SystemCenterForums: SystemCenterForum.net

Just skimming through the results so far is pretty interesting.  So far Android leads the pack with iOS a close second.  Windows Mobile is in a quiet 3rd place.

If you’ve not participated in the poll yet, or just want to see the current results, visit the following link:

http://www.myitforum...9611&zoneid=120

When posting questions to a professional forum or newsgroup it is vital to format the question and it's content in a proper way in order to greatly increase the possibility for quickly receiving a good answer, and thus saving you time and frustration.

How to ask a question

Seats available for Kent Agerlunds master class in Long Beach, October 27-29. This 3 day lab is now updated to cover R3.

http://en.truesec.com

Seats are still available for the Chicago session September 14-16 for the 3 day hands on lab “Deploying Windows 7 using MDT 2010 and SCCM 2007 SP2”.

This is the “must take training” for a Windows 7 deployment with style.

http://en.truesec.com

What mobile OS are you using on your primary mobile device?

Participate here:

http://www.myitforum.../?a=19611&z=120

a new guide to help you monitor servers in your dmz or a workgroup with system center operation manger

By shahar nusbaum

Well there might be a few guides like this around the web and I have used most of them,

But for the past 3 mounts I have been battling with this scenario where the agent would stay in "not monitor" state after been approved in the pending management pane and the agent had 21007 and 21016 events on the operations manger event log on the workgroup / dmz server  I wanted to monitor.

If you have a working gateway and after your approve the agents in pending mode and used to momcertimport with successful results and you still receive event id's like21007 and 21016 on the workgroup / DMZ agent this guide is for you.

Well my solution is available for you here

Well first of all and very basic (but not for me) I have 2003 enterprise ca server so I used this guide to create my certificate template

To create a certificate template - http://technet.micro...y/bb735413.aspx

I flowed that guide to the letter and still those event id's and no communication to my gateway.

 Something was missing,

The first change I noticed was that I now I had no option to save a certificate to local computer certificate store this of course is because of the server 2008 enrolment  pages that would need administrator right witch the internet explorer does not use  

So in order to export the certificate to a file I had to use internet explorer

There under tools -> internet options -> content 

There is a certificates section.

Click the certificate button and you can export your certificate from there

Remember to export the private key after clicking the next batten leave this mark

Don’t mark include all certificates it the certification path if possible

The momcertimport tool will not be able to import the certificate

We will deal with the root ca needed in the workgroup / DMZ server in a minute

Then you can save your certificate to a pfx file and copy it to the server you want to monitor

Keep it in a shared folder for the duration of the install process because you will need it for the gateway server as well as the workgroup / DMZ server.

One more certificate is needed before we can continue and again I used this guide

http://technet.micro...y/bb735413.aspx  I used the section called "To download the Trusted Root (CA) certificate"

Notice that you might not be able to get to the web site of your ca server form the workgroup computer so you can do that from your root management server and just save it in the folder were you saved your ca for the workgroup / DMZ server you wanted to monitor

And on one last note before we begin: while most guide say the certificate subject a.k.a the name filed is fqdn don’t just push your domain name in the computer name.
cheek before logon to the workgroup / DMZ server  and Go to start -> computer -> properties – check the full computer name and copy the exact name to your gateway host file if no dns resolution is available

NOW FOR THE STEP BY STEP GUIDE

1.    PREPERING TO INSTALL  THE AGENT ON THE WORKGROUP MECHINE 

 I recommend  you copy this folders  form your scom CD  to one folder you can move around in your environment, let's call that our "scomdmz" inside you will need this folders
* SupportTools
* agent
I recommend  you copy this files to that same folder
* server_cert.pfx (certificate you created using a template for your workgroup / DMZ server)

* CA_certificate_chain.p7b (for the trusted Root (CA) certificate)
move this file to your workgroup machine  (keep a copy of your server_cert.pfx to copy to your gateway server later  )

2.     INSTALLING THE AGENT ON THE WORKGROUP MECHINE

run the msi installation on your server  if there is no dns resolution for your gateway server ping –a the ip address to see if you get the name of your gateway server,  if not you will need to add your gateway server fqdn name to your host file – it's in c:windowssystem32driversetc


(we use the example in our org…)

I KNOW THIS IS A VERY BASIC STUFF RIGHT HERE – I want this guide to be able to apply even to those who don’t deal with this in a daily manner

 now this to prevent any human typing Mistake write the fqdn gateway server in the host file copy & paste it to the management computer name I recommend also copy & paste to command line and telnet the computer name to your gateway on 5723 to check connectivity.
Click next your almost home free…

3.     IMPORTING THE CERTIFICATES TO YOUR GATEWAY AND SERVER

THIS WILL BE SPLIT IN TO TWO PARTS

A.  IMPORTING THE CERTIFICATES ON YOUR DMZ SERVER YOU WANT TO MONITOR -  

 using the momcertimport tool   
-on the workgroup / DMZ server go to start -> if 2008 type cmd if 2003 go to run type cmd
one thing very imported cheek -  if you're on server 2008 check to see if your command prompt run with administrator rights (if not right click the icon before you press enter and  run it as administrator)



the tool is in the SupportTools folder (the one we copied earlier if you flowed step one)
so! The way to run this tool is simple get to it in the command prompt and the give the server certificate file like so
c:dmzfolderSupportToolsi386momcertimport  server_cert.pfx type the password for the key and you will need to receive successfully  state message

YOU GOT THIS FAR – you stop and started the health service like asked in the momcertimport tool after imported the certificate  and still receive those 21007 and 21016 events  you will need to fallow this few steps

 What you need now is another certificate to be imported.
    1.     Go to start mmc -> file -> add/remove snap-in…
    2.     Add certificates add computer account, click next choose local                                            computer click ok and exit – it's all you need for the console

    3.     Go to the Trusted Root Certification Authorities folder on the folder Certificates right click all tasks -> import…
and import your  CA_certificate_chain.p7b we prepared in step 1 this guide
and import it to the Trusted Root Certification Authorities folder
the folder contains certificates that in most time already be in there
but don’t skip this stage.



B. IMPORTING THE CERTIFICATES ON TO YOU GATEWAY SERVER – again this is for all of you battling with  error id  21037 on your gateway (and of course any kind of lack of communication between the agent and your gateway server )

    1.     Go to start mmc -> file -> add/remove snap-in…
    2.     Add certificates add computer account, click next choose local                                            computer click ok and exit – it's all you need for the console
    3. Go to the Trusted Root Certification Authorities and import your
server_cert.pfx we talked about in step one to that folder
    3. Go to Personal folder and import it to that folder ass well



note: we are importing the certificates of the server that we want to monitor into our gateway  Trusted Root Certification Authorities and to the personal folder

4.     CHEKING THE COUMNICATION -

after all the certificates have been imported to  the gateway server and to our soon to be monitored server, in order for this changes to take affect well have to do the fallowing steps

restart health service known as system center management on your gateway
restart health service known as system center management on your  root management server
restart health service known as system center management on your dmz server

Check your DMZ server event viewer to see if the error id repeats

Some changes take time you might want to wait 5-10 minutes after 10

Minutes you need restart the health service again on your DMZ server and cheek your event viewer for the id's if still receive restart the health service again on your root management server and your gateway server


this is my solution and I would like to thank Yossi tali and Gal Hutman

For their help in finding this solution

We rely on Run Advertised Programs (RAP) quite heavily at Dell – we have approximately 400 applications available in RAP, available to almost all systems.  I was asked to provide a quick report that shows the number of successful installs for each Advertisement over the past 30 days, so I thought I would share with you!

SELECT     COUNT(*) AS Count, v_ClientAdvertisementStatus.AdvertisementID, v_Advertisement.AdvertisementName
FROM         v_ClientAdvertisementStatus LEFT OUTER JOIN
                      v_Advertisement ON v_Advertisement.AdvertisementID = v_ClientAdvertisementStatus.AdvertisementID
WHERE     (v_ClientAdvertisementStatus.LastStateName = 'succeeded') AND (v_ClientAdvertisementStatus.LastStatusTime > DATEADD(day, - 30, GETDATE()))
GROUP BY v_ClientAdvertisementStatus.AdvertisementID, v_Advertisement.AdvertisementName
ORDER BY v_Advertisement.AdvertisementName

Enjoy!

Greg Ramsey |  DELL

ConfigMgr MVP | DellTechCenter | @ramseyg | greg_ramsey@dell.com

“This chat’s focus is on Microsoft System Center and will give you the opportunity to chat with Intel experts and your peers in the industry. Come discuss how you are using System Center and Intel vPro technology in your enterprise. This is a great opportunity to ask questions of your peers and to share your best practices.”

More info here:  http://communities.i...m/docs/DOC-5355

Efficiently monitor distributed IBM DB2 databases on Microsoft Windows from a central console.
The NiCE DB2 Management Pack (NiCE DB2 MP) helps you increase RDBMS availability and performance and to lower the overall cost of maintaining your DB2 databases. It enables you to perform service-oriented management as well as incident management in your DB2 environment, supporting your business critical processes.
To ensure always-on availability, the NiCE DB2 MP monitors key operational activities and events such as event logs and processes. Information from important system tables is collected to reflect DB2 activity.

Free Evaluation Copies: https://portal.nice.de

*Note – This post is based on ConfigMgr R3 Beta 1 Code.*

You may be familiar with some of the home-grown right click console extensions, such as one I created a long time ago for SMS 2003, and then modified for ConfigMgr 2007, also from my colleague Rick Houchins, and good friend Matthew Hudson, and most recently a post on System Center Central. I’ve met several admins who use these tools on a daily basis. FINALLY, we have some of the functionality built into ConfigMgr! One of the new features you will find in ConfigMgr R3 is the ability to Right-Click a Collection, and select Add Resources:

When you click Add Resources, the following dialog appears:

It has a similar look and feel to searching in Active Directory (at least it does to me…). I was slightly disappointed to see it default to “IP Network” (if you are too, you should file a bug on Microsoft Connect), as I almost always use “System Resource”.  Once I change the resource type to “System Resource”, I then enter a name (or partial name) into the first textbox, and hit “Search”. If found, the name, domain, and Site Code appear in the “Search Results” box. Click Add then OK to add the system.  You can also extend your search criteria by selecting Advanced—you will then be able to select additional attributes based on discovery data, such as AD Site Name, IP Address, System OU Name, etc. Also worth noting is that the membership rules are added as Direct Membership Rules.

If you’re like me, you often need to add more than one system at a time to a collection. You could easily accomplish this using the community tools mentioned above. Although it’s not obvious, you can actually perform a “bulk insert’ using the new Add Resources feature. Simply add each name (or partial name), separated by a comma. Here’s an example of two partial names:

I can then select Add and OK to add all the systems in the search result to the collection.

As you may already see, there’s one drawback to that as well, because you need all systems on one line in a comma-separated format. We commonly receive list of systems to add in email, or an Excel spreadsheet, one system per line.  You can easily transpose in Microsoft Excel, but if you’d like to transpose with PowerShell instead, use the following three lines of code (assume you have a file named siteservers.txt, with one server  name per line):

$a = get-content .siteservers.txt
$a | % {$b += $_ + ","}
$b.remove($b.length-1,1) | clip

The first line reads the file siteservers.txt in the current directory. For the second line, we create a new variable $b, and write each value from $a to it, followed by a comma. On the third line, we remove the last comma, and then pipe to clip.exe so that the results are copied to the clipboard.

View More Right-Click Community Extensions

Read About ConfigMgr R3 and Join the Beta

Greg Ramsey |  DELL

ConfigMgr MVP | DellTechCenter | @ramseyg | greg_ramsey@dell.com

My colleague Warren released  the Legacy Desktop Driver Pack for XP today (we released the Notebook Driver Pack at MMS 2010). You can find all Dell Driver Packs on DellTechCenter.

The legacy packs are at the bottom of the page – download the compressed file, extract and be sure to read the Readme.txt before you import!

Here are the supported models for the XP Desktop and Notebook Driver Packs:

Dell IT Legacy Desktop Driver Pack for XP

Optiplex 740*
Optiplex 745
Optiplex 755**
Optiplex GX620
Optiplex GX520
Precision Workstation T3400**
Precision Workstation T5400**
Precision Workstation T7400**
Precision Workstation 390**
Precision Workstation 490**
Precision Workstation 690**

Dell IT Legacy Notebook Driver Pack for XP

Latitude D420
Latitude D620
Latitude D820
Latitude D430**
Latitude D630**
Latitude D830**
Precision Mobile Workstation M90
Precision Mobile Workstation M65
Precision Mobile Workstation M2300
Precision Mobile Workstation M4300
Precision Mobile Workstation M6300

Greg Ramsey |  DELL

ConfigMgr MVP | DellTechCenter | @ramseyg | greg_ramsey@dell.com

I recently coauthored a Dell White Paper titled  Best Practices for Remote TPM Enablement for Dell Business Client Systems. This whitepaper shows multiple ways to enable TPM on Dell Business Client systems.  (Find Additional white papers on DellTechCenter). One method of enabling TPM presented is to enable TPM using a ConfigMgr OS Deployment task sequence (easily translated to MDT-speak also), using the Dell Client Configuration Toolkit.

For complete details, AND a sample ConfigMgr task sequence to import into your ConfigMgr environment, download the whitepaper!

Here’s a quick example to create your own task sequence to enable TPM on Dell systems:

1. Download and Install the latest version of the Dell Client Configuration Toolkit (CCTK)
   1. http://support.dell.com/downloads
   2. Select a business client model (Latitude, OptiPlex, etc)
   3. Under “Systems Management”, select the “Dell Client Configuration Toolkit”
   4. Extract and Install on a supported operating system.
2. Create ConfigMgr Packages for X86 and X64 CCTK
   1. Copy %ProgramFiles%DellCCTK* to a location that will be used for Configuration Manager. You will have two subfolders, x86, and x86_64.
   2. Create two ConfigMgr Packages, using the source directory for x86, and x86_64. Send to Distribution Points.
3. Create a ConfigMgr Task Sequence to Enable TPM. (download the whitepaper for the example Task sequence that you can import into your own environment, which includes conditional checks for running for the appropriate architecture (x86 or x64)). Create a task sequence step for each of these actions, referencing the appropriate source files from the CCTK. Here’s the sample task sequence:

In our sample task sequence, we created an x86 and an x64 group. Here, you can see the conditional statements we apply to the x86 group.

A BIOS password is required to enable TPM, so if you don’t currently have a BIOS password, you must set one (replace “temppwd” with your desired password):

Enable TPM:

After Enabling TPM we need to Activate TPM. Some models may require a reboot between Enable and Activate, so enable the “Restart Computer” step if needed.

To complete activation of TPM, a restart is required. You can skip this step in an OS Deployment script, as long as the system reboots later in the task sequence before you enable BitLocker.

You can enable BitLocker during the OS Deployment task sequence, as shown here:

For more information about enabling BitLocker, review the ConfigMgr online documentation (direct link to Enable BitLocker Task Sequence step). From the document, you will see that BitLocker requires two partitions. You can use the BitLocker Drive Preparation Tool (BdeHdCfg.exe) to reconfigure drives prior to enabling BitLocker. See http://technet.micro...026(WS.10).aspx for more information.

Also worth mentioning is that that the CCTK is fully supported in WinPE, so you could perform these tasks before booting the OS for the first time during an OS Deployment. If you execute any of these steps in WinPE, keep in mind that you may need to modify the conditional statements for the operating system, and instead use source files that match the architecture of WinPE (x86 or x64).

Greg Ramsey |  DELL

ConfigMgr MVP | DellTechCenter | @ramseyg | greg_ramsey@dell.com

I have this information posted on DellTechCenter also, but I thought it was valuable enough to share here again!  As you may know, there are several ways to get “raw” drivers for Dell Systems.  Here’s a unique (and one of my favorite) way(s) to extract for Windows, VMWare, and Linux! (I also see that Jeff Huston posted on this topic a couple years ago too!)

Many of the most popular Operating System Deployment tools use Plug and Play (PNP) to install hardware-specific drivers during OS Deployment to a Windows system. If you currently use Microsoft System Center Configuration Manager (ConfigMgr), take a look at the Dell Server Deployment Pack for ConfigMgr. If you use the Microsoft Deployment Toolkit (MDT), Windows Deployment Services, or any other Operating System Deployment technology, take a look at this process.

This document will walk you through the process of extracting Dell PowerEdge Server drivers so that they can be consumed by multiple OS Deployment processes.

1. Obtain the latest "Dell Systems Management Tools and Documentation" DVD.
2. Burn the DVD to disk, or use a tool such as Virtual CloneDrive to mount the drive as a local drive letter. (We'll call it D: for this document)
3. From the command prompt, navigate to D:server_assistantdriver_toolbin
4. Run make_driver_dir.exe --help to see the help info:
5. From the Example above, you can see that we're extracting drivers for the Dell PowerEdge 1855 for Server 2003 (x86)
6. To list full detail for platform and OS support, run the following command: make_driver_dir.exe -i d: --info | more
7. Note that the platform (model name) and OS are case sensitive (all lowercase). Here is a list of current platform and OS keywords (for an updated list, execute the following from the command prompt (showing models for PowerEdge R810 for example): make_driver_dir.exe -i D: -p per810 --info

8. OS Code	OS Description
   w2003sbs	Microsoft Windows Small Business Server 2003 Service Pack 2
   esx410	VMware ESX 4.1
   iesx400	VMWare ESXi 4.0 Update 1 HDD
   rh50_64	Red Hat Enterprise Linux (version 5 Update 3) x86_64
   esx310	VMware ESX 3.5 Update 4
   w2008ebs_64	Microsoft Windows Essential Business Server 2008 x64 (64 bit Edition)
   suse10_64	SUSE Linux Enterprise Server 10 SP2 x86_64
   w2008	Microsoft Windows Server 2008 x86 (32 bit Edition)
   w2008_64	Microsoft Windows Server 2008 x64 (64 bit Edition)
   w2008sbs_64	Microsoft Windows Small Business Server 2008 x64 (64 bit Edition)
   w2003_64	Microsoft Windows Server 2003 Service Pack 2 x64 Edition
   w2000	Microsoft Windows 2000 Server Service Pack 4
   rh50	Red Hat Enterprise Linux (version 5 Update 3) x86
   w2003	Microsoft Windows Server 2003 Service Pack 2
   rh40_64	Red Hat Enterprise Linux (version 4 Update 7) x86_64
   suse11_64	SUSE Linux Enterprise Server 11 x86_64
   rh40	Red Hat Enterprise Linux (version 4 Update 7) x86
   Citrix
   w2008r2_64	Microsoft Windows Server 2008 x64

    
9. Execute make_driver_dir.exe -i d: --info | more for the Platform Support Matrix

   Command Line

   Description

   make_driver_dir.exe -i d: -d c:drv -p per900 -o w2008 --extract
   Extracts the PowerEdge R900 drivers for Windows Server 2008 x86 to c:drv

   make_driver_dir.exe -i d: -d c:drv -p per900 -o w2008_64 --extract
   Extracts the PowerEdge R900 drivers for Windows Server 2008 x64 to c:drv

   make_driver_dir.exe -i d: -d c:drv -o w2008_64 --extract
   Extract drivers for all platforms that support Windows Server 2008 x64

   make_driver_dir.exe -i d: -d c:drv -o w2003_64 --extract
   Extract drivers for all platforms that support Windows Server 2003 x64

   make_driver_dir.exe -i d: -d c:drv -o w2003 --extract
   Extract drivers for all platforms that support Windows Server 2003 x86

10. The following image shows the drivers that are extracted (in raw format) when using make_driver_dir.exe command.
11. 
12. Next, if you’re using ConfigMgr 2007, you can right-click on Driver Packages in the Admin Console, and select New->Driver Package.  Select the extracted directory, and you’ll have all the drivers for that model and platform!

So, we started out with a rough day yesterday…Our offloaded NLB management point was having trouble connecting to our offloaded SQL server for one of our ConfigMgr 2007 sites. (yes, that’s a bit of offloading….). It really felt like a permissions/SPN issue. After looking at MP_Framework.log on each of the NLB MPs, we saw a couple different errors:

“CMPDBConnection::Init(): IDBInitialize::Initialize() failed with 0x80004005”

Clicking on the line that starts with MPDB ERROR, I see the following:

“[DBNETLIB][ConnectionRead (recv()).]General network error. Check your network documentation.”

Wow – in hind-sight, that seems pretty obvious – it didn’t at the time.  To make a few-hours-long story short, we saw that our database server had unusually high Network Utilization of over 50%.  We also saw that the higher the utilization, the more errors we saw on our NLB MPs (and secondary sites) in the MP_Framework.log file.

We then found the following in the System Event Log

“Broadcom BCM5708C: Network controller configured for 100 MB half-duplex link.”  That’s our issue – our network port is definitely not configured for 100/Half…  I’ve been told this is a ‘known issue’, but haven’t yet found it documented yet – so if you have any information, please share.

So, to do a quick check on other servers, I decided to run a PowerShell query – here’s the sample command line:

get-winevent -filterhashtable @{LogName="System";ProviderName="l2nd"} -computer myServerName | ft –autosize

This example queries “myServerName”, in the System Log, for Provider Name (a.k.a. Source) = “l2nd”, which is from a BroadCom NIC. To customize this a little more, I searched for only ID=8, and I also decided to sort descending based on the TimeCreated field.:

get-winevent -filterhashtable @{LogName="System";ProviderName="l2nd";ID=8} -computer myServerName| Sort-object  `TimeCreated –descending

This allowed me to easily identify other servers that have encountered this issue. Luckily, it was only this one server.

Appendix A of this BroadCom Doc describes all the event log messages that are written to the System log by BroadCom.

More information on the get-winevent cmdlet. 

We then configured the NIC properly, and all is well now.

Greg Ramsey |  DELL

ConfigMgr MVP | DellTechCenter | @ramseyg | greg_ramsey@dell.com