup
New-VMMUserRole
New-VMRCCertificateRequest
New-VMXMachineConfig
Reassociate-VMMManagedCompute
Refresh-LibraryShare
Refresh-VirtualizationManager
Refresh-VM
Refresh-VMHost
Refresh-VMHostCluster
Register-VM
Remove-GuestOSProfile
Remove-HardwareProfile
Remove-ISO
Remove-LibraryServer
Remove-LibraryShare
Remove-MachineConfig
Remove-Script
Remove-Template
Remove-VirtualDiskDrive
Remove-VirtualDVDDrive
Remove-VirtualFloppyDisk
Remove-VirtualHardDisk
Remove-VirtualizationManager
Remove-VirtualNetwork
Remove-VirtualNetworkAdapter
Remove-VirtualSCSIAdapter
Remove-VM
Remove-VMCheckpoint
Remove-VMHost
Remove-VMHostCluster
Remove-VMHostGroup
Remove-VMHostNetworkAdapter
Remove-VMMUserRole
Remove-VMXMachineConfig
Repair-VM
Restart-Job
Restore-VMCheckpoint
Resume-VM
SaveState-VM
Set-GuestOSProfile
Set-HardwareProfile
Set-ISO
Set-LibraryServer
Set-LibraryShare
Set-PROTip
Set-Script
Set-Template
Set-VirtualCOMPort
Set-VirtualDiskDrive
Set-VirtualDVDDrive
Set-VirtualFloppyDisk
Set-VirtualFloppyDrive
Set-VirtualHardDisk
Set-VirtualizationManager
Set-VirtualNetwork
Set-VirtualNetworkAdapter
Set-VirtualSCSIAdapter
Set-VM
Set-VMCheckpoint
Set-VMHost
Set-VMHostCluster
Set-VMHostGroup
Set-VMHostNetworkAdapter
Set-VMHostVolume
Set-VMMServer
Set-VMMUserRole
Shutdown-VM
Start-VM
Stop-Job
Stop-VM
Store-VM
Suspend-VM
Update-VMHost
Update-VMMManagedComputer

1. Windows 2000/2003/2008/Vista Security Event with Legacy Equivalents 

This spreadsheet is a copy of the Microsoft Security Event Reference for Windows 2008/Vista with the legacy event equivalents for  Windows 2000/2003 included. Pretty handy even if you are not an ACS customer. (I have actually been using this one for several months since they originally posted it).

Fig 1 - Windows Security Event Ref with Legacy Event Column

2. Updated ACS Database and Disk Calculator Resource Calculator

SecureVantage have added to the ACS Database and Disk Calculator Resource Calculator I wrote a few months ago by adding additional worksheets, the most notable containing an ACS ROI Calculator for the SecureVantage archival component. This is a must-have tool when planning your ACS implementation, along with the guidance and sample Events per Second script in the OpsMgr Performance and Scalability Whitepaper. 

Fig 2 - New worksheets in the ACS Disk and Database Calculator

3. Security Event Creation Scripts 

There are more than two dozen sample VBscripts that can be used to affect changes that will trigger security events. Useful tools for testing your security rules even if you’re performing security auditing without ACS.

4. ACS Noise Filter HTML Application 

When run on an ACS Collector, this GUI tool actually applies the appropriate noise filter query automatically. Since applying the right noise filter has been shown to reduce ACS database size by as much as 30%, this is another definitely worth taking a look at. It is accompanied by the well known ACS Noise Filter Guide written by SecureVantage several months ago.

WHERE TO GET IT

That’s a taste of what you’ll find in the kit. You can find a download link to the SecureVantage ACS Resource Kit on our community /tools page.

Locating and interpreting error messages in the WindowsUpdate.log file is a bit unfamiliar and confusing to most Essentials admins, at least the first time around. Here are a some tips and tools for parsing the log and identifying errors quickly.

How to Read the WindowsUpdate.log

The following are some recommendations to bear in mind when examining the WindowsUpdate.log for failures.

1.    Search the log from the bottom up. That way you are searching through the most recent entries first.

2.    Search on the words “WARNING” and “FATAL”. Then find the error code near those words. The error code will be in the format  0×00000000, where the rightmost eight digits are the error code.

3.    Look up the error code on the Microsoft TechNet Support website for a list of associated KB articles.

If this yields no results, use Windows Live Search, or search the Essentials Managed Forums directly for answers. Many error codes will have been encountered by other users in the community, and their causes and resolutions will be well-documented.

Tools and resources related to parsing / interpreting WindowsUpdate.log

How to read the Windowsupdate.log file

http://support.microsoft.com/kb/902093

Comprehensive List of WSUS Error Codes (from Eric Brodish, Microsoft)

http://inetexplorer.mvps.org/archive/windows_update_codes.htm

Tools for Parsing WindowsUpdate.log

You can use the free Logparser command line utility from Microsoft to parse WindowsUpdate.log for errors. Tips for how to query WindowsUpdate.log with Logparser HERE. It allows you to run SQL-like queries, as shown below.

LogParser “SELECT date, time, PID, TID, component, text FROM windowsupdate.log WHERE text like ‘FATAL%” -i:TSV -iHeaderFile:.\wu.hdr -headerRow:off

You can also lookup WSUS error codes using the WSUS Error Code Lookup Tool, which is an HTML app that reads a spreadsheet containing the error codes 

GATEWAY_Session_v1_2_final.pdf (2 MB)

Then rule is created as a result of the Agent Failover configuration in the management server properties in the Administration space. Here’s an excerpt on the topic from page 7 of the AD Integration Guide:

The Agent Failover configuration procedure creates a rule, stored in the Default Management Pack, which is scheduled to run on an hourly basis. The rule creates and populates a number of AD security groups. The membership of these security groups will include all machines, based on auto agent assignment settings, which should connect to the management server. The SCP name is the management server’s NetBIOS name with the suffix “_SCP”.
The rule also creates 2 security groups with the name of the management server’s NetBIOS name, the
first one with the suffix “_PrimarySG_<random number>” and the second one “_SecondarySG_<random
number>”

And that’s not all…

When you configure AD integration for untrusted and child domains, you will need to configure RunAs accounts for those domains (as the RMS machine account won’t have permissions in those domains). RMS performs AD querying and writing with a user account (Domain user rights are sufficient for this account). As you may know, it is not normally recommended to save customizations in SCOM to the Default Management Pack. However, RunAs Profiles used for AD integration can only be used when they are defined there. Read about how to configure AD Integration in child and untrusted domains on page 11.

As Ian mentioned, this info is relevant to OpsMgr 2007 with SP1…no guarantee we won’t see changes in R2.

If you’re curious about the finer points of configuring AD Integration in multi-domain environments, LDAP query samples for configuring agent failover, and troubleshooting information, see the updated  AD Integration Guide at http://systemcenterforum.org/wp-content/uploads/ADIntegration_final.pdf.