I was recently working with a dynamic group membership situation where we needed to include all of the sub-OU’s within the group. Our approach was to create a dynamic membership which matched based on a wildcard value that would exist because the sub-OU naming includes the top level OU naming. The result was just what we needed so we didn’t need to specify each sub-OU’s membership in the group. I was going to write up the details on this, but I found that someone else had done so (it’s great being a member of a community that shares information like this – way to go!). The following is a subset of his article available a http://00shep.blogspot.com/2012/03/scom-groups-dyanmic-members-ou.html

“Note the highest level OU for which you want to capture all sub-systems

1. Go to one of the systems in SCOM and view the properties in “Monitoring”. One of the values will be “Organizational Unit” > Copy it
2. Create your Dynamic Members inclusion rule
3. Select “Windows Computer” > Add

• Property = “Organizational Unit”
• Operator = “Matches Wildcard”
• Value = I* + < OU that you copied in step 2>

e.g.
*OU=XenApp-65,OU=Servers,DC=MYDOMAIN,DC=com”

Operations Manager (SCOM, OpsMgr) has the ability to monitor an untrusted domains as well as highly segmented\firewalled networks. 

Gateways can be within the trusted domain as well, but are highly segmented by Firewalled VLANs.  The Gateways that are installed in the trusted domain do not actually utilize certificates, as the untrusted domain computers do.  In this case, the trusted computers utilize Kerberos (SPNs must be registered) and they may also require a Trusted Internal CA Root Cert.

The untrusted Gateway cannot properly communicate to the MS’s (EVENT ID 220071, 21016)

OpsManager Unable to set up a communication channel with MS

I validate the following:

1. Verify Manual Agent Installs show in Pending Actions for approval
   • In the Operations Console, Administration>Settings>Security
     • Ensure ‘Review new manual agent installations in pending managmeent view’ is checked
2. Recycle the HealthService (System Center Management Service)
3. SPN’s registered for DB\DW and MS’s
   • Restart of Servers in this order may be necessary
     1. DB\DW Instances
     2. RMSe Management Server
     3. Other MS’s
4. Install GW as local Administrator
   • GW Approval tool run using an account with SysAdmin privileges to SQL DB
5. Certificates are OK
   • Trusted Root Certificates on All GW and MS
   • Ensure Full Name of Computer is used as the Friendly name and name of the certificate
   • OpsMgr Cert unique to each computer and imported
   • Using 1024 or 2048 key size (2048 adds slight CPU overhead)
     • MOMCertImport changes this to 1024
   • Expiration OK
     • MOMCertImport changes this to 1 year in the Registry
   • If you cannot request the certificate from the GW or Agent:
     • Use the web site on the MS to request a server cert
6. Gateway approval tool is OK
   • Ensure the following files exist on the Management Server:
     • Microsoft.EnterpriseManagement.GatewayApprovalTool.exe
     • Microsoft.EnterpriseManagement.GatewayApprovalTool.config
   • Command Run successfully:
     • Microsoft.EnterpriseManagement.gatewayApprovalTool.exe /ManagementServerName=<managementserverFQDN> /GatewayName=<GatewayFQDN> /Action=Create
7. Port 5723 has been validated as Open
   • I haven’t seen the need for 5724 in the past, although mentioned in the MS documentation
8. Telnet to 5723 to the MS succeeds
9. Check DNS
   • Mgmt Server name resolves to IP
   • Potential Hosts file edit or DNS entry
10. Try re-copying the certificate out of the OperationsManager Folder into the Trusted Root store and restarting HealthService
11. Flushing Health Service Cache
12. Reinstalling GW and pointing to different MS
13. Reissuing Certificates and reimporting, then running MOMCertImport
14. Recycle the HealthService (System Center Management Service)

I ran into this issue where the RMSe Installation would fail at the Data warehouse configuration during Operations Manager Setup. 

Issue:

The install fails at the DW installation….and a warning is seen for the Management Server Install, then subsequent red X Critical Failures below.

• OS versions = Server 2012 STD
• SQL version = SQL 2012 SP1 STD
• OpsMgr 2012 SP1

Assumptions:

• OpsMgr 2012 SP1 cannot configure the OperationsManagerDW database files in a non default location for new User Databases
• OpsMgt 2012 SP1 is not able to write the correct data file name per this post
  • https://www.catapultsystems.com/jcowan/archive/2013/04/18/opsmgr-2012-sp1-workaround-fresh-install-results-in-blank-operationsmanagerdw-data-and-log-file-names-mdf-and-ldf.aspx
• Cameron Fullers Blog is similar, however the errors are different, while the issue is extremely similar
  • https://www.catapultsystems.com/cfuller/archive/2013/02/13/issue-when-installing-opsmgr-2012-sp1-all-in-one-scom-sysctr.aspx

Error:

The OpsMgrSetupWizard.log states the following interesting section where the Error begins.

[14:38:27]: Error: :RemoveVssExpressWriter failed with the following exception: : Threw Exception.Type: System.Reflection.TargetInvocationException, Exception Error Code: 0x80131604, Exception.Message: Exception has been thrown by the target of an invocation.
[14:38:27]: Error: :StackTrace:   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)

[14:37:43]:    Always:    :Management Server DENAPP08.amr.ch2m.com failed to connect, now trying another one.
[14:37:43]:    Warn:    :Failed to connect to any SDK in the management group, trying again
[14:38:03]:    Error:    :Error:Could not connect to management group. Can not continue with DW upgrade…
[14:38:03]:    Info:    :Info:got MG connection
[14:38:03]:    Error:    :Error:Could not connect to management group. Cannot continue with current action…
[14:38:03]:    Error:    :FATAL ACTION: GetManagementGroup
[14:38:03]:    Error:    :FATAL ACTION: DWInstallActionsPostProcessor
[14:38:03]:    Error:    :ProcessInstalls: Running the PostProcessDelegate returned false.
[14:38:03]:    Always:    :SetErrorType: Setting VitalFailure. currentInstallItem: Data Warehouse Configuration
[14:38:03]:    Error:    :ProcessInstalls: Running the PostProcessDelegate for OMDATAWAREHOUSE failed…. This is a fatal item.  Setting rollback.
[14:38:03]:    Info:    :SetProgressScreen: FinishMinorStep.
[14:38:03]:    Always:    :!***** Installing: OMCONSOLE ***
[14:38:03]:    Info:    :ProcessInstalls: Rollback is set and we are not doing an uninstall so we will stop processing installs
[14:38:03]:    Always:    :****************************************************************
[14:38:03]:    Always:    :****Starting*RollBack*******************************************
[14:38:03]:    Always:    :****************************************************************

I tried the following, but not limited to:

• Windows Firewall disabled and service stopped and disabled
• Service accounts are within a group that is a Local Admin on SQL and the RMSe
• Turning UAC OFF
• ODBC and wbemtest connections to the DB server from the RMSe succeeded
• Ran Setup ‘As Administrator’….
• Checked ACLs on all Drives
• Almost tried precreating the OperationsManager and OperationsManagerDW, but didn’t get to that point.
• Rebooted 3 times and spun around in circles

Workaround:

Perform the installation for creation of OperationsManager and OperationsManagerDW to the default location of User database files as configured on the SQL instance.  When the installer completes successully, then you can manually move the OperationsManagerDW to the preferred disk.

Additional Logs:

[14:33:54]:    Always:    :Current Action: CreateDataWarehouse
[14:33:54]:    Always:    :Creating DataWarehouse Database
[14:33:54]:    Info:    :Info:Using DB command timeout = 480 seconds.
[14:33:54]:    Info:    :Adding Script files to dictionary.
[14:33:54]:    Info:    :
    .\build_mom_dw_admin.sql
[14:33:54]:    Info:    :Added
    .\build_mom_dw_admin.sql
   to the dictionary.
[14:33:54]:    Info:    :
    .\Datawarehouse.Initial.Setup.sql
[14:33:54]:    Info:    :Added
    .\Datawarehouse.Initial.Setup.sql
   to the dictionary.
[14:33:54]:    Info:    :
    .\build_momv3_dw_localization.sql
[14:33:54]:    Info:    :Added
    .\build_momv3_dw_localization.sql
   to the dictionary.
[14:33:54]:    Info:    :
    .\Datawarehouse.OM12.Upgrade.sql
[14:33:54]:    Info:    :Not Added to dictionary:
    .\Datawarehouse.OM12.Upgrade.sql
[14:33:54]:    Info:    :Done loading scripts
[14:33:54]:    Info:    :Info:Connecting to Remote SQL server SCOMDB.domain.com
[14:33:54]:    Info:    :Info:Connecting to Remote SQL server SCOMDB.domain.com
[14:33:54]:    Always:    :Creating Database: OperationsManagerDW
[14:33:57]:    Always:    :Running first set of configuration scripts.
[14:33:57]:    Info:    :Info:Using DB command timeout = 1800 seconds.
[14:33:57]:    Info:    :Adding Script files to dictionary.
[14:33:57]:    Info:    :
    .\build_mom_dw_admin.sql
[14:33:57]:    Info:    :Added
    .\build_mom_dw_admin.sql
   to the dictionary.
[14:33:57]:    Info:    :
    .\Datawarehouse.Initial.Setup.sql
[14:33:57]:    Info:    :Added
    .\Datawarehouse.Initial.Setup.sql
   to the dictionary.
[14:33:57]:    Info:    :
    .\build_momv3_dw_localization.sql
[14:33:57]:    Info:    :Added
    .\build_momv3_dw_localization.sql
   to the dictionary.
[14:33:57]:    Info:    :
    .\Datawarehouse.OM12.Upgrade.sql
[14:33:57]:    Info:    :Not Added to dictionary:
    .\Datawarehouse.OM12.Upgrade.sql
[14:33:57]:    Info:    :Done loading scripts
[14:33:57]:    Always:    :Running standard DB Configuration scripts.
[14:35:27]:    Always:    :Running DataWarehouse Database configuration scripts
[14:35:27]:    Info:    :Info:Using DB command timeout = 1800 seconds.
[14:35:27]:    Info:    :Adding Script files to dictionary.
[14:35:27]:    Info:    :
    .\build_mom_dw_admin.sql
[14:35:27]:    Info:    :Added
    .\build_mom_dw_admin.sql
   to the dictionary.
[14:35:27]:    Info:    :
    .\Datawarehouse.Initial.Setup.sql
[14:35:27]:    Info:    :Added
    .\Datawarehouse.Initial.Setup.sql
   to the dictionary.
[14:35:27]:    Info:    :
    .\build_momv3_dw_localization.sql
[14:35:27]:    Info:    :Added
    .\build_momv3_dw_localization.sql
   to the dictionary.
[14:35:27]:    Info:    :
    .\Datawarehouse.OM12.Upgrade.sql
[14:35:27]:    Info:    :Not Added to dictionary:
    .\Datawarehouse.OM12.Upgrade.sql
[14:35:27]:    Info:    :Done loading scripts
[14:35:27]:    Always:    :Setting Auto Close off..
[14:35:27]:    Always:    :Running DW Sql strings now…
[14:35:27]:    Info:    :CreateDataWarehouse completed.
[14:35:27]:    Always:    :Current Action: RunDWExistingMGStrings
[14:35:27]:    Always:    :Running DataWarehouse Database configuration scripts
[14:35:27]:    Info:    :Info:Using DB command timeout = 1800 seconds.
[14:35:27]:    Info:    :Adding Script files to dictionary.
[14:35:27]:    Info:    :
    .\build_mom_dw_admin.sql
[14:35:27]:    Info:    :Added
    .\build_mom_dw_admin.sql
   to the dictionary.
[14:35:27]:    Info:    :
    .\Datawarehouse.Initial.Setup.sql
[14:35:27]:    Info:    :Added
    .\Datawarehouse.Initial.Setup.sql
   to the dictionary.
[14:35:27]:    Info:    :
    .\build_momv3_dw_localization.sql
[14:35:27]:    Info:    :Added
    .\build_momv3_dw_localization.sql
   to the dictionary.
[14:35:27]:    Info:    :
    .\Datawarehouse.OM12.Upgrade.sql
[14:35:27]:    Info:    :Not Added to dictionary:
    .\Datawarehouse.OM12.Upgrade.sql
[14:35:27]:    Info:    :Done loading scripts
[14:35:27]:    Always:    :Running DW Sql strings now…
[14:35:27]:    Info:    :RunDWExistingMGStrings completed.
[14:35:27]:    Always:    :Current Action: GetManagementGroup
[14:35:27]:    Info:    :Info:getting MG connection
[14:35:27]:    Info:    :Info:trying to connect with server server01.domain.com
[14:35:33]:    Info:    :Info:Error while connecting to management server: The Data Access service is either not running or not yet initialized. Check the event log for more information.
[14:35:33]:    Error:    :Couldn’t connect to mgt server stack: : Threw Exception.Type: Microsoft.EnterpriseManagement.Common.ServiceNotRunningException, Exception Error Code: 0x80131500, Exception.Message: The Data Access service is either not running or not yet initialized. Check the event log for more information.

Summary: Operator role and higher (operator, advanced operator, and administrator) should be able to put systems into maintenance mode.

My testing: For due diligence I tested this in my lab environment as well for the Administrator role, Operator Role and Read-Only Operator Role and the results are shown below.

Administrator: (Maintenance mode is available)

Operator: (Maintenance mode is available)

Read-Only Operator: (Maintenance mode is NOT available)

For additional details, Microsoft has provided a set of what privileges are associated with each role in OpsMgr which is included in this post for reference purposes (The following content of what roles have what privileges is re-arranged from: http://technet.microsoft.com/en-us/library/hh872885.aspx)

1.1 Administrator

The Administrator profile includes full privileges to Operations Manager. No scoping of the Administrator profile is supported. The Administrator profile contains all of the privileges found in the Author, Advanced Operator, Operator, and Read-Only Operator profiles in addition to those listed below.

• Create a resolution state
• Delete a resolution state
• Update a resolution state
• Deploy an agent
• Repairing or update an installed agent
• Uninstall an agent
• Enumerate agent settings
• Update agent settings
• Enumerate agents
• Start or stop managing computers or devices via a proxy health service
• Enumerate computers or devices managed via a proxy health service
• Insert a new instance of a computer or device
• Delete an instance of a computer or device
• Run discovery task
• Create events
• Enumerate global settings
• Update global settings
• Export Management Packs
• Enumerate Management Servers
• Delete notification endpoint
• Update notification endpoint
• Create performance data
• Create Run As Accounts
• Delete Run As Accounts
• Enumerate Run As Accounts
• Update Run As Account
• Create mappings between Run As Account and Run As Profiles
• Delete mappings between Run As Account and Run As Profiles
• Enumerate mappings between Run As Account and Run As Profiles
• Update mappings between Run As Account and Run As Profiles
• Create connected management groups
• Delete connected management groups
• Enumerate user roles
• Delete user roles
• Update user roles
• Write favorite reports
• Delete favorite reports
• Read favorite reports
• Update favorite reports
• Read reports
• Run reports

1.2 Author

The Author profile includes a set of privileges designed for authoring of monitoring configuration. A role based on the Authors profile grants members the ability to create, edit, and delete monitoring configuration (tasks, rules, monitors, and views) within the configured scope. For convenience, Authors can also be configured to have Advanced Operator privileges scoped by group. The Author profile contains all of the privileges found in the Advanced Operator, Operator, and Read-Only Operator profiles in addition to those listed below.

• Create Management Packs
• Delete Management Packs
• Enumerate Run As Profiles

1.3 Advanced Operator

The Advanced Operator profile includes a set of privileges designed for users who need access to limited tweaking of monitoring configuration in addition to the Operators privileges. A role based on the Advanced Operators profile grants members the ability to override the configuration of rules and monitors for specific targets or groups of targets within the configured scope. The Advanced Operator profile contains all of the privileges found in the Operator and Read-Only Operator profiles in addition to those listed below.

• Update Management Pack
• Enumerate templates

1.4 Operator

The Operator profile includes a set of privileges designed for users who need access to alerts, views, and tasks. A role based on the Operators profile grants members the ability to interact with alerts, run tasks, and access views according to their configured scope. The Operator profile contains all of the privileges found in the Read-Only Operator profile in addition to those listed below.

• Update alerts
• Run diagnostics
• Create favorite tasks
• Delete favorite tasks
• Enumerate favorite tasks
• Updates favorite tasks
• Run recovery routines
• Update maintenance mode settings
• Enumerate notification actions
• Delete notification actions
• Update notification actions
• Enumerate notification endpoints
• Enumerate notification recipients
• Delete notification recipients
• Update notification recipients
• Enumerate notification subscriptions
• Delete notification subscriptions
• Update notification subscriptions
• Enumerate tasks
• Enumerate task status
• Run tasks

1.5 Read-Only Operator

The Read-Only Operator profile includes a set of privileges designed for users who need read-only access to alerts and views. A role based on the Read-Only Operators profile grants members the ability to view alerts and access views according to their configured scope.

• Read alerts
• Retrieve the instance of the data warehouse for the Management Group
• Read state of a resolution
• Read instance of a connector
• Read a console tasks
• Enumerate diagnostic objects
• Enumerate the results of diagnostics
• Enumerate discovery objects as defined in a Management Pack
• Read a discovery rules
• Read events
• Write to favorite console tasks
• Delete favorite console tasks
• Enumerate favorite console tasks
• Update favorite console tasks
• Write a favorite view
• Delete a favorite view
• Enumerate a favorite view
• Update a favorite view
• Enumerate monitoring objects
• Enumerate monitoring classes
• Enumerate monitoring relationship classes
• Enumerate Management Packs
• Enumerate monitor types
• Enumerate module types
• Enumerate monitors
• Enumerate overrides
• Enumerate performance data
• Enumerate discovery objects as defined in a Management Pack
• Enumerate the status of past recoveries
• Enumerate relationship between monitored objects
• Enumerate rules
• Enumerate saved searches
• Update saved searches
• Write to saved searches
• Delete saved searches
• Enumerate state
• Allows access to connected Management Groups
• Enumerate views
• Enumerate view types

1.6 Report Operator

The Report Operator profile includes a set of privileges designed for users who need access to Reports. A role based on the Report Operator profile grants members the ability to view reports according to their configured scope.

• Retrieve the instance of the data warehouse for the Management Group
• Write to favorite reports
• Delete favorite reports
• Read favorite reports
• Update favorite reports
• Read reports
• Run reports

1.7 Report Security Administrator

• The Report Security Administrator profile includes a set of privileges designed to enable the integration of SQL Server Reporting Services security with Operations Manager.
• Export Management Packs
• Enumerate classes as defined in the Management Packs
• Enumerate Management Packs
• Run a report
• Enumerate rules

Thank you to Paul Johnson for his assistance putting this together!

Kent Agerlund posted a new blog post where Coretech developed a really nice shutdown utility for use with ConfigMgr. Read the full post here.

To suppress or not suppress a computer restart when deploying software and software updates that is the question. No matter what you do, you most likely will not win the “best colleague of the Month” award.

If you do not force a computer restart you might face problems like:

• Non-compliant computers
• Computers being in reboot pending mode which might prevent them from installing new software and software updates

If you do force a restart you might face problems like:

• Very unhappy users
• Scenarios where you restart while the end-user is using the computer for a demo or presentation
• End-users calling Servicedesk and complaining about a virus that’s shutting down their computer
• Restarting computers that are already compliant