Home

Yo-ho-ho,

this is part 3 of a series about Mutual Authentication for SCOM.

Mutual Authentication for SCOM Part 1: Root CA

Mutual Authentication for SCOM Part 2: Certificate Request

Mutual Authentication for SCOM Part 3: Prepare Gateway /DMZ server for Mutual Authentication

In my previos posts I’ve written about: how to set up root CA for MA and how to request the certificate by the use of templates.

In this short post I’ll try to explain you what you need to do to set up the gateway / DMZ server.

Export the certificate on SCOM server.

Check “Yes, export the private key”

Make sure that “Include all certificates in the certification path if possible is” checked.

Type in a password and click on “Next”.

Give it a name and export it.

Copy the certificate.pfx and the “MOMCertImport.exe” to the gateway/DMZ/unjoined server. Start mmc load Certificates for local computer and import the certificate

Import the certificate to your Personal Certificate Store.

And finally import the certificate via MOMCertImport.exe like we  did it before (in part 2).

If you are about to set up the connection for a domain unjoined server or a DMZ, server this is the point where you are ready.

If you want to set up a gateway server you need to copy “Microsoft.EnterpriseManagement.GatewayApprovalTool.exe” from SCOM Server “C:\Program Files\Microsoft System Center 2012 R2\Operations Manager\Server” to the future gateway server and run the installation, which is pretty much straight forward.

Technet: How to Deploy a Gateway Server

*Captain

Yo-ho-ho,

this is part 2 of a series about Mutual Authentication for SCOM.

Mutual Authentication for SCOM Part 1: Root CA

Mutual Authentication for SCOM Part 2: Certificate Request

Mutual Authentication for SCOM Part 3: Prepare Gateway /DMZ server for Mutual Authentication

In my previous post I wrote about what to set up on Root CA. This post is about the certification request on Operations Manager Management Server.

Start mmc and add snap- in for certificates for computer account.

“Request New Certificate”Select your recently created certificate template and hit on “More information is required to enroll for this certificate. Click here to configure”

You should fill out “Common name” and “DNS” and I recommend to attach more information like Locality or Country.

I also recommend to fill in the FQDN in “General” “Firendly name”

In “Extensions” / “Key Usage” make sure that the “Selected options” are “Digital signature” and “Key encipherment” and in “Extend Key Usage (application policies)” “Server Authentication” and “Client Authentication” are checked in.

Everything else in Extensions can be left as is.

In “Pricate Key” / “Cryptographic Service Provider” have a look at “Microsoft RSA SChannel Cryptographic Provider (Encryption)” and “Microsoft Enhanced Cryptographic Provider v1.0 (Encryption)” are enabled.

As well as “Key size” is “2048”, “Make private key exportable” are set.

Take care that your CA is deposited

Leave “Signature” as is and “Enroll” the certificate…

To make sure the request went fine – double click on the certificate and have a look at certification path. If everything is okay it will look like this or even close…

As a final step you need to import the certificate with “MOMCertImport.exe” and make it available for Operations Manager.

You can find “MOMCertImport.exe”on the ISO File at “\SupportTools\AMD64”

Select the Certificate and hit on “OK”

Now you need to request the exactly same certificate with the difference to request it for the gateway or DMZ server. So all you’ve got to do is to switch the hostname within the re

In the next part I’ll tell you how to make your gateway or DMZ server ready for mutual authentication.

*Captain

Yo-ho-ho,

This is a 3 part series about Mutual Authentication for SCOM.

Mutual Authentication for SCOM Part 1: Root CA

Mutual Authentication for SCOM Part 2: Certificate Request

Mutual Authentication for SCOM Part 3: Prepare Gateway /DMZ server for Mutual Authentication

To be honest this is a big one for me. It took me days to figure out to figure out what I needed to fill in every field and what is required.

So what do you need?

Let’s start with duplicating the required certificate. Go to your root CA and open a new mmc. Hit on “File” and “Add/Remove Snap-in…” Select “Certificate Templates” and add it to the selected snap-ins

Search for IPSec (offline request), right -click and duplicate it.

Leave “Compatibility” as is

In “General” give it a name – I had good experience with something like: Company Name – Use of the Certificate – Validity period – Version number

Check “Allow private key to be exported” in “Request Handling” and leave the rest as is.

Set the minimum key size to “2048” and enable “Microsoft RSA SChannel Cryptographic Provider” and “Microsoft Enhanced Cryptographic Provider v.1.0”

There is nothing to change in “Key Attestation”

and “Superseded Templates”

In “Extensions” edit “Application Policies” remove “IP security IKE intermediate”. Add “Client Authentication” and “Server Authentication”

Next tab is security. You’ve got to give “Authenticated Users” the right to “Enroll”

and we need to add “Domain Computers” allow on “Read”, “Write” and “Enroll”.

“Subject Name”, “Server” and Issurance Requirements can be left in default state.

Okay. So the template is done. Next step is to Add the “Certification Authority” Snap-in. Go down to “Certificate Templates”, right-click on it and click on “New” “Certificate Template to Issue”.

The certificate template will appear what means that it is available for requests by now.  So you’re done at the CA. Next step is to request the certificate on your SCOM server. You will find the guide in Part 2.

*Captain

Pirate,

this is Part 3 of a SCOM series focussing monitors and rules. In my last post about Monitoring a Windows Service with SCOM 2012 R2 I’ve talked about how to set up a monitor for a specific service and how you can do something like a first level recovery. The way I showed you is a good way if you are about to monitor a specific service on a bunch of same class servers. Maybe you remember that I’ve set up the Monitor target to “Windows Server”

Selecting “Windows Server” for new monitors will distribute the monitor to every windows instance in the whole management group respectively whole environment. Saying if you chose “Windows Server” here and check the “Monitor is enabled” box the service will be monitored on every server even though the service doesn’t exist on a server. Please keep your hands off!

Got that so far?

Another way you could set up the monitor is to select “Windows Server” and to leave the “Monitor is enabled” checkbox unchecked, right? Afterwards you could set an override to a specific object of class or for a group.

Aye… that’s a way to do it but if you are using SCOM Health Explorer you will face into a loooot of white circles because the requirements to monitor that service will be distributed to every Windows Server. No matter if you want to monitor that service on the server or not, as I said.  So thats not a good way to set up your environment, too.

So what to do?

The answer in most of these cases is create your own class!

In Operations Manager there are multiple methods that you can use to create a new class that can be used as a target for monitors and rules. I’ll show you what you’ve got to do.

1. Create a new group and add the servers you are about to monitor. Good news here: “Certain monitoring wizards will require a group to be specified. This specifies the group of computers that will be searched to determine if they have the component that the wizard is monitoring. For example, if you run the Windows Service monitoring wizard, you specify the name of a service to monitor. The wizard will search all computers in the target group that have the service installed. Only those computers with the service will be monitored.”

Just another remark on this point: Pleeeeeease seperate your customizations, rules, monitors, tasks etc. by management pack. Don’t ever, ever, ever, erver put everything together in one ore two managmenet packs. Thats just a mess and you will face into problems when upgrading management packs way quicker than you expect today.

So once you’ve created a new group and added the explicit members. Hit on “Management Pack Templates” and click on “Add Monitoring Wizard”.

Select “Windows Service”

Give it a name and select the Management pack.

Chose the service by hitting on “…” and search for the server. Target the group which we’ve installed in the first step.

Changes here are not necessary for my stuff so I leave everything as is.

And “create”

So what we’ve created is a new Class with a Service Running State monitor which is just monitoring the service on the machines in the group.

Actually this should cover over need so far but to show you the point I’ll create another unit monitor:

So here comes the big point: Instead of “Windows Server” we are able to select “IT-Pirate Citrix Print Manager Service” class which only affects systems within our group and this is actually my “Best Practice” advice on how to monitor a windows service.

*Captain.
More infromations:

TechNet: Selecting a target & Creating a new target

ahoy sailor!

Actually this is Part 2 of a SCOM series focussing monitors and rules. Originally my challenge was to set up a monitor for Citrix Print Manager Service. A customer of mine has a constellation where this service crashes nearly once a week. I’ve spent so many lines in explaining the difference between monitors and rules so I decided to write a second post.

Alright let’s start.

1. Go to Authoring – Management Pack Objects – Monitors

2. Right Click Monitors – Create Monitor – Unit Monitor…

3. In Monitor Type open Windows Services node and choose Basic Service Monitor. Select or create a custom Management Pack.

4. Name the Monitor (my recommendation is a unique prefix which should be a part of every custom rule/monitor/group-Servername-ServiceName) and insert a description.

When selecting the Monitor target do a little brainstorming on where you wanna use this Monitor. If you will only use it for 2008R2 servers only select these machines as monitor target. If you need the monitor working on all OS types select Windows Server like I did.

Parent Monitor could be a aggregate rollup monitor for example as we’ve learned in the previous post.

I chose Availability because what I actually do monitor is the availability for this task. So this fits here. Please undo the Monitor is enabled checkbox by default. If you leave this one enabled SCOM is trying to monitor the service on every machine in your environment.

5. Ok next is Service Details. It’s freakin’ important to choose the service and not to type in the service name. So do a click on “…”, type in the servername and select the service.

6. On Configure Health we work with the default, which is a two-state condition monitor setting.

7. We enable alerting for this monitor and write down a custom text and hit on create.

8. For testing purposes we set an override for one specific server. So search for the Monitor and hit right on it and choose Overrides > Override the Monitor > For a specific object of class: Windows Server xxx Computer. The upcoming window shows you all servers on where this service is running. Choose one and hit ok.  A second window appears where you do have to check the override checkbox in the line of enabled and need to set the override value to true.

9.Alright it’s testing time. Go to Monitoring > Windows Computers do a right click on the “test”server and Open>Helath Explorer for [testserver]. Close the very annoying Scope…

… and find your newly created monitor under Availabilty – hopefully in a healthy state

10. Now stop the service on the server and see if the monitor turns to critical.

…ooookay…so what do we need to set up next? A simple recovery task would solve the customers need here so let’s do this.

11. Go back to Authoring > Monitors  – Look for your Monitor do a right click in the correct group and hit on > properties > Diagnostic and Recovery > Configure recovery taks and >Add > Recovery for critical health state

12. Run Command

13. Type in a Recovery name and a description. If you wanna follow my recommendation you check the “Recalculate monitor state after recovery finishes”. If the recovery is successful the monitor returns to a healthy state the next time that it detects the required information from the destination server(s).

14. I recommend you to work with the net services commands.

This is it!

Next Part of this series is a best practice recommendation for monitoring a Windows Service.

Yo Ho, Yo Ho! A pirate’s life for me.

*Captain

ahoy sailor!

so today’s challenge is to set up a monitor for Citrix Print Manager Service. A customer of mine has this “bug” where this service terminates unexpectedly when one connects to a XenApp server.

So let’s first of all talk about monitors and rules in SCOM 2012R2. Aftewards I’ll show you how to configure a unit monitor with a basic recovery task.

As far as I understand everything right I can tell you this:

When you want to monitor specific occurences with SCOM you’ve got two options to go.

On the one hand you’ve got Rules:

Rules collect data from sources like Log Files, Windows Event Logs or if you want to collect performance data . This data gets stored in the Operations Manager database where it replicates with the Data Warehouse (if one exists) and can be used for reporting purposes. So a Rule is kind of a stateless Monitoring element and does not create Alerts about state changes. The result of a rule is always a write action and a rule does not come up in the health explorer.

On the other hand we have Monitors:

Monitors provide real-time information So if you want to monitor an object like application components, Windows services, scripts or events, a monitor should be your method of choice. In general we distinguish to kinds manifestations we do have “Two-state” and “Tree-State” Monitors. Thus a monitor can either be in one of thwo /tree states. So here is what the point is: a Monitor is programmed with the intelligence to determine wheter a componenent is healthy or not and (in the best case) has the appropiate command or script to solve the incident.

Alright now let’s have deeper look on the tree monitors.

Unit monitors

• “Unit monitors are often described as the “workhorses” of SCOM monitoring and are the most common kind of monitor out there.” A unit monitor is the fundamental monitoring component and is used to monitor events, scripts, services etc. “These unit monitors can be used at an extremely granular level and provide you with a multitude of ways to monitor even the most minor elements of system stability.”

Aggregate rollup monitors

• An aggregate rollup monitor is a collection of several monitors. Aggregate Monitors should be configured to watch similar items like a group of DNS Servers.  So here’s how an aggregate rollup monitor works: “Suppose you’re using a dependency rollup monitor to watch eight separate DNS servers. You could create a high level monitor that undergoes a state change only once five of the eight DNS servers become unavailable. In this way (i.e. Only raise alert if 5 of 8 DNS servers are down) you can be alerted on your terms. “

So use an aggregate rollup monitor to group multiple Monitors into one.

Dependency rollup monitor

• The dependency rollup monitor, allows the health of one object to directly affect the health of another completely unrelated object. Let’s make an example regarding a SQL Cluster. You would use a dependency rollup monitor to check for the databases. But if one database is offline this does not mean, that the whole SQL is critical so you could configure the monitor in the way to not notice you. If the master database is not available the SQL Environment is down for sure and the dependency rollup monitor would generate alerts. So this construct offers you a bit more flexibility.

Please notice:

In the above listed definitions I’ve tried to make the fielding as clear as possible. Unfortunately it’s not always that clear in business. Sometimes there are to possible ways to implement tasks (like checking whether a certain service is up & running) and can be solved with both rules and monitors. But the above definitions should give you a good starting point.

Thanks to Scott D.Lowe for this great article about Introduction to System Center Operations Manager 2012 (Part 6) – Monitors where I’ve copied some fantastic descriptions to my post.

If you need more informations on Monitors and Rules have a look at TechNet!

Cheers! And Arghhhhhh! Bring the Rum cask aft.

*Captain