Author: Captain

Windows 10 Provisioning Packages – Installation of the Imaging and Creation Designer (ICD)

Pirate,

this is part 2 of my provisioning package series. In this part we will have a look on how to install the Imaging and Creation Designer out of the Windows 10 ADK.

Continue reading

Windows 10 – Provisioning Packages – Overview

Ahoy Pirate,

this is part 1 of my provisioning package series:

Continue reading

Visio Viewer 2013 does not open

Ahoey,

the way we’ve decided to install Office 2103 within a recent project includes the Viewer for Visio documents. So normally when you open a drawing with Visio Viewer, the drawing appears inside an Internet Explorer window. Technically the Visio Viewer implements and ActiveX control which renders Visio Drwaings inside IE. The pages are available as tabs along the bottom of the viewer. But after the uninstallation of the old version and the installation of Office 2013 there was no file association to the viewer. What needed to be done was to set the Visio viewer as default viewer.

This can be done easily by modifing the registry:

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\.vsd]
“Content Type”=”application/vnd.ms-visio.viewer”
@=”VisioViewer.Viewer”

[HKEY_CLASSES_ROOT\.vst]
“Content Type”=”application/vnd.ms-visio.viewer”
@=”VisioViewer.Viewer”

[HKEY_CLASSES_ROOT\.vdx]
“Content Type”=”application/vnd.ms-visio.viewer”
@=”VisioViewer.Viewer”

[HKEY_CLASSES_ROOT\.vss]
“Content Type”=”application/vnd.ms-visio.viewer”
@=”VisioViewer.Viewer”

[HKEY_CLASSES_ROOT\.vst]
“Content Type”=”application/vnd.ms-visio.viewer”
@=”VisioViewer.Viewer”

[HKEY_CLASSES_ROOT\.vsx]
“Content Type”=”application/vnd.ms-visio.viewer”
@=”VisioViewer.Viewer”

[HKEY_CLASSES_ROOT\.vtx]
“Content Type”=”application/vnd.ms-visio.viewer”
@=”VisioViewer.Viewer”

This issue very often appears if you remove Visio Standard 2010 and don’t install any later version. We then inserted a step within the task sequence which takes over this task by running the migration from Office 2010 to Office 2013.

This solved it for us in general.

 

Cheers

*Captain

SCCM Client Activity: Active / Inactive

Ahoey Pirate!

Recently I had an issue where every client went from active to inactive.

2015_02_17_17_39_06_Remotedesktopverbindung.png_2

 

At Site Status SMS_MP_CONTROL_MANAGER reported Management point as “critical” with two significant errors:

 

“MP could not write out CCM setting to WMI.

Possible cause: MP didn’t get installed properly.
Solution: Ensure MP setup succeeded; if not, reinstall MP”

 

and

 

“SMS Executive detected that this component stopped unexpectedly.

Possible cause: The component is experiencing a severe problem that caused it to stop unexpectedly.
Solution: Refer to your ConfigMgr Documentation or the Microsoft Knowledge Base for further troubleshooting information.”

 

For me the next step was to look into mpcontrol.log where I found these errors

2015-02-18 09_07_03- Remotedesktopverbindung

 

 

“CMPControlManager::WriteToCCMSettings(): pWmi->GetObject() failed – 0x80041002”

“MPStart(): WriteToCCMSettings() failed – 0x80041002”

“SMS_MP_CONTROL_MANAGER failed to start with 0x80041002”

“CMPControlManager::ReadConfigurationSettings(): m_pWmi->GetObject() failed – 0x80041010”

 

For me it seemed to be an issue with WMI. So first thing I tried was to connect to a client with Windows Management Instrumentation Tester (wbemtest) and that worked. Next I tried to do a clean client installation by using the “Uninstall existing Configuration Manager client before the client is installed” function. The client installation aboarded nearly instant with the following message:

 

“GetDPLocations failed with error 0x8000ffff”

“Failed to get DP locations as the expected version from MP ‘[SERVERNAME]’. Error 0x8000ffff”

 

So I tried to figure out if the client is able to connect to the management point. Therefore you can use your Web browser and type in following adress

 

HTTP://[Hostname or FQDN]/SMS_MP/.SMS_AUT?MPCERT

 

instead of something like this:

 

2015-02-18 10_39_03- Remotedesktopverbindung

 

I got an Internal server error.

So everything pointet out to be a faulty or misconfigured management point and I decided to reinstall that role. So I opened up Administration\Overview\Site Configuration\Servers and Site System Roles\ selected the affected Management Point and hit on Remove Role. In MPSetup.log you can follow the deinstallation.

 

2015-02-18 10_59_05- Remotedesktopverbindung_2

 

After a while I reinstalled the Management Point.

 

2015-02-18 11_41_17- Remotedesktopverbindung_2

Management Point was available via Internet Explorer and my client reported Client Activity as Active. Problem solved!

 

Good luck

*Captain

 

run as account cannot log on locally

Sailors,

I’ve set up a new SCOM environment at a customers side. Once the installation and the base configuration was finished, I let the server run and collect alerts for several days. On the next workshop day we had a lot of warnings like these and the customer asked me why:

CLEAN_run_as_account cannot log on locally

I have to admit, I was a litte bit confused in the beginning too, because I’m trying to configure my environments on the least privilege way. But then I recognized, that the customers admin has started to configure Run As Accounts on his own way and it became clearer…

If you create a Run as Account of type “Windows” and set the Distribution of this account to “less secure” this account gets distributed to every system and SCOM trys to autenticate with every “less secure” Run As Account on every system.

 

Run_As_Account_Type_Windows

You shouldn’t use “less secure” accounts at all. Work with more secure accounts and specify the servers on which you want them to be provided to.

 

Aaaaaaaaarrrrr

*Captian

Mutual Authentication for SCOM Part 3: Prepare Gateway /DMZ server for Mutual Authentication

Yo-ho-ho,

this is part 3 of a series about Mutual Authentication for SCOM.

Mutual Authentication for SCOM Part 1: Root CA

Mutual Authentication for SCOM Part 2: Certificate Request

Mutual Authentication for SCOM Part 3: Prepare Gateway /DMZ server for Mutual Authentication

In my previos posts I’ve written about: how to set up root CA for MA and how to request the certificate by the use of templates.

In this short post I’ll try to explain you what you need to do to set up the gateway / DMZ server.

 

Export the certificate on SCOM server.2014-12-17 20_14_07-wwscom000326 - Remote Desktop Connection

Check “Yes, export the private key”

2014-12-17 20_17_08-wwscom000326 - Remote Desktop Connection

 

Make sure that “Include all certificates in the certification path if possible is” checked.

 

2014-12-17 20_17_57-wwscom000326 - Remote Desktop ConnectionType in a password and click on “Next”.

2014-12-17 20_18_50-wwscom000326 - Remote Desktop ConnectionGive it a name and export it.

Copy the certificate.pfx and the “MOMCertImport.exe” to the gateway/DMZ/unjoined server. Start mmc load Certificates for local computer and import the certificate

2014-12-17 20_29_53-wwscom000326 - Remote Desktop Connection

 

Import the certificate to your Personal Certificate Store.

2014-12-17 20_33_07

And finally import the certificate via MOMCertImport.exe like we  did it before (in part 2).

If you are about to set up the connection for a domain unjoined server or a DMZ, server this is the point where you are ready.

If you want to set up a gateway server you need to copy “Microsoft.EnterpriseManagement.GatewayApprovalTool.exe” from SCOM Server “C:\Program Files\Microsoft System Center 2012 R2\Operations Manager\Server” to the future gateway server and run the installation, which is pretty much straight forward.

Technet: How to Deploy a Gateway Server

 

 

*Captain

Mutual Authentication for SCOM Part 2: Certificate Request

Yo-ho-ho,

this is part 2 of a series about Mutual Authentication for SCOM.

Mutual Authentication for SCOM Part 1: Root CA

Mutual Authentication for SCOM Part 2: Certificate Request

Mutual Authentication for SCOM Part 3: Prepare Gateway /DMZ server for Mutual Authentication

In my previous post I wrote about what to set up on Root CA. This post is about the certification request on Operations Manager Management Server.

Start mmc and add snap- in for certificates for computer account.

2014-12-17 19_09_07-wwscom000326 - Remote Desktop Connection

“Request New Certificate”2014-12-17 19_10_07-wwscom000326 - Remote Desktop ConnectionSelect your recently created certificate template and hit on “More information is required to enroll for this certificate. Click here to configure”

2014-12-17 19_13_15-wwscom000326 - Remote Desktop ConnectionYou should fill out “Common name” and “DNS” and I recommend to attach more information like Locality or Country.

2015-01-05 09_39_31-# Remotedesktopverbindung
I also recommend to fill in the FQDN in “General” “Firendly name”

2014-12-17 19_22_45-wwscom000326 - Remote Desktop ConnectionIn “Extensions” / “Key Usage” make sure that the “Selected options” are “Digital signature” and “Key encipherment” and in “Extend Key Usage (application policies)” “Server Authentication” and “Client Authentication” are checked in.

2014-12-17 19_32_47-wwscom000326 - Remote Desktop Connection

2014-12-17 19_33_34-wwscom000326 - Remote Desktop ConnectionEverything else in Extensions can be left as is.

In “Pricate Key” / “Cryptographic Service Provider” have a look at “Microsoft RSA SChannel Cryptographic Provider (Encryption)” and “Microsoft Enhanced Cryptographic Provider v1.0 (Encryption)” are enabled.

2014-12-17 19_36_49-wwscom000326 - Remote Desktop ConnectionAs well as “Key size” is “2048”, “Make private key exportable” are set.

2014-12-17 19_38_44-wwscom000326 - Remote Desktop ConnectionTake care that your CA is deposited

2014-12-17 19_40_16-wwscom000326 - Remote Desktop ConnectionLeave “Signature” as is and “Enroll” the certificate…2014-12-17 19_42_05-wwscom000326 - Remote Desktop Connection

To make sure the request went fine – double click on the certificate and have a look at certification path. If everything is okay it will look like this or even close…

2014-12-17 19_44_17-wwscom000326 - Remote Desktop ConnectionAs a final step you need to import the certificate with “MOMCertImport.exe” and make it available for Operations Manager.

You can find “MOMCertImport.exe”on the ISO File at “\SupportTools\AMD64”

2014-12-17 19_50_34-wwscom000326 - Remote Desktop ConnectionSelect the Certificate and hit on “OK”

 

Now you need to request the exactly same certificate with the difference to request it for the gateway or DMZ server. So all you’ve got to do is to switch the hostname within the re

 

In the next part I’ll tell you how to make your gateway or DMZ server ready for mutual authentication.

 

*Captain

Mutual Authentication for SCOM Part 1: Root CA

Yo-ho-ho,

This is a 3 part series about Mutual Authentication for SCOM.

Mutual Authentication for SCOM Part 1: Root CA

Mutual Authentication for SCOM Part 2: Certificate Request

Mutual Authentication for SCOM Part 3: Prepare Gateway /DMZ server for Mutual Authentication

 

To be honest this is a big one for me. It took me days to figure out to figure out what I needed to fill in every field and what is required.

So what do you need?

Let’s start with duplicating the required certificate. Go to your root CA and open a new mmc. Hit on “File” and “Add/Remove Snap-in…” Select “Certificate Templates” and add it to the selected snap-ins

2014-10-14 10_38_12-wsysca000301 - Remote Desktop Connection

Search for IPSec (offline request), right -click and duplicate it.

2014-10-14 10_42_10-wsysca000301 - Remote Desktop Connection

Leave “Compatibility” as is

 

2014-12-17 17_51_06-wsysca000301 - Remote Desktop ConnectionIn “General” give it a name – I had good experience with something like: Company Name – Use of the Certificate – Validity period – Version number

2014-12-17 17_53_03-wsysca000301 - Remote Desktop ConnectionCheck “Allow private key to be exported” in “Request Handling” and leave the rest as is.

2014-12-17 18_00_16-wsysca000301 - Remote Desktop ConnectionSet the minimum key size to “2048” and enable “Microsoft RSA SChannel Cryptographic Provider” and “Microsoft Enhanced Cryptographic Provider v.1.0”

2014-12-17 18_04_22-wsysca000301 - Remote Desktop ConnectionThere is nothing to change in “Key Attestation”

2014-12-17 18_08_38-wsysca000301 - Remote Desktop Connectionand “Superseded Templates”

2014-12-17 18_12_20-wsysca000301 - Remote Desktop ConnectionIn “Extensions” edit “Application Policies” remove “IP security IKE intermediate”. Add “Client Authentication” and “Server Authentication”

2014-12-17 18_16_53-wsysca000301 - Remote Desktop ConnectionNext tab is security. You’ve got to give “Authenticated Users” the right to “Enroll”

2014-12-17 18_26_13-wsysca000301 - Remote Desktop Connection

and we need to add “Domain Computers” allow on “Read”, “Write” and “Enroll”.

2014-12-17 18_29_22-wsysca000301 - Remote Desktop Connection“Subject Name”, “Server” and Issurance Requirements can be left in default state.

2014-12-17 18_33_51-wsysca000301 - Remote Desktop Connection 2014-12-17 18_34_03-wsysca000301 - Remote Desktop Connection 2014-12-17 18_34_12-wsysca000301 - Remote Desktop ConnectionOkay. So the template is done. Next step is to Add the “Certification Authority” Snap-in. Go down to “Certificate Templates”, right-click on it and click on “New” “Certificate Template to Issue”.

2014-12-17 18_38_28-wsysca000301 - Remote Desktop Connection

 

The certificate template will appear what means that it is available for requests by now.  So you’re done at the CA. Next step is to request the certificate on your SCOM server. You will find the guide in Part 2.

*Captain

Best Practice for monitoring a Windows Service

Pirate,

this is Part 3 of a SCOM series focussing monitors and rules. In my last post about Monitoring a Windows Service with SCOM 2012 R2 I’ve talked about how to set up a monitor for a specific service and how you can do something like a first level recovery. The way I showed you is a good way if you are about to monitor a specific service on a bunch of same class servers. Maybe you remember that I’ve set up the Monitor target to “Windows Server”

2014-09-03 17_07_29-scom - wwscom000326 - Remote Desktop Connection

Selecting “Windows Server” for new monitors will distribute the monitor to every windows instance in the whole management group respectively whole environment. Saying if you chose “Windows Server” here and check the “Monitor is enabled” box the service will be monitored on every server even though the service doesn’t exist on a server. Please keep your hands off!

Got that so far?

Another way you could set up the monitor is to select “Windows Server” and to leave the “Monitor is enabled” checkbox unchecked, right? Afterwards you could set an override to a specific object of class or for a group.

 

2014-12-16 19_52_40-wwscom000326 - Remote Desktop Connection

Aye… that’s a way to do it but if you are using SCOM Health Explorer you will face into a loooot of white circles because the requirements to monitor that service will be distributed to every Windows Server. No matter if you want to monitor that service on the server or not, as I said.  So thats not a good way to set up your environment, too.

 

So what to do?

The answer in most of these cases is create your own class!

In Operations Manager there are multiple methods that you can use to create a new class that can be used as a target for monitors and rules. I’ll show you what you’ve got to do.

1. Create a new group and add the servers you are about to monitor. Good news here: “Certain monitoring wizards will require a group to be specified. This specifies the group of computers that will be searched to determine if they have the component that the wizard is monitoring. For example, if you run the Windows Service monitoring wizard, you specify the name of a service to monitor. The wizard will search all computers in the target group that have the service installed. Only those computers with the service will be monitored.”

2014-12-16 20_21_06-wwscom000326 - Remote Desktop Connection

 

Just another remark on this point: Pleeeeeease seperate your customizations, rules, monitors, tasks etc. by management pack. Don’t ever, ever, ever, erver put everything together in one ore two managmenet packs. Thats just a mess and you will face into problems when upgrading management packs way quicker than you expect today.

 

So once you’ve created a new group and added the explicit members. Hit on “Management Pack Templates” and click on “Add Monitoring Wizard”.

2014-12-16 20_37_52-wwscom000326 - Remote Desktop Connection

Select “Windows Service”

2014-12-16 20_42_07-wwscom000326 - Remote Desktop Connection

Give it a name and select the Management pack.

2014-12-16 20_43_21-wwscom000326 - Remote Desktop Connection
Chose the service by hitting on “…” and search for the server. Target the group which we’ve installed in the first step.

2014-12-16 20_44_43-wwscom000326 - Remote Desktop Connection

Changes here are not necessary for my stuff so I leave everything as is.

2014-12-16 20_49_51-wwscom000326 - Remote Desktop Connection

And “create”

2014-12-16 20_51_04-wwscom000326 - Remote Desktop Connection

So what we’ve created is a new Class with a Service Running State monitor which is just monitoring the service on the machines in the group.

2014-12-16 21_15_00-wwscom000326 - Remote Desktop Connection
Actually this should cover over need so far but to show you the point I’ll create another unit monitor:

2014-12-16 21_43_49-wwscom000326 - Remote Desktop Connection

 

So here comes the big point: Instead of “Windows Server” we are able to select “IT-Pirate Citrix Print Manager Service” class which only affects systems within our group and this is actually my “Best Practice” advice on how to monitor a windows service.

*Captain.
More infromations:

TechNet: Selecting a target & Creating a new target

 

Monitoring a Windows Service with SCOM 2012 R2

ahoy sailor!

Actually this is Part 2 of a SCOM series focussing monitors and rules. Originally my challenge was to set up a monitor for Citrix Print Manager Service. A customer of mine has a constellation where this service crashes nearly once a week. I’ve spent so many lines in explaining the difference between monitors and rules so I decided to write a second post.

Alright let’s start.

1. Go to Authoring – Management Pack Objects – Monitors

2. Right Click Monitors – Create Monitor – Unit Monitor…

1

3. In Monitor Type open Windows Services node and choose Basic Service Monitor. Select or create a custom Management Pack.

2

 

4. Name the Monitor (my recommendation is a unique prefix which should be a part of every custom rule/monitor/group-Servername-ServiceName) and insert a description.

When selecting the Monitor target do a little brainstorming on where you wanna use this Monitor. If you will only use it for 2008R2 servers only select these machines as monitor target. If you need the monitor working on all OS types select Windows Server like I did.

Parent Monitor could be a aggregate rollup monitor for example as we’ve learned in the previous post.

I chose Availability because what I actually do monitor is the availability for this task. So this fits here. Please undo the Monitor is enabled checkbox by default. If you leave this one enabled SCOM is trying to monitor the service on every machine in your environment.

3

 

5. Ok next is Service Details. It’s freakin’ important to choose the service and not to type in the service name. So do a click on “…”, type in the servername and select the service.

4

5

6. On Configure Health we work with the default, which is a two-state condition monitor setting.

6.

7. We enable alerting for this monitor and write down a custom text and hit on create.

7

8. For testing purposes we set an override for one specific server. So search for the Monitor and hit right on it and choose Overrides > Override the Monitor > For a specific object of class: Windows Server xxx Computer. The upcoming window shows you all servers on where this service is running. Choose one and hit ok.  A second window appears where you do have to check the override checkbox in the line of enabled and need to set the override value to true.

8

9

9.Alright it’s testing time. Go to Monitoring > Windows Computers do a right click on the “test”server and Open>Helath Explorer for [testserver]. Close the very annoying Scope…

10

… and find your newly created monitor under Availabilty – hopefully in a healthy state

11

10. Now stop the service on the server and see if the monitor turns to critical.

 

…ooookay…so what do we need to set up next? A simple recovery task would solve the customers need here so let’s do this.

11. Go back to Authoring > Monitors  – Look for your Monitor do a right click in the correct group and hit on > properties > Diagnostic and Recovery > Configure recovery taks and >Add > Recovery for critical health state

12

12. Run Command

13

13. Type in a Recovery name and a description. If you wanna follow my recommendation you check the “Recalculate monitor state after recovery finishes”. If the recovery is successful the monitor returns to a healthy state the next time that it detects the required information from the destination server(s).

14

14. I recommend you to work with the net services commands.

15

This is it!

16

Next Part of this series is a best practice recommendation for monitoring a Windows Service.

 

Yo Ho, Yo Ho! A pirate’s life for me.

*Captain

© 2022 IT-Pirate