Re-installing Operations Manager 2007

In a recent deployment, we encountered several wierd problems. Most of them not documented. So we decided to reinstall Ops Manager and.. try again. These were the steps that we took:

1. We used the Clean Up tool provided in the Ops Manager Resource Kit. Also downloadable. (see my other post for the link)
2. We also used the Clean up tool to remove the Agents.
3. Then we used SQL Management Studio to delete the OperationsMangerDB and OperationsManagerDW

We then proceeded to reinstall OpsMgr 2007.

When we came to Installing Reporting, it game us an error that said.. SRS could not be validated. This is where i remembered a tool that is provided with OpsManager that you need to run to reset the Reporting Server because a different encryption key was used.

Go to the Support Tools folder in the OpsMgr CD and copy the ResetSRS.exe utility into your HDD. Then run either:

ResetSRS.exe MSSQLSERVER (if you had installed SQL using default instance), 'or'

ResetSRS.exe InstanceName (the instance name you installed)

You will then be prompted to enter a credential to be used for authentication. Enter it using this format: DOMAIN\username

After this, launch the Report Services Configuration Wizard. You should see that the Web Authentication section is producing an error. Click on that page and click Apply.

Then Exit.

Proceed to restart the server.

Now you should be able to install OpsMgr Reporting

Hope this helps

Ops Manager 2007 Agent not connecting

I was in a Ops Manager Deployment last week and when we pushed the Agent to the Exchange Server, it got stuck in the Pending view and refused to move. The Operating System was Windows Server 2003 SP1 and had Windows Installer 3.1

Checking the logs at the Agent, we noticed the following error messages:

Event ID: 21016
OpsMgr was unable to set up a communications channel to server.domain.com and there are no failover hosts. Communication will resume when server.domain.com is both available and allows communication from this computer

Event ID: 21001
The OpsMgr Connector could not connect to MSOMHSvc/server.domain.com because mutual authentication failed. Verify the SPN is properly registered in the server and that is properly registered in the server and that, if the server is in a seperate domain, there is a full trust relationship between two domains

Event ID: 20057
Failed to initialize security context for target MSOMSvc/server.domain.com. The error returned is 0x80090303 (The specified target is unknown or unreachable). This error can apply to either the Kerberos or the SChannel package.

We verified that both servers are part of the same domain and DNS lookups were fine.

We then proceeded to check the SPN IDs and found out conflicting records.

To support mutual authentication, the server registers Service Principal Names that are tied to either the computer account or the user account. In this instance somehow, SPNs got registered with the OpsMgr server account as well as the OpsAdmin user account.

To solve this, I did the following:

1. From the domain controller, open a command prompt and then type the following string: ldifde -f domain.txt
2. Open the text file in Notepad and then search for the SPN that is reported in the event log. ServiceClass/host.domain.com (in this case look for MSOMHSvc/server.domain.com)
   Note the user accounts under which the SPN is located and the organizational unit the accounts reside in

Use one of the following options to delete the account SPN registrations from the accounts that should not contain registrations to ServiceClass/host.domain.com. (i.e. Typically any accounts containing an SPN registration for SeriviceClass/host.domain.com that services are not explicitly starting with). Make sure you know which credentials you want to keep (in this case the system account or the domain administrator) and see to it that the service is running with the credentials you want to use. Delete the other one.

Using ADSIEdit

1. Add ADSIEdit to the MMC and bind to the domain using the Domain well known naming context.
2. Navigate to each user account you previously documented (for my case, I went to the opsadmin user account)as having a duplicate SPN registration and right click the account and select properties.
3. Scroll through the list of attributes until you see servicePrincipalName, double click servicePrincipalName and remove the duplicate SPN registration and click on OK and exit ADSIEdit.

Then I proceeded to restart the Health Service on the Agent and wallahhhh!!! connected!..

A similar explanation can be found at: http://www2.wolzak.com/index.php?option=com_content&task=view&id=15&Itemid=2

Operations Manager Service Pack 1 Contents

Ops Manager 2007 SP1 is at RC code and can be downloaded from the connect.microsoft.com website. Here is a grasp of what it is all about...

Bug Fixes

Check out this site for a full listing of the fixes that SP1 does... http://www.systemcenterforum.org/features-in-sp1-rc-for-operations-manager-2007-series-wrap-up/

New Features
The new features that are in Operations Manager 2007 SP1 are:

• Improved performance and reliability when working with alerts, overrides, and searches.
• In all Alert views, performance has been increased through better fetching and yields alert row selection that is three times quicker. Actions and reports are fetched in the background, which further improves performance. Alert knowledge that is displayed in the Alert Details pane can be shown or hidden according to the user's preference.
• Operations Manager 2007 advanced search has been improved by enabling the ability to search across monitors and rules by their overrides.
• Support for the discovery and monitoring of both SNMP v1 and SNMP v2 network devices. Users can select which SNMP Community Version to search for in the Discovery Wizard.
• Support for exporting Operations Manager 2007 diagrams to Microsoft Visio VDX file format. Note that the Visio button is located on the toolbar when in a diagram view. Diagram layouts can now be saved and will be remembered when the diagram view is selected again.
• Support for copying and pasting (CTRL+C and CTRL+V) from the Alert details pane.
  

Setup and Recovery
The following are improvements in setup and recovery:

• To make backup and recovery easier, setup in Operations Manager 2007 SP1 starts the Secure Storage Backup Wizard at the end of setup, by default, to back up the RMS encryption keys. This is the same command-line tool used in the original version of Operations Manager 2007, but with an easier-to-use wizard interface. The wizard is actually started by using the command-line version of the tool when no parameters are passed to the tool or it is started from Windows Explorer. The Secure Storage Backup tool is located on the installation media in the Support Tools directory. The Secure Storage Backup Wizard can be started according to the user's preference.
• To make the recovery of a clustered RMS easier, Operations Manager 2007 SP1 enables the repromotion of the RMS cluster to the RMS role after it is fixed. This addresses the situation where a clustered RMS has failed and another management server in the management group has been promoted into the RMS role.

User Interface and Experience
The following are improvements in user interface and experience:

• To make the creation of new management packs easier, Operations Manager 2007 SP1 introduces the ability to copy views from any existing management pack to an unsealed management pack. This is done in the Monitoring view. For example, if you have created a management pack for SQL Server overrides and want to use one of the SQL Server management pack views in the SQL Server overrides management pack, you would simply select the desired view, right-click to copy it, and then paste it into the target management pack folder.
• In all Alert views in the Monitoring space and in the Web console, Operations Manager 2007 SP1 ensures that the Repeat Count value is incremented correctly.
• After you have created an override for any management pack object, you can look at the summary of overrides for the object type in the Overrides Summary box. Operations Manager 2007 SP1 ensures that the description of the override target is complete. For example, if you create an override for Logical Disk Free Space for the C:\ of Server1, the summary will display 'server1/c:'

Core Product
The following are improvements in the core Operations Manager 2007 product:

• SP1 ensures that when agents are uninstalled from a computer in the Administration space\Device Management container\Agent Managed node of the Operations Console, that they are also removed from the computer views in the Monitoring space.
• Scripts can now be used for diagnostic tasks.
• View names, data and, display strings in the Operations Console that have been collected from computers running different language versions of Microsoft Windows operating systems are displayed correctly.

Reporting
The following are improvements to reporting:

• When you are in a report, you can now choose to publish the report by selecting Publish from the File menu. This will allow you to publish reports to multiple locations, such as Microsoft Windows SharePoint Services Web sites.

Web Console
The following are improvements in the Operations Manager 2007 Web console:

• The Operations Manager Web console provides access to performance data. Users can then select specific counters to graph. In Operations Manager 2007 SP1, it is now possible to construct a filter for the desired performance counters to ease searching and navigation. This ability is available when a performance view is selected and displays in the Performance legend pane. The search options available are All items, Items in the Chart, Items not in the Chart, and Items by text search.
• The Web console has been further improved so that the Favorite Reports container is now available in My Workspace.

Audit Collection Services (ACS)
The following are improvements for ACS:

• New discoveries and views have been added. These features detect and indicate which agents and servers are ACS-forwarding enabled.
• There are more monitors and alert generating rules to track the health state of the ACS collectors. For example, Operations Manager 2007 SP1 includes the ability to watch the DB Queue % full level against default thresholds, such as the back-off threshold or disconnect threshold.
• The ACS forwarder feature is now supported on the Management and Gateway Server roles. The ACS Forwarder is disabled by default. When enabled, it will allow the inclusion of security auditing data for these server roles.
• When using ACS, one of the most common tasks is to enable forwarding on ACS agents. In Operations Manager 2007 SP1, an Operations Manager Command Shell script can be used to enable forwarding for entire computer groups, thereby greatly easing the deployment and administration of ACS.

Agentless Exception Monitoring (AEM)

AEM now provides an improved appearance and functionality of AEM reports.

Monitoring servers in DMZ or Untrusted domains or Workgroups

In a recent POC, I encountered a scenario where the customer did not allow u to join the Ops Manager server into the domain. This was the challenge put forth as we would have issues with mutual authentication.

Due to limitation of resources as well, we could not set up a Gateway Server.

After much hair loss, we performed the following solution.

The Concept
Create a certificate services environment to achive mutual authentication between the trusted and untrusted domain then install agents to get it monitored.

The Grind
We installed and setup Certificate Services on the Windows 2000 Active Directory Domain Controller (yes. the customer was using this so we had to simulate their environment). We then requested the server certificate and client certificate.

After which we used the MOMCertImport Tool to import the server certificate into the Management Server and the Client certificate into the monitored servers.

We then proceeded to install the Agents. DONE! Hooray!... wait... why isn't anything showing up on the Management Server?

After much more hair loss and loss of brain cells, we finally figured it out. What was missing was the Root Certificate.

So the following are the correct steps:

1. Use MOMCertImport tool to import the Root Certificate and Server Certificate into the MS
2. Use MOMCertImport tool to import the Root Certificate and Client Certificate into the Monitored server in the untrusted domain
3. Install the Agent

Pooof!!! Monitored server appears in the Pending view.

Hope this helps you guys out there who are posed with the situation of monitoring in untrusted domains.

OM 2007 Cleanup

I found this utility quite useful. Even though going through Add/Remove Programs can achieve the removal of OpsMgr, this tool does a better and CLEAN method of it. I encourage everyone to download and use it

http://www.microsoft.com/downloads/details.aspx?familyid=14ff7073-c71b-4ad0-805a-a8e458d2c9e0&displaylang=en

Exchange 2007 MP is here!

The Exchange MP is here... The Exchange MP is here... hi ho the dearieyah.. the Exchange MP is here...

http://technet.microsoft.com/en-us/opsmgr/bb847850.aspx

Command Shell is proving to be a fairly simple language to learn and it can do wonders for the administration of Operations Manager 2007. There is a video which I found useful with regards to this...

Check it out.
http://www.microsoft.com/winme/0703/28666/Command_Shell_Intro_Edited.asx

Operations Manager 2007 Tool Kit

Just discovered some cool tools for Operations Manager 2007!!! such as AD Integration script, Vista Gadget, OpsMgr Cleanup Tool, Action Account Tool, Effective Configuration Viewer, OpsMgr Inventory, AEM Validation and AEM MP. Get it from http://technet.microsoft.com/en-us/opsmgr/bb625978.aspx#eie