Kwan's System Center Experience

The Story of The Great Battle with the Security Hardening Policy

2011-10-29T13:36:00.001+08:00

It’s been a while since I last posted on my blog. I am reigniting my blog posting initiative and to kickstart things off, I have changed the blog template to something which I hope to be more refreshing. Hope you liked it.

Lets get serious and back to business.

Recently, me and a colleague of mine encounters an problem with our OpsMgr installation setup. We have problems launching our Web Console as well as RMS having problem communicating with Data Warehouse.

When you launch your Web Console, you will get an error with the following description:

This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

The workaround to resolve this was to

Goto the SCOM Web Console folder

Edit Web.Config with a text editor

Locate the <system.web> section and add the following into the section

<machineKey validationKey="AutoGenerate,IsolateApps" decryptionKey="AutoGenerate,IsolateApps" validation="3DES" decryption="3DES"/>

Save the Web.Config file

Restart IIS

Note: Repeat the steps above with the SSRS folder in your server that hosts the SQL Reporting Services

More information available from: http://support.microsoft.com/kb/911722

Announcement: SCOM 2007 R2 Admin Reskit Released

2011-06-04T08:54:00.001+08:00

The Administrator Resource Kit for SCOM 2007 R2 has just been released. It provides SCOM administrators with the following features

Scheduled Maintenance Mode

Clean Mom

MP Event Analyzer

This is a must have for SCOM administrators especially for those who wants to schedule maintenance mode for their servers during scheduled maintenance windows

For more details about the release, please visit the SCOM Team Blog

http://blogs.technet.com/b/momteam/archive/2011/06/03/system-center-operations-manager-2007-r2-admin-reskit-released.aspx

Of Property Bags & Custom Performance Rules

2011-05-16T20:32:00.001+08:00

This might not be the best kept secret with OpsMgr especially for those who had experience creating custom monitors/performance in OpsMgr.

Although OpsMgr provides many avenue to collect monitoring information on monitored systems (either via WMI, Perfmon etc), nevertheless at times there are still a need for us to collect information that is not available directly … or maybe the collected data needs a bit of manipulation before sending it to OpsMgr.

In this example, I will just share a simple scenario where we need to collect % Disk Utilization for a Logical Disk in a server. (Albeit OpsMgr already collects % Free Space, but I am going to flip things around in this scenario)

Let’s start things by exploring how do we get the necessary information to compute % Disk Utilization?

This is where our good friend Windows Management Instrumentation (WMI) comes into the picture. Many would know that WMI is a big repository class which stores the management information on the systems host and in this case, we need to query WMI to retrieve the information related to Logical Disk utilization.

There are many ways to achieve this (e.g Powershell, Scripts etc.) but being an old school VB guy, I will resort to VBScripts to do this.

The following are the excerpts for my code.

Const HARD_DISK = 3
Dim counter, strComputer
strComputer = "."

‘ Connect to the WMI class of root\cimv2 (which provides the systems information that we need)

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")

‘ Query WMI to retrieve all Logical Disks in the local computer

Set colDisks = objWMIService.ExecQuery _
("Select * from Win32_LogicalDisk Where DriveType = " & HARD_DISK )

‘ Iterate each Logical Disk (e.g C:\ D:\ etc & Provide the Size of the Disk)

For Each objDisk in colDisks

‘Compute Disk Utilization = (Size – Free Space)/Size
l_pct_util = ((objDisk.Size - objDisk.FreeSpace)/objDisk.Size) * 100)

Next

Now we have the script to collect Disk Utilization, my next posting will show how we will modify this script to collect performance data to OpsMgr using Property Bag.

Creating SNMP Performance Collection Rule

2011-05-05T13:08:00.001+08:00

Many folks out there will bump into this problem when they tried to create a Performance Collection Rule and target it to a custom SNMP Device Group.

Let me give you an example here:

I have a group of Extreme Network Switches that I need to collect the temperature for these devices. Hence I created a Group that consist only the Extreme Network switches.

Then like most people, you will just go over to create an SNMP collection rule to collect the performance and will target the rule to the SNMP device –> Only to encounter error when you try to Create the rule.

How to resolve this:

One workaround that I tried was this. When you create the rule, instead of targeting the custom Group, target to the SNMP device. But DO NOT enable the rule.

This will create a Rule that is Disabled by default. Now you just need to Override this rule and target back at the Extreme Network Switch and set to Enable it.

This should get things working.

Unable to execute .js file for Object Discovery in OpsMgr

2011-05-03T13:40:00.001+08:00

Noticed that one of my monitored servers is giving up warnings on Health Service Modules

Looks like we have encountered issues on CScript executions on .JS files.

I went on further to the working folder and execute the .js script and I got hit with the following error

Input Error: There is no script engine for file extension ".js".

I then proceed to open command prompt and type

ASSOC .js

and looks like the .js file is associated incorrectly.

Go back to command prompt and reassociate .js file

ASSOC .js = JSFile

Restart Health Service and this should do the trick.

The Day IT Security Policy Gave Me The Banana Skin

2011-03-12T13:14:00.001+08:00

Ever wondered that one day you will be given the “warm” welcome by the IT security team because of their unique security policy.

I was trying to deploy some OpsMgr agents to some servers which sits in DMZ. No worries, just open the firewall and we are clear to go. Discovery Wizard got it, agent installation successful and we should expect them to show up in Monitoring soon … but hey, wait a sec … why the agent version is unknown and the health status is Grey (unable to contact agent)

Lets take a look at the Agent Patch version. Its supposed to be CU4. Ouch, the server does not have the version detected. Not Good

Lets go in to the monitored server and have a look at the event viewer. Wow! I get tons of event 21400. Discovery scripts kept failing because it cannot find the CScript.exe file to run the VBS scripts.

When I look at the folder, wow CScript.exe is missing. No wonder SCOM cannot execute the discovery scripts

A quick chat with the administrator, apparently once upon a time. Their security team has this policy of not allowing system executable file to reside in C:\Windows\System32 folder. Anyways that policy does not apply now and we just need to copy the file back to System32 folder.

To be safe, I restarted the Health Service on the monitored server to kickstart discovery tasks immediately. Within a minute … it worked like a charm.

Opalis Active Directory Integration Pack cannot work in Windows Server 2008 R2?

2010-12-29T17:07:00.001+08:00

If you all are planning to deploy have Active Directory related policies to be executed on Opalis running on Windows 2008 R2 server, chances are; you will be dissapointed because the Integration Pack that ships with it only supports 32 bit OS.

We all know that Windows Server 2008 R2 runs on 64 bit and this MS Active Directory v2 Integration Pack would not run.

Nevertheless, there is a similar Active Directory Integration Pack available in CodePlex authored by randofer.

It should work.

http://opalisadextension.codeplex.com/

Unable to access SCOM Web Console

2010-12-28T13:09:00.001+08:00

If you install your Web Console on a server which is not an RMS, chances are you might get hit with this issue.

When you try to access the Web Console, you will be asked to enter your credentials even though you have configured your Web Console IIS settings access as Integrated Windows Authentication.

You will notice after entering your credentials 3 times, your web browser will show

“You do not have have permission to view this directory or page”

To resolve this:

- Launch the Active Directory Users And Computers MMC Snap-In

- Open the Computer Object for the Web Console server,

- Click on the Delegation tab

Check the “Trust this computer for delegation to any service (Kerberos only)”

Try to access your web browse and it should work now

Introducing System Center AVICode

2010-12-17T22:09:00.001+08:00

It has finally arrived! Ladies and Gentleman … it is official. AVICode is now the latest addition in the System Center solution suite.

AVICode has been a leading application monitoring system that enables you to monitor your application up to code level … yes you read it correct … CODE LEVEL … will now be made available under the System Center Management Suite.

In the next couple of weeks, I will share my experience on the latest AVICode which runs on version 5.7 on how it monitors .NET application.

AVICode also provides a Management Pack that can pump the monitoring data to be viewed by System Center Operations Manager console thus giving you a total end-to-end application monitoring covering both the infrastructure as well as the development end!

Stay Tuned !!!

Troubleshooting Certificates Errors when you install Cross Platform Agents in SCOM

2010-12-05T09:59:00.001+08:00

Objective:Install Cross Platform agent to a Red Hat Linux Enterprise Server v5.4

Issue Faced: When you are about the install your agent into the Linux server … and you get hit with a failed installation with the following error.

The SSL certificate contains a common name (CN) that does not match the hostname.

Potential Cause: There are many reasons for such an error. But we can pretty much be sure that this revolves around hostname for the Linux server.

Troubleshoot the Issue:

From the Linux server, launch your terminal console and type the following

openssl x509 -noout -in /etc/opt/microsoft/scx/ssl/scx.pem -subject -issuer –dates

Now you can clearly see that the problem here is that the CN is webproxy.contoso.com

(A bit of history, I have previously used this Linux server in another environment and have installed Cross Platform in it but since then I have changed the FQDN for the server)

Resolution:

To resolve this, we will need to change the Subject Name in the certificate to RHEL.SystemCenter.local

To do this, execute the following command

/opt/microsoft/scx/bin/tools/scxsslconfig -f –v

(This will change the host name and re-create the certificate and private key)

Re run the query of the certificate CN

Let’s retry the re-installation of the agent.

Voila ! Worked like a charm

Opalis Integration Pack for SharePoint

2010-12-03T09:12:00.001+08:00

This Integration Pack which was released a couple of back provides the integration with SharePoint that you manipulate SharePoint Lists and Libraries.

For more information, have a look at:

http://opalis.codeplex.com/releases/view/56094

Integrating Opalis with SCVMM

2010-11-26T22:45:00.001+08:00

Though I openly profess my love for Opalis, I got to say there are still much room for improvements and if you ask me … the first thing in my mind would be documentation.

Yes, we were given powerful orchestration objects that integrates with different management systems but what lacks is the documentation on how to set things up. Well, I am not going to whine alot here but to concentrate on just blogging on how to get Opalis to integrate with SCVMM.

Out of the box, the SCVMM Integration Packs offers a rich set of VMM functionalities ranging from creating VM to Remove VM as depicted below.

Now in my previous postings, I have shared with you on installing Opalis and deploying Integration Packs. This posting basically revolves around getting those Integration Packs to work and I am going to start with SCVMM, not that this is the first that I have tried but the first that actually gave me some time to crack my head and get it working !

Now in essence there are a couple of ways to integrate Opalis with SCVMM;

Connect via WinRM (Remote)
Connect locally (Requires VMM Console to be installed in the Action Servers)

Approach 1: Win RM

The first approach requires you to configure a couple of things on VMM Server as well as your Action Server.

In your VMM Server, Open your command prompt and run the following command

winrm quickconfig

Then launch Windows Powershell and run the following command

set-executionpolicy –ExecutionPolicy RemoteSigned

Now for each of your Action Servers, run the following command in the command prompt

winrm quickconfig

And followed by

WinRM set winrm/config/client @{TrustedHosts="RemoteHost"}

RemoteHost = FQDN of your VMM Server

Once that is done, launch the Opalis client console and goto Options –> System Center Virtual Machine Manager

In the Prerequisites configuration click Add and enter the necessary information.

Computer Name = VMM Server name
User: User Account which has administrator rights on VMM
Domain:AD Domain
Password: User Password
VMM Server = VMM Server name

(Leave others as default)

Now lets get it rolling … to test whether your connection works drag an object from the VMM IP to the workbench and try to connect

Now many of you might be wondering, how come my account does not have enough rights to access VMM (especially that account is the VMM admin !!!)
Now let’s revisit the connection page again … this time remove the user credentials …

And if we try things again … and this time it works … so much for entering the user credentials eh.

Now I try to make a logical explanation behind this and yet I still can’t find any that makes sense … but hey … .as long as it works right !

Approach 2: Connecting Locally

Unlike the previous approach, you just need to have VMM console installed in the Action Server and you are clear to go.
You do not need to set WinRM configurations on your VMM as well as your Action Servers to do so.
Nevertheless, the “rule” for setting up the connection settings to VMM still applies …

Hope this gets you guys rolling and have fun exploring Opalis-SCVMM !

Unable to load Active X Control in Self Service Portal–Request Software module

2010-11-24T22:14:00.001+08:00

In Self Service Portal, when you try to request for a Software Request (Self Service Software Request) you will be prompted that Active X control cannot be loaded.

To resolve this, you need to install the PortalClient.msi file which is located in the installation CD

Once you have that install .. you are clear to go …

Service Level Management in Service Manager 2010 ? YEA ! You better believe it !!!

2010-11-24T20:02:00.001+08:00

Noticed something different in my Incident Form? Yes, for those who have been playing with Service Manager 2010, you will surely noticed that … wait for it … wait for it … Yes ! an SLA component in the Incident form !!!

Many would be surprised that since when Service Manager has a SLA module?

Let me introduce SLA Management Pack for Service Manager from Cased Dimensions.

Like many SLA module, the SLA MP provides you to create the SLA policies to be attached to your Incidents, Change & Problems in Service Manager.

You can flexibly setup your working calendars for different business units to accurately measure your SLA against your official working hours in your organization.

Now with this Management Pack, Service Manager is ready to be join the big boys in the ITSM realm … bring it on !!!

For more information about the SLA Management Pack for Service Manager, have a look at

http://www.caseddimensions.com/service_manager_SLA_management/

Installing Opalis Part 3 – Upgrading to Opalis 6.3

2010-11-23T20:33:00.001+08:00

Let’s get straight into action shall we …

Extract the Installation resource for Opalis 6.3
Open the Management Server installation folder. By default, this is located in C:\Program Files\Opalis Software\Opalis Integration Server\Management Service. Browse to the Components\Objects folder.
Copy the OpalisIntegrationServer_FoundationObjects.msi file provided in this release to the System Drive:\Program Files (x86)\Opalis Software\Opalis Integration Server\Management Service\Components\Objects directory. Replace the existing file.
Uninstall the existing Foundation Objects via Add/Remove Programs
Reinstall the Foundation Objects from the newly copied source.
Run the OpalisIntegrationServer_ManagementService_630_PATCH.msp installer. Do not change any of the default values.

Now let’s deploy the Action Servers in our Opalis server

Click Run, click Programs, click Opalis Software, click Opalis Integration Server, and then click Deployment Manager.

In the Deployment Manager console, Right Click at Action Server and select Deploy New Action Server

In the Service Information screen, enter the name of your Action Server and enter a user which will be the action account.

Proceed throughout the entire wizard setup by accepting the default values to kickstart the deployment

After you deploy the clients from the Deployment Manager, copy the OpalisIntegrationServer_Client_630_PATCH.msp file included in this release to each client

CONGRATULATIONS !

YOU ARE NOW AT OPALIS v6.3

Installing Opalis Part 2 – Upgrading to Opalis 6.2.2 SP1

2010-11-23T20:03:00.002+08:00

In Part I of my posting, I have shared with you on the steps to install Opalis 6.2.2.

In this part, I will share with you on the SIMPLE steps to upgrade to SP1

Start off by extracting the installation source which is the \Opalis Integration Server 6.2.2 Service Pack 1_6.2.2.51310
Execute the OpalisServicePack1.msi file
Choose to unzip the installation files to a folder eg:C:\OpalisSP1
Navigate to the installation folder of Opalis, eg:

C:\Program Files (x86)\Opalis Software\Opalis Integration Server\Management Service\Components\Objects

Replace the existing OpalisIntegrationServer_FoundationObjects.msi file with the OpalisIntegrationServer_FoundationObjects.msi file provided in this service pack.
In Add or Remove Programs, uninstall Opalis Integration Server - Foundation Objects.
Run the OpalisIntegrationServer_FoundationObjects.msi installer. Do not change any of the default values on the installation screens.

Congrats, you have upgraded Opalis to SP1. As I said … Simple right

Installing Opalis Part I – Opalis 6.2.2

2010-11-22T23:00:00.002+08:00

WARNING: This POST IS A LONG EXHAUSTIVE ONE AND YOU HAVE BEEN FOREWARNED

The recent release has created many waves throughout the entire System Center community and I wanted to share some of my experiences throughout my journey exploring Opalis since it joined the System Center familiy. And I would like to start my sharing with some postings on the installation steps for Opalis from 6.2.2 –> SP1 –> 6.3

Now in Part I, I will commence with the installation of Opalis 6.2.2, the very first version of Opalis since it joined the good old System Center family

To kickstart things, my Opalis server runs on Windows 2008 R2 (x64) and has been installed with MS SQL Server 2008 SP1 (x64)
You will also need Windows PowerShell 2.0 installed (to automate Operator Console installation)
Once that is done, extract your installation resources
The installation version would be \Opalis Integration Server 6.22_6.2.2.5229 as depicted in the picture below

Kickstart Installation by executing the Setup.exe
Click on Install Opalis Integration Server

On the next screen, click on Install the Management Server

Accept the Licensing Agreement and goes Next
Proceed with defaults until you reach the Logon Information step. In this step, you need to provide a valid user account that will be used by the Opalis Management Service (basically that is your Service Account). Enter a valid user and proceed to commence installation of the Management Server.

The next thing you need to do is to configure the datastore (which simply means configure the Opalis DB). Simply click Configure Datastore to commence the process

The next screen will need your input the select which database will host the Opalis DB and since we LOVE Microsoft so much … I will choose MS SQL Server and proceed

Now in the Server details, enter the DB server and the authentication method and proceed (In this case, my SQL is the same as the Opalis server and I have set to use Windows Authentication during the installation of SQL Server)

Give the name for the Opalis DB and proceed to let installer do the rest.

The next step is to import a license for Opalis. In the License Manager, click on Import. When prompted to Import license, enter the license key and the corresponding license file made available for you either as a customer or an evaluator. Once you are don, click Close

The next thing that you want to do is to Install the client

Accept the license terms and accept defaults and let the rest roll by itself.

AND YOU THOUGHT IT’S ALL DONE SO EASILY ??? THINK AGAIN … YOU HAVE JUST GONE THROUGH THE EASY PART.

When I first started to install Opalis, I dreaded the way they forced us to install the Operator Console because unlike the always easy Microsoft Wizard based approach, we are tasked to “install” the Operator Console by a series of copy & paste of java object which is SIMPLY PAINFUL
Even preparing the installation for Operator Console is a bitch simply because you need to manually prepare the pre-requisites which would be:
Download JDK 6 Update 4 from http://java.sun.com/products/archive/
Download JBoss Application Server 4.2.3.GA from http://jboss.org/jbossas/downloads/
Then you have a very long list of Pre-Requisites of Java Objects that is scattered all over the internet which I am kind enough to download and made available for you at my SKYDRIVE folder at http://cid-8b468d6e5c4e0782.office.live.com/browse.aspx/Opalis%20Pre-Req
Well, apparently things have changed when SP1 was rolled out where our lives are made abit easier where Microsoft provides us with an installation script to automate the installation steps.
Extract the Installation Resources for the following \Opalis 6.2.2\Opalis Operator Console Installer Script 1.0_1.0.0.0001
Run the OpalisOperatorConsoleInstaller.msi file
Create a new folder C:\Libraries

Copy all the pre-requisites file that you have downloaded from my skydrive into this folder

Install Java Development Kit 6 Update 4 by using the default settings.
Set the JAVA_HOME system variable to the directory of the local Java Development Kit. By default, the location is C:\Program Files\Java(x86)\Jdk1.6.0_04.
Add %JAVA_HOME%\bin to the Path Environment variable.
Extract the contents of the JBoss Application Server 4.2.3.GA to the folder where the JBoss Application Server will run. Eg C:\JBoss.
Launch the command prompt, change to the C:\Libraries folder and run the command

java -jar JAXWS2.1.2-20070917.jar.

A license dialog box appears.Accept the Sun Microsystems, Inc. License Terms. The JAXWS2.1.2-20070917.jar file will be unpackaged.
Confirm that the \Jaxws-ri\Lib folder was created.
Click Start, click Programs, click Accessories, click the Windows PowerShell folder, and then click the Windows PowerShell item.
At the Windows PowerShell prompt, type

set-executionpolicy RemoteSigned.

Type the full path to the location where you installed the InstallOpConsole.ps1 file. For example, C:\OpConsoleInstaller\installOpConsole.ps1

Follow the on-screen prompts. You will be asked to provide configuration information, for example:

a. The full path to the location of the \JBoss folder.

b. The full path to the location of the \OperatorConsole folder.

c. The full path to the location of the \Libraries folder.

d. The database type (Microsoft SQL Server or Oracle).

e. The name of the database server, for example, localhost.

f. The database authentication type (Windows authentication or SQL Server authentication). For SQL Server, provide the user name and password.

g. The name of the Opalis database.

h. The user authentication type (Stand-alone or Active Directory). For Active Directory, provide the Active Directory root DN, Domain Controller, Port, and SAM account name for the administrator group.

When the Operator Console installation complete message appears, click Close
Start JBoss by executing the following command in the <JBOSS>\bin folder:

run.bat -b 0.0.0.0

Ladies and Gentleman, you will know that the Operators Console installation is successful when you see the following:

Now I will end the rather exhaustive post on this Part I and will continue with the next Part where I will share how do you patch Opalis to SP1.

Note: I will only deploy my Action Servers & Integration Pack once I am done with the installation up to version 6.3

Till then …. STAY TUNED.

What else do I need to do to protect my SharePoint 2010 Server

2010-11-21T23:39:00.001+08:00

I got hit with this problem when I was trying to create a Protection Group in DPM to protect our SharePoint 2010 server in our R&D lab. I have already did the necessary pre-requisites on the SharePoint server such as:

ConfigureSharepoint.exe –enableSharepointProtection
ConfigureSharepoint.exe EnableSPSearchProtection

However I still got hit with the error of not meeting the pre-requisites when I tried to create a new protection group for SharePoint

I went over to the SharePoint Server and noticed that DPM agent could not find the registry key that denotes the SharePoint version:

HKLM\SOFTWARE\Microsoft\Share Tools\Web Server Extensions\14.0\Version

I immediately go to the Regedit and yes indeed that the registry key value is not there. I manually added a new String Value and named it as Version and give the value as 14.0.0.4762.

Go back to DPM console and Voila ! it works !!!

Opalis 6.3 is released

2010-11-21T22:53:00.005+08:00

I have been following on Opalis since it was bought over by Microsoft earlier this year and has been impressed by what it can do since. And with the recent release of Opalis, the version 6.3 now supports Opalis installation running on Windows Server 2008 R2 (Yes, unfortunately as at Opalis 6.22 SP1 we can only run them from Windows 2003 which some of my customers gives the evil grin smile). Another noteworthy addition is the introduction of Integration Packs to support Microsoft Sytem Center Suite of products namely:

System Center Configuration Manager 2007 (which supports SCCM 2007, SCCM 2007 R2 & SCCM 2007 SP2)
System Center Operations Manager 2007 (Support for OpsMgr 2007, OpsMgr 2007 R2 has already been there since Opalis 6.2.2 and as of installation on 6.3 I have not seen additional objects)
System Center Data Protection Manager
System Center Virtual Machine Manager
System Center Service Manager 2010

Those who are interested can download the 180 day trial from

http://www.microsoft.com/systemcenter/en/us/opalis.aspx

I have been lucky enough the be able to participate in the BETA testing of version 6.3 and honestly I feel that the new IPs are extremely interesting to explore on. Honestly, Don't expect the IPs can do wonders and and able to automate/integrate with all the functionalities of the System Center products as its still V1.0.

As I am working on Opalis for quite some time, I do have some thoughts that I hope to share … stay tuned.

OMG !!! I can't monitor new servers in OpsMgr

2010-09-07T17:29:00.004+08:00

Recently I bumped into this problem. Apparently every new servers (that is being installed with SCOM monitoring agent) cannot be monitored by SCOM. You can clearly see from the OpsMgr console that I have tons of servers with the status of Not Monitored.

Bad News + Tension = ~non stop sweating~

I checked all my agent communication ports and nothing is wrong. My Management Server event logs doesn't show any significant errors. The only thing I got was heaps of

Event 20070
The OpsMgr Connector connected to (RMS FQDN), but the connection was closed immediately after authentication occured. The most likely cause of this error is that the agent is not authorized to communicate with the server, or the server has not received configuration. Check the event log on the server for the presence of 20000 events, indicating that agents which are not approved are attempting to connect.

Event 21023
OpsMgr has no configuration for management group (managementgroupname) and is requesting new configuration from the Configuration Service.

Event 21402
Operations Manager has discarded 1 items in management group (managementgroupname) , which came from $$ROOT$$. These items have been discarded because no valid route exists at this time. This can happen when new devices are added to the topology but the complete topology has not been distributed yet. The discarded items will be regenerated.

Not long after that, my RMS starts to generate heaps of Warning in the Event Viewer. I get tons of
Event 29106 indicating problem writing data into the OpsMgr database. Somehow I got an impression that something is not right the Management Pack.

I made a query to the OpsMgr database to look for which Management Pack that was affected and apparently something is amiss with the Windows Server 2003 MP in my case.

I quickly look back at the Management Pack and the Windows Server 2003 MP is not updated whilst the Windows Server Operating System library has been updated. Maybe certain objects was removed from the data structure when the new Base OS library was updated but then the Windows Server 2003 MP was not updated to tally with the changes done.

I updated the Windows Server 2003 Management Pack and all is well. The new servers have successfully reported back to the system and problem solved !

Synthetic Transaction: Cannot find Web Recorder in Internet Exploer

2010-09-02T13:35:00.006+08:00

Issue:
When you start to capture a web session (for the application that you want to monitor, the browser does not load the Web Recorder component hence you could not capture the web session that you intend to monitor.

Cause:
This happens if you try to record/capture the session on a x64 machine. This is because you need to launch Internet Explorer (x64) to get Web Recorder loaded.The default path of Internet Explorer is actually the x86 version hence the Web Recorder component could not be loaded.

Resolution:
Change the default path of Internet Explorer by changing the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE\(Default)

The key value should be - C:\Program Files\Internet Explorer\IEXPLORE.EXE

Note: Internet Explorer needs to be close and reopen (if its open existingly). Once you are done, click on Start Capture from the Web Application Editor and the browser will now

Service Manager Authoring Console 2010 is Released

2010-08-16T10:55:00.003+08:00

The long awaited release of Service Manager Authoring Console has been released. With authoring console, we can now easily create & customize forms and workflows in Service Manager.

Download link is provided below.

http://www.microsoft.com/downloads/details.aspx?FamilyID=40b8f1b7-da63-46ae-9ca4-ef007fc3cb29&displaylang=en

Remote Configuration Manager Console cannot view advertisements

2010-08-05T12:06:00.004+08:00

When you install Configuration Manager console on a remote machine, you will not be able to view the advertisements from the console.

Thanks to the following article which enlightened me on what I should do to rectify this issue.
http://blogs.technet.com/b/configurationmgr/archive/2010/03/11/fix-no-advertisements-are-listed-in-the-sccm-console-on-a-remote-machine-but-they-do-show-up-on-the-site-server-itself.aspx

Apparently, a file AdminConsole.xml which defines the viewing rules for the SCCM console has an incorrect query to retrieve the Advertisements.

Incorrect Query :
SELECT * FROM SMS_AdvertisementInfo WHERE NOT (AssignmentID = NULL) ORDER BY AdvertisementName

Correct Query :
SELECT * FROM SMS_AdvertisementInfo WHERE NOT (AssignmentID IS NULL) ORDER BY AdvertisementName

Now instead of installing the hotfix, I did it in a much faster way since it's just modifying the xml file.

Open the XML folder location eg:C:\Program Files\Microsoft Configuration Manager Console\AdminUI\XmlStorage\ConsoleRoot

Edit the AdminConsole.xml file (by opening it via NotePad)
Search for the Incorrect Query (as mentioned above)
Replace it with the Correct Query (as mentioned above too)
Save the XML file
Restart your console

Voila' ... the advertisement is being listed now.

Root Management Server unavailable

2010-08-02T15:29:00.003+08:00

This is more of a nooby posts, nevertheless I would still try to share it out to starters who have encountered this issue in their environment.

Got hit with this problem recently where out of sudden my RMS went unavailable and before you know it I got this alert .

A quick check on my Event Viewer shows that I got tons of Event 2115 .

After a quick check on things, I noticed that something is amiss and it proved to be caused by my OpsMgr DB settings. Apparently by default, my OperationsManager DB has a file growth restriction and it seems that my DB hit the limit and thus no new monitoring data could be inserted into the Database.

Just go over and set the File Size to unrestricted growth and that did the trick.

Error Accessing ACS Reports: Cannot create connection to data source

2010-05-10T10:33:00.004+08:00

This is something that I wanted to share out for quite some time but it just flew out of my mind until I got hit with this problem recently that I force myself to blog it NOW before I suffer from memory lapse syndrome.

Now, a bit of background here; the OpsMgr environment that I am working in has RMS, DB, DW + Reporting, ACS Collector & ACS DB all deployed into 5 different servers. Now with best practice in mind you would normally have a Data Reader/Data Write account created for your Data Warehouse action accounts. However the same was not stressed with the ACS Database. So what entails then?

So now you have successfully uploaded the ACS reporting components to the Reporting Server you would thought that you are ready to generate the ACS reports? Well, not exactly because you will most likely hit with your report giving you the following error.

From the looks of things, it seems that your report has problems creating a connection to the data source. Now what could be the problem?

Because you have a specific Data Reader account that accesses your Data Warehouse tables/views but this does not apply to ACS Database and because your Data Reader does not have access rights to the ACS Database, your connection will fail.

What would be the workaround for this?
The workaround for this is relatively simple, you would just need to access the SQL Server Reporting Services for the Reporting Server via your internet browser.
For example: http://reportingservername/reports

From the SQL Server Reporting Services Home page, click on Audit Reports
Inside Audit Reports, click on Show Details. You shall see DB Audit appears on the screen
Click on DB Audit to launch the setting properties
Scroll down to Connect Using, and select Credentials stored securely in the report server
Enter the User credentials that has access to the ACS Database.
Click Apply to store the settings.

Once you have saved the settings, exit browser. Relaunch the OpsMgr console and now you will be able to access the ACS reports without much problem.

Service Manager 2010 has RTMed !!!

2010-04-21T23:21:00.003+08:00

Just moments ago, Service Manager 2010 has been RTMed. A product which is very dear to my heart, I have been working on it since its Beta1 days and now with the RTMed version I am happy to see such a wonderful product being shipped to the end user.

http://blogs.technet.com/servicemanager/archive/2010/04/20/announcing-system-center-service-manager-2010-rtm.aspx

UNIX Noob trying to deploy OpsMgr to monitor Sun Solaris

2010-04-02T11:37:00.005+08:00

The title says it loud and clear ... me being a UNIX noob learnt some new stuffs today.

Mission Objective: Deploy OpsMgr to monitor Sun Solaris
Target Environment: Sun Solaris 10
Mission Target: Monitor Sun Solaris 10 OS & Oracle DB running in it.

So to start things, make sure that the Sun Server met the following requirements especially on the OS patch !

Required Package	Description	Minimum Version
Required OS patch	PAM memory leak	112960-48
SUNWlibC	Sun Workshop Compilers Bundled libC (sparc)	5.9,REV=2002.03.18
SUNWlibms	Forte Developer Bundled Shared libm (sparc)	5.9,REV=2001.12.10
OpenSSL	SMCosslg (sparc) Sun does not provide a version of OpenSSL for Solaris 9 SPARC. There is a version available from Sunfreeware.	0.9.7g
PAM	Pluggable Authentication Modules SUNWcsl, Core Solaris, (Shared Libs) (sparc)	11.9.0,REV=2002.04.06.15.27

As for OpsMgr pre-req, besides the installation pre-req; you need to ensure that you have the relevant RunAs Accounts created, correctly distributed & attached to the Run As Profiles for the Unix Servers.

Detailed steps available here in the following URL:
http://technet.microsoft.com/en-us/library/dd788981.aspx
Next, I manually installed the Cross Platform agent

Transfer the agent (scx---.pkg.Z) to the Solaris server.

scx---.pkg.Z
Run the following command:

uncompress scx---.pkg.Z
To install the package, type

pkgadd -d scx---.pkg MSFTscx
To verify that the package is installed, type

pkginfo –l MSFTscx
To verify that the Microsoft SCX CIM Server is running, type

svcs scx-cimd

Full details on Manual Installation of Cross Platform agents is available in the following link:
http://technet.microsoft.com/en-us/library/dd789016.aspx

Note: Remember to jot down the hostname of the server. This is extremely important especially for certificate issueance. If your DNS server does not include the Sun Server hostname in the DNS record, you need to manually enter this hostname into the OpsMgr RMS server hostfile.

Now back in OpsMgr, run the discovery for the UNIX/LINUX Server. Now the catch here; you will need to communicate with the Sun server via SSH. I was given a root account to discover the Sun server and in most circumstances as well as a default behavior; root account is not permitted to access via SSH. (Security Issue).
So your option is either to use another account or enable root account to login via SSH (which I will share in my next post)

The moment your Sun server is being discovered, you will be prompted to Sign the certificate; select the Sun server checkbox and click on Sign. A successfully signed certificate will bring you to the next screen which show you that the Sun server has been discovered.

Complete the Wizard and your Sun server will be discovered and monitoring will kick in.

OpsMgr SMS Notification with SysMan Integration - Part 5

2010-02-25T15:55:00.011+08:00

In the final chapter of my 5-part series, I would like to share

what I would want to share is to trigger the notification channel on alert certain instances and target groups. You wouldn't want you Handphone to be bombarded with SMSes that is totally non-critical right.

In my example:
I will only trigger SMS alerts when certain the OpsMgr detected Health Service failures on business critical servers that is being monitored.

From the Operations console, navigate to Administration -> Notifications -> Subscription and select New -> Subscription

In the Notification Subscription Wizard, enter a name for the subscription and click Next

In the subscription criteria page, provide your filtering criteria and click Next to proceed

In the Subscriber page, add the subscriber that you have created earlier (please refer to Part 4 of this posting series if you missed out on the creating subscriber part). Click Next to proceed

In the notification channel page, add the notification channel that you have created earlier
(again... please refer to Part 4 of this posting series if you missed out on the creating subscriber part).

Finally, check the Enable this notification subscription checkbox and click Finish

OpsMgr SMS Notification with SysMan Integration - Part 4

2010-02-25T10:37:00.025+08:00

A quick recap on what was covered so far, we have gone through:

Setting Up of Serial Over IP device that communicates with the GSM Modem device
Setting Up Port Mapping from OpsMgr server to the Serial Over IP device
Setting Up & Configure SysMan SMS Notification Server

In this chapter of my 5-part series, I will touch on the integration piece between OpsMgr & SysMan SMS Notification server.

From the operator console, navigate to the Administration space.

Go to Administration -> Notifications -> Channel

Right click on Channel and select New channel -> Command

In the Command Notification Channel Window, enter the name for the channel and click Next to proceed.

In the Settings page;

For the Full path of the command line field; enter the path where you SysManSMS_IClient.exe resides in.
(eg: %Program Files%\SysManSMS\Iclient\SysManSMS_IClient.exe)

In the command line parameters field, enter the .lst file to send the SMS to your intended audience and the contents of your SMS.
(eg: MyUserList.lst $Data/Context/DataItem/AlertName$)

In the StartUp folder for the commandline field, enter the folder which your SysManSMS_Iclient.exe resides in
(eg:%Program Files%\SysManSMS\Iclient\)

Once the configuration is completed, click Close.

Right click on Administration -> Notification -> Subscriber and select New Subscriber

In the Notification Subscriber Wizard, enter a user name and click Next

In the schedule page, select Always send notifications or you can configure the schedule for the notifications to be sent
(eg: you wouldn't want the SMS to come in the middle of your good sleep)

Click Next to proceed

In the Addresses page, click on the Add button to launch the Subscriber Address wizard

In the Subscriber Address wizard, enter a name for the Address.

In the channel page of the wizard, select Command as the Channel Type

For the Command Channel, select the notification channel that you have created earlier.

In the schedule Notifications, configure your preferred notification schedule and click Next

Back in the Subscriber Addresses page, click Finish

Click Close once the process is complete

The steps above literally means that we have configured OpsMgr to be able to send SMS notifications to intended recipients (that was defined in the .lst file) which is done through executing SysManSMS_Iclient.exe with the necessary parameters passed in.

OpsMgr SMS Notification with SysMan Integration - Part 3

2010-02-01T12:12:00.015+08:00

In this posting, I shall share on how to install & configure SysMan SMS Server to work with the Serial-Over-IP device that we have configured earlier.

A quick recap on what was being shared in my previous postings; our OpsMgr SMS notification system consists of 3 major components being:

GSM Modem device - sends SMS notification to OpsMgr administrators
Serial-Over-IP device - a bridge that connects to the GSM device via serial port and at the same time connected through COM Port mapping on the OpsMgr server
OpsMgr server that triggers SMS notification commands the moment critical alerts are detected in the server.

Now we have successfully configured the Serial-Over-IP device as well as mapping it to a COM port in OpsMgr server; the next thing that we need to do is to configure SysMan SMS server to communicate with the GSM device via the Serial-Over-IP device.

Run the Installation Setup application from the SysMan installer CD. In the Setup.exe prompt; click Setup to kickstart installation & configuration of the application.

In the Installation Properties window, select the installation location and tick the Installation Type as Server - Require GSM hardware option.

Once you are ready; click on the Install button

In the SMS Server Properties window; enter your Company Name and the License Number.

You will also need to enter the Device Port to map the COM port number that you have assigned to your Serial-Over-IP device earlier.

Once you are done; click CONTINUE

Once you are done; start the SysMan Service by right clicking on the icon in the System Tray and select

Server Settings -> Start SysMan Service.

The next step that we will need to configure is to enter the necessary phone numbers which SysMan will send SMS notifications to.

Right click the SysMan systray icon and select Edit Number Files

In the window, click New and add the Contact Number information for your target numbers which SysMan will send notifications to. Once you are done; you can save the Number files into a location folder.

In my scenario here; I have saved it to a file call CPOC.lst file

Now that we had our core components readily installed & configured, the next posting will finally show how we can configure OpsMgr to send SMS notification to Administrators via SysMan SMS Gateway Server.

OpsMgr SMS Notification with SysMan Integration - Part 2

2010-01-31T20:04:00.028+08:00

In my earlier post, I have shared on how to configure networking settings into our Serial-over-IP device. In this post, I will share on how to map your device into a Serial Port (COM) within your OpsMgr server.

The first thing that we need to is to install the NPort Administration Suite into your OpsMgr server. Once that is complete; you can easily launch the NPort Administrator console

From the OpsMgr server, go to Start -> All Programs -> NPort Administration Suite -> NPort Administrator to launch the administration console.

In the NPort Administrator console, click NPort -> Configuration node and click Search IP

In the Add NPort popup, enter the IP Address of your NPort device which you have configured earlier and click OK

The device will now be listed in the NPort Administrator console

Double click on the device if you want to configure the device

Click on NPort -> COM Mapping on the Function pane and select Configure to configure mapping of your OpsMgr server Serial Port to the device

In the COM Port Settings window, select a valid COM port that you wish to map the device and click OK to proceed

Now we have the device being mapped to a Serial Port (COM) in your OpsMgr server; you can easily verify the configuration by running AT commands to access the GSM device that is connected to the Serial-Over-IP device.

In my next posting, I will share on how we can use SysMan SMS notification gateway to integrate with OpsMgr to send out SMS notification to administrators.

OpsMgr SMS Notification with SysMan Integration - Part 1

2010-01-31T18:54:00.014+08:00

Wanted to share with you folks out there on how OpsMgr can integrate with SysMan to send out SMS notification to your administrators the moment an alert is triggered in OpsMgr.

As shown in the diagram on the left, we have our OpsMgr server running within as a virtual machine
( which unfortunately is not Hyper-V).

Our OpsMgr server is then connected to a Serial-over-IP device which will then be directly connected to a GSM Modem device which in turn will send SMS notifications to OpsMgr administrators.

To get things started; we need to set an IP address into the Serial-Over-IP device.
(By default, the IP address for the device is 192.168.127.254)

You can telnet into the device to set the IP address for the device.

From the Main Menu; type 2 to enter Network Settings Module of the device

From the Main Menu -> Network Settings Module; type 1 for you to be able to enter the IP Address for the device

Enter your IP Address from the next prompt and press ENTER to set the IP Address into the device.

Press any key to continue

You can easily configure other settings such as Gateway, DNS Server etc. from the Main Menu -> Network Settings module. Once your are done, type m to go back to the Main Menu

Back in the Main Menu, enter s to Save the settings and Restart the device.

On the following prompt that ask for your confirmation to Restart the device, enter Y to confirm.

In this Part 1 posting, I basically shared with you on overall architecture of the integration with SysMan from OpsMgr and how do you configure the Serial-Over-IP to set networking configuration into the device.

In the next posting, I shall share how we can configure Serial Port mapping within OpsMgr server to the device.

Error Installing Service Level Dashboard 2.0 - Error while Adding Site Template

2009-11-02T16:39:00.003+08:00

Sometimes when you tried to install Service Level Dashboard 2.0 (SLD) on your existing OpsMgr R2 infrastructure only to end up being frustrated of constant failing without anything hints. It couldn't help with the installer not leaving any log files for us to troubleshoot.

I have never had problems with the installation until today. Somehow I encountered installation error when I tried to install SLD v2.0 on my customer's POC environment today. I kept getting error when the installer tries to "Adding Site Template"

The bad part is, no installation log files were created that enables me to do detailed troubleshooting. Fine !

Finally found a way to do that, using command prompt type the following command to launch the installer to output the installation log

msiexec /i serviceleveldashboard_x64.msi /L*V install.log

Installation still fails but this time, I have an Install.log file to TROUBLESHOOT !!!

I scrolled down to the potential error and found this !

Action 16:16:59: ADDSITETEMPLATE. Adding Site Template...
MSI (s) (3C:F0) [16:16:59:113]: Executing op: CustomActionSchedule(Action=ADDSITETEMPLATE,ActionType=1025,Source=BinaryData,Target=CAQuietExec,CustomActionData="C:\Program Files\Common Files\microsoft shared\Web Server Extensions\12\BIN\STSADM.EXE" -o addtemplate -filename "C:\Program Files\Service Level Dashboard 2.0\SLD_SiteTemplate.stp" -title ServiceLevelDashboard)
MSI (s) (3C:D0) [16:16:59:118]: Invoking remote custom action. DLL: C:\Windows\Installer\MSI69E8.tmp, Entrypoint: CAQuietExec
CAQuietExec:
CAQuietExec: Access denied.

Looks like I have permission errors. (Don't we all do, duh ? lol) Though the account that I use is already a Domain Administrator somehow I did a workaround. I use the Run As Administrator option to execute the installer and the installation were successful and I am less stressful !

Error ID 33333: Data Access Layer rejected retry on SqlError

2009-11-02T10:34:00.004+08:00

Got hit with this problem when I came in to look into the Operations console and suddenly no monitoring data collected ! Performance Data went blank ! Reports blank !

Push the Panic Button >-> Not Yet :)

As usual, the good old trusted Event Viewer will surely gives you something to look into if you bumped into problems with OpsMgr. Fair enough, I got hit by a series of the following error

Apparently it's my bad after all. I forgot to turn on agent proxying for this servers since they are DC's & Exchange Servers.

Thanks to an entry from the product team, it helped me solved my problem.

http://blogs.technet.com/smsandmom/archive/2008/03/13/opsmgr-2007-dataaccesslayer-event-id-33333-with-should-not-generate-data-about-this-managed-object.aspx

Basically, we need to turn on agent proxying for each of the DCs & Exchange Servers. To be safe, restart the Health Service ( aka System Center Management) on the agents. So far, my Event Viewer looks good and fingers crossed, hope that my monitoring data flows in as well ... gulp

(Oh yea, just checked a minute ago, they came in ... hurray ! I just love OpsMgr)

Service Manager 2010 Beta2 is available

2009-10-03T09:03:00.002+08:00

With great excitement, I wish to share with you folks out there that Service Manager 2010 Beta 2 is available for download.

So what will I be excited about with this version compared to the previous Beta1 and also the CTP2 version that I have been playing with.

Self Service Portal
Problem Management
Self Service Software Provisioning

Additional information is available in the product team's blog site:
http://blogs.technet.com/servicemanager/archive/2009/10/02/service-manager-beta-2-has-shipped.aspx

Within this site, you can get the link that will direct you to Microsoft Connect site which lets you to download this exciting product for your evaluation.

Now enjoy ... I know I will enjoy my time with this product as I have been for the previous versions.

DPM 2010 Beta is available

2009-09-30T09:48:00.003+08:00

It has been announced that System Center Data Protection Manager 2010 (DPM 2010) Beta is available for download.

Overview of this exciting product is available in the product site
http://www.microsoft.com/systemcenter/dataprotectionmanager/en/us/2010beta-overview.aspx

Within this link, you can also download and try it out at:
http://go.microsoft.com/?linkid=9686964

My immediate interest is to see how DPM2010 provides backup/restore of Hyper-V R2 virtual machines that runs on Clustered Shared Volumes (CSV) ...

Managing Applications with Service Maps in Service Manager 2010

2009-09-27T20:19:00.003+08:00

This TechNet webcast demonstrate how Service Manager 2010 can integrate with Operations Manager 2007 R2 to import Service Maps such as your Messaging Application, Directory Services, Web Portal application and more ... into Service Manager and lets you extend information like Service Owner, Users who uses the service/application, incidents & change requests for the service and more.

This lets you as the IT Service Manager to be able to view the CI relationship of the infrastructure that supports the service and at the same time lets you assess the business impact shall the IT service fails and also helps you perform activities like root cause analysis and more ... in summary, Service Maps lets you have a visualization on your IT Services and able to quickly assess the business impact of the service so that you will be able to perform quick remediation activities to bring back the service up ASAP.

Enough talk ... enjoy ....

http://edge.technet.com/Media/Managing-Applications-with-Service-Maps-in-System-Center-Service-Manager-2010/

SPEAK YOUR MIND & BE HEARD BY THE PRODUCT TEAM

2009-09-25T09:59:00.003+08:00

If you want to have your thoughts on OpsMgr to be heard by the product team directly, now you can do it.

The team has just launched a connect portal that let's you feedback (good or bad) to the team and have them heard ... a luxury that only TAP partners used to have ... but now have been extended to general public.

You can access the portal via the following link:
https://connect.microsoft.com/opsmgr

Also the announcement of the New Connect Site portal can be seen here

Storage Server 2008 Default Password

2009-08-18T11:27:00.003+08:00

Windows Storage Server 2008 does not let administrator to provide a password during installation. Hence when the installation is done you get this big question running in your head ... what's the password???

Well, for those who are lazy to read the installation guide ... like me :P

The default password for Storage Server 2008 is (case sensitive):

wSS2008!

And don't forget to change the password once you are logged in :P

Operations Manager 2007 R2 - Sizing Helper

2009-08-12T20:21:00.003+08:00

The OpsMgr R2 Sizing Helper lets us work out capacity sizing & planning for OpsMgr R2 deployment.

http://blogs.technet.com/momteam/archive/2009/08/12/operations-manager-2007-r2-sizing-helper.aspx

Bridgeways announced the release of MP for R2

2009-07-18T10:06:00.002+08:00

Bridgeways recently announced that they have released 4 new Management Packs for OpsMgr R2. Focusing on extending monitoring capabilities for OpsMgr R2 in non Windows Application & Database servers, Bridgeways Management Pack offerings includes

JBoss Application Server
Oracle Database Server
MySQL Database Server
Apache HTTP Web Server

And guess what, they even have MP to monitor VMWare ESX without needing to go through Virtual Center !

As I am blogging my post here, I actually had their MP configured to monitor a customer's Apache Web Server...

For more information on the product drop by at theor product info page here
And their technical blog here

Can't install WinRM. Access Denied

2009-06-24T15:09:00.002+08:00

One of the pre-requisites that we need to have is WS Management 1.1 component so that we can manage non-windows machines. And most of the time, we just need to download the update and install and voi'la it works.

Not today ... I am working in a customer site which all the servers are hardened. So when I tried to install the update ... it gives me error ... Access Denied ...

Never in my mind that installing an update using Domain Administrator account will give me Access Denied.

After an hour of troubleshooting, I find the culprit. The permission for the registry entry for

Local Machine\Software\Microsoft\WINNT\Svchost

only gives Read rights for administrators hence I cannot register the WinRM service into the server.

After getting permission from customer, I set the permission to Full Control and the installation of the update works without any problem.

Extract monitors,rules and object discoveries using Powershell

2009-06-02T16:28:00.002+08:00

Wrote a Powershell script to extract the Monitors, Rules and Object Discoveries and export the names of the objects to a text file.

The method is pretty simple, I just use a couple of get-objects cmdlets and adds the criteria to match certain criteria strings and the script should.

For example, to extract monitors for Linux

$exportpath = "C:\DUMP\allLinuxmonitors.txt"
$mp = Get-ManagementPack | WHERE {$_.DisplayName -match "linux"}
foreach ($mp1 in $mp)
{
$mp1 | Format-Table DisplayName | Out-File $exportpath -Append
Get-monitor -ManagementPack $mp1 | format-table DisplayName | Out-File $exportpath -Append
}

To extract Rules for Linux

$exportpath = "C:\DUMP\allLinuxrules.txt"
$mp = Get-ManagementPack | WHERE {$_.DisplayName -match "linux"}
foreach ($mp1 in $mp)
{
$mp1 | Format-Table DisplayName | Out-File $exportpath -Append
Get-rule -ManagementPack $mp1 | format-table DisplayName | Out-File $exportpath -Append
}

To extract Object Discovery for Linux
$exportpath = "C:\DUMP\allLinuxdiscovery.txt"
Get-Discovery | WHERE {$_.DisplayName -match "linux"}| Format-Table DisplayName | Out-File $exportpath -Append

Ray just threw me a challenge ! Extract those information together with the threshold, Enabled By Default, Override values etc. Will work on it if I have time :)

Updates not deployed ... even after 1 hr !!!!!

2009-05-16T23:20:00.002+08:00

Was building a lab image for my training class next week and somehow things was not as smooth as I would fancy. :(

It was supposed to be a simple Software Update deployment lab which I am preparing and what seemed to be a very routine step (yes, did this hundreds of times and it works all the time) but somehow my client machines is still not getting the software update after 1 hour ! ( triggered countlessly on the Machine Policy and Software Update Deployment Cycle actions)

Well, I took a look at the client's updatesdeployment.log and noticed that the advertisement is not activated yet ! Chaos mode !

Then took a look at the Deployment Management for the update, and noticed that my Time/Settings is set to UTC which is by default.

So the lesson learned here is, unless you are great with mathematics calculations of timezone/date, better stick with the Client Local Time options !

Test Drive System Center Service Manager

2009-05-05T10:59:00.002+08:00

Eager to try and see how the upcoming System Center Service Manager looks like?

Well then please go and have a try at the Hands On Lab for Service Manager

http://www.microsoftservicemanagertestdrive.com/

The scenarios in this lab will demonstrate an overview of a Microsoft System Center Service Manager installation and initial configuration, covering the following topics:

Installing Service Manager
Importing data from Active Directory,System Center Configuration Manager, and data and alerts from Operations Manager 2007 SP1 and above
Configuring User Roles within Service Manager
Manually adding users that were not imported from Active Directory
Creating several templates, configuring initial parameters, creating queues, lists, and groups, and then creating a management pack to save any custom objects
Installing Service Manager in a production environment in a scenario where Service Manager is installed on four computers

Enjoy !

Generating ACS Report is slow ... what I can do about it ?

2009-05-04T13:02:00.003+08:00

I have a friend who set his ACS data retention for 2 years to comply to SOX standards which means he needs to set the data retention range to 2 years without an archiving solution at that time.

It has been a year since he has the ACS data collected and he contacted me recently and complaining about the Audit report takes ages to generate. Well it kinda makes sense for the reporting to be slow because of the sheer volume of the data that was collected.

So what's next? Well both of us have been toying around with the ACS DB and managed to find a workaround to do this.

Well as I have shared on my previous posts, the data source which the Audit Reports retrieved from actually points to the adtserver.dvAll5 view and this view will retrieve all the data collected for the past year.

We have 2 ways to do this:

Option 1: Modify the dvAll5 View
- Go to SQL Management Studio, modify the dvAll5 syntax to only include the views that you want to see.
- Execute the SQL syntax
- Note: Although this is simple and straight forward, you need to constantly go into SQL Management Studio to do this and your settings will eventually be overwritten everytime ACS creates a new Partition table because the DBCreatePartition.sql will rebuild the dvAll5 view

Option 2: Modify the DBCreatePartition.sql file
- This file resides in C:\WINDOWS\system32\Security\AdtServer
- Before you start playing with this, make a backup copy of this file.
- Edit this file and look for select top 42 PartitionId from dtPartition order by PartitionCloseTime desc
- Change the Top value to a lower value. For example, if I just want to generate report for the range of 2 weeks, I just need to modify the statement to select top 14 PartitionId from dtPartition order by PartitionCloseTime desc
- Save the SQL file
- What we did just now is to have ACS to only include the 14 latest Partition views to be included into the data source (which is dvAll5) which means the resultset is much smaller hence the performance will be increased.

What if you want to keep ACS data for more than 256 days ? - Part 3

2009-05-04T11:28:00.002+08:00

In my previous posts, I have shared a little on the data structure of ACS database and what are the potential issues that we might faced if we do not adhere to best practice such as the 256 table limitation of SQL Server. That being said, many organizations has a requirement to keep their security events/logs up to a certain period of time to comply with a certain standards/compliance.

This is the dilemma which my friend is currently facing now realizing that he will potentially lose the ability to provide Security Audit reports for long term data (which is longer than 256 day). But after some study which we did, we managed to find a workaround for that though this requires alot of manual work and tweaking of the a couple of SQL scripts in ACS.

But before we go into details, just as a disclaimer you better make sure that you have properly and adequately backed up your entire OpsMgr infrastructure before you embark on this "perilous" adventure.

Well to start things with let us recap on the objective: We need to be able to generate Audit reports for up to 2 years worth of data.

So the first thing is to set the retention range for ACS from 14 days (by default) to the range that you need and let ACS do the rest in terms of collecting data and storing to the ACS database
To generate report for the range which is older than 256 day,go to SQL Server Management Studio and identify the partition tables IDs that stores the collected events/data for the date range from dtPartition table using the following SQL statement. SELECT * FROM dtPartition ORDER BY partition time
Now this is the interesting part. Once you have identified the Partition Table IDs, open the dvAll5 view and edit the syntax and include the partition views into the syntax. For example, if I have identified 2 partition tables with the id of 12345_abcde and 67890_fghij as mentioned in Step 2 the modified syntax for the dvAll5 view will look something like this: ALTER VIEW [AdtServer].[dvAll5] AS SELECT * FROM dvAll5_12345_abcde UNION ALL SELECT * FROM dvAll5_67890_fhgij
Execute the syntax and now the dvAll5 view which is the data source for reporting will retrieve the collected events/data that falls within your date range

Of course the steps above is rather tedious for some and quite complex for a few more.
Well, guess what? There is a tool out there that can do whatever I mentioned above easily and reliably.

The solution which can solve an administrator headache to manage long term ACS data is the Audit Collection Archiver brought to you by Secure Vantage.

This solution will archive your ACS data into a series of compressed binary files and provide you the ability to generate reports on the archived data.

If you would like to know more about this cool solution, have a look on this link
http://www.securevantage.com/Products/AuditCollectionArchiver/Default.aspx

What if you want to keep ACS data for more than 256 days ? - Part 2

2009-05-02T22:22:00.011+08:00

In the last posting, I shared with you about a friend of mine who needs to keep his ACS data for 2 years, only to face with an issue when the collected data reached the 256th day and his ACS Collector service stops.

Well, we eventually installed the hotfix available for KB 954948 from http://support.microsoft.com/kb/954948

Now in order for us to know what causes this problem, we need to do some study on how the ACS Database structure works.

As many of us already know, what ACS does is to collect security events from monitored servers and store them back into the ACS Database. These collected data will be stored in what we called a partition table, a table dynamically generated/created daily by ACS to store events data that was collected on that particular day. To let you have a clearer view of what I meant, take the following as an example.

I would like to ensure that the events collected on the 17th April 2009 is successfully stored in my ACS DB so how do I view those data? Like what I shared with you earlier, all the collected events are stored into partition tables and in order for us to identify which partition table was created to store the events for 17th April 2009, we need to select from the ACS Database and the SQL syntax to query the dtPartition table to list all the partition tables and sorting them by Date. This can be achieved using the following SQL statement:

SELECT * FROM dtPartition ORDER BY partition time

The returned resultset will list all the partition tables and which one stores the data for which date.
In my case ( as depicted in the following screenshot), I have already 258 partition tables created for the events that was collected for the past 258 days. I can also see that the partition table that stored the events that was collected on 17th April 2009 by referring to the PartitionId column which is 5705ab39_f297_4555_ad04_57f72603b941 and also PartitionStarTime and PartitionCloseTime as the date indicators.

Once we have the partition id identified, we shall validate the data that was stored is indeed collected on the 17th of April 2009. We will now attempt to select from the view that was created from the partition table and to do that simpy use the following syntax:

SELECT * FROM db0.dvALL5_(your partition table id)

In our scenario the SQL syntax will look like this,

SELECT * FROM dbo.dvALL5_5705ab39_f297_4555_ad04_57f72603b941

We should be able to see the event data that was collected. As for my screenshot, what we have done is a bit extra where we tried to verify the events collected in the partition table is indeed those on 17th April 2009

Now we have been able to understand a bit more on how ACS database structure works, the next step is to understand how reports are retrieved? Well to start with, ACS reports are retrieved from a Data Source which refers to the dvAll5 view. The interesting part on how this view work is that it is dynamically built to retrieve from all the views of the partition tables.

Yes, this means if you have 20 days of events collected this generally means that you have 20 partition tables which also means that you have 20 views created and to top it all, the dvAll5 view will select from all the 20 partition views ! I personally have some reservation on this approach as this would lead to performance issue if especially if your data size is huge and if your retention period is exceptionally long. (Guess this is why the default retention period is only 14days)

So how does dvAll5 is being created then? Well, after we studied the syntax that builds the view the SQL syntax that builds it actually does a UNION on all the partition views ... and it looks something like this ~gulp~

create view [AdtServer].[dvAll5] as select * from dvAll5_8fe6b4cb_aab5_43ef_b3a7_4ae601e0be53 UNION all select * from dvAll5_0ff135f5_b14f_474c_a94f_c5a8249b3b82 UNION all select * from dvAll5_76c46145_961f_492e_a015_fad4c0c41046 UNION all select * from dvAll5_d9d39a78_66d1_48ee_8da3_c4685c6d9c59 UNION all select * from dvAll5_add3b5d7_48ee_4cce_a12e_8fa6f96577da UNION all select * from dvAll5_66975973_55ee_4db2_9c45_f655a2c03779 UNION ....... all select * from dvAll5_72e2f5be_bbdd_49af_bc79_8efba125bf78

Yes, if you have 20 paritions tables this means your dvAll5 view will really include all of them.

Now this is when things gets interesting. Remember that my friend needs to have a data retention for more than 2 years ! ... and how his ACS dies after the 256th day ?

The reason is because, SQL Server has a limitation that you cannot be SELECTING for more than 256 tables in ONE view hence the error the he faced occurs.

After we have installed the patch, ACS will be a bit clever. If it detects that it has more than 256 partition tables, dvAll5 will only retrieve the latest 256th tables hence the earlier table will be discarded from reporting.

Now for my friend who is the administrator and needs to ensure that ACS can report data up to 2 years ... that simply freaked him out in the first place ! But after we studied the structure carefully and through some creative thinking we managed to find a workaround for this ... which I will share on my next post.

What if you want to keep ACS data for more than 256 days ? - Part I

2009-04-26T20:00:00.005+08:00

I have a good friend who has configured his OpsMgr settings (last year) to keep his collected events in ACS for 2 years because his company's policy requires them to save all security events data for 2 years. And so the story goes ...

Last week, he contacted me with regards to a couple of errors that he encountred in his ACS Collector. Apparently he kept getting the following error in his Event Viewer and eventually his ACS Collector service has stopped and could not be started.

Event Type: Error
Event Source: AdtServer
Event Category: None
Event ID: 4618
Date: 04/12/2009
Time: 2:00:34 AM
User: N/A
Computer: SCOMAPP1
Description:
Error occured on database connection:
Status: 0x04080000
ODBC Error: 106
ODBC State: 42000
Message: [Microsoft][ODBC SQL Server Driver][SQL Server]Too many table names in the query. The maximum allowable is 256.
Database: SqlWriter
Connection: Maintenance
Statement:

We managed to find a hotfix to resolve this issue in the following link:
http://support.microsoft.com/kb/954948

and have the patch installed on the ACS Collector.

But then again if you read the documentation for the hotfix properly, it states that the system will only retain data of the latest 256 partitions/days of events. My friend needs to be able to pull reports for data of 2 years.

In my next blog post, I will share with you how do we open and study the ACS database and eventually found a way albeit messy and cumbersome method to achive that. At the same time, I will also share with you a product out there which will be able to resolve this problem without you getting your hands dirty. Stay tuned ...

Installing of SCCM agent failed: WMI repository error

2009-04-03T11:40:00.003+08:00

It's been a while since my last posting. Has been extremely tied up with work and community events of late. Anyways, I have something interesting to share with folks out there who has difficulties deploying their SCCM agents.

Was helping my colleague to deploy SCCM for a customer and suddenly we noticed that a couple of machines has problems when we tried to push the agents. A check on the log files showed that we have some problems with WMI repository:

- Failed to open to WMI namespace '\\.\root\ccm' (80041014) CcmExec 8/30/2007 2:25:09 PM 2148 (0x0864)
- CCMDoCertificateMaintenance failed (0x80041014). CcmExec 8/30/2007 2:25:09 PM 2148 (0x0864)
- Phase 0 initialization failed (0x80041014). CcmExec 8/30/2007 2:25:09 PM 2148 (0x0864)
- Failed to connect to CCM namespace CcmExec 8/30/2007 8:13:56 AM 2160 (0x0870)

Managed to find the solution from http://www.myitforum.com/forums/m_165955/tm.htm

What needs to be done is:
- On the client machines, shut down WMI service
- Goto C:\Windows\System32\WBEM and rename the repository to maybe "oldrepository". Basically what we do here is to rebuild the WMI repository.
- Restart WMI service and you should be able to see a new repository will be generated

Jalasoft Xian Network Manager Io SP2 has RTMed !

2009-02-27T20:50:00.003+08:00

Jalasoft Xian Network Manager Io SP2, a partner add-on which extends OpsMgr monitoring capabilities to non-Windows environment such as Linux,UNIX, network devices and even VMWare Virtual Center has RTMed.

What's new in SP2 ?

There are several improvements in Xian Io SP2. The ones that have had the most impact on functionality and performance are detailed below.

Improved Communication between Xian Io and Management Servers.

The Xian Data Server no longer uses the SDK to send counters and events to the Root Management Server; it can now communicate with secondary Management Servers using the Xian Connector Module. This feature increases the monitoring capacity of Xian while at the same time improving stability.

Improved Management Packs

Xian’s ‘Smart Management Packs’ have been redesigned to take up less memory and cause less congestion allowing those resources to be used to enhance Xian’s monitoring capacity.

Multiple Xian Environments

To increase the number of devices you can monitor with Xian you can add an independent Xian installation to your OpsMgr Management Group. The amount of additional devices you can monitor with a second installation of Xian depends on hardware configuration, number of active rules and rule execution intervals among others. You can do this as many times as necessary.

Automatic Health Reset

When a rule sends an alert to Operations Manager, it remains open until a success event is sent to close the alert. What Automatic Health Reset does, is once the rule is removed and is no longer monitoring that node, it sends a success event so that remaining alerts in Operations Manager disappear.

Improved SNMP engine

In Xian Io SP1 the snmp counter could, on rare occasions send wrong counters. Through the use of a new and more robust SNMP module this is no longer possible.

Enhanced Monitoring Capabilities

The number of devices a single installation of Xian Io SP2 can monitor has been increased to approximately 1000.

More reports

To have more possibilities to analyze your performance counters Xian Io has now even more reports to help you. Every Management Pack comes with over 100 build in Reports!

Available Smart Management Packs

The Jalasoft Smart Management Packs provide the intelligence to organize, process, and analyze the information on monitored devices into the views, computer groups, and reporting capabilities of Ops Mgr 2007 using the Xian Connector for Ops Mgr 2007.

Cisco Switches
Cisco VPN Concentrators
Cisco Routers
Cisco PIX/ASA
Cisco Wireless
HP Procurve Switches
F5 Big Ip
Linux Servers
Solaris Servers
IBM AIX Server
VMWare Virtual Center
Linux MySQL
APC UPS
Generic Network Device
Availability (ICMP only)

For more information, take a look at:

http://www.jalasoft.com/Web/Product/Product.aspx?id=44

Configuring Email Notification channel in Service Manager

2009-02-21T20:21:00.008+08:00

Extremely straightforward and simple.

Logon to your Service Manager Console
Go to the Administration space and expand the Administration -> Notification node
Click on the Channels node
On the Middle pane, select Email Notification Channel and click the Edit link on the right pane
This will launch the Email Notification Settings window
Tick on the Enable e-mail notifications checkbox. Click on the Add button to launch the Add SMTP Server window
Input your mail server settings and click OK.
Enter the Return Address and click OK again to save your settings and now you have added your email notification channel.

pre-Reqs for Service Manager

2009-02-19T11:39:00.006+08:00

For those who are like me who just wouldn't be interested in reading installation notes and eventually got burnt. I will be kind enough to share this with

you after having my hands charred a couple of times.

One of the key pre-Reqs when you want to install and configure Service Manager is to get you action accounts configured properly. Here I have copied

excerpts from the Initial Config guide and let it be our light ...

1) Create an Active Directory group of users that will be assigned to the role of Service Manager administrators of both the data warehouse and Service Manager management groups. For example, create the group SM_Admins. This group of users must be in the same domain that Service Manager is in. Users from any other domain, even child domains, are not supported.

2)For the account you use to run Setup, verify the following:

Must be a SQL Server sysadmin on the SQL server where you install the databases.

Must be a member of the data warehouse management group administrators. For example, add this account to the SM_Admins group.

3)Identify or create a domain account that will be used for the Service Manager account. For example, create the domain account SM_Acct.

This account must be in the same domain that Service Manager is in. Accounts from any other domain, even child domains, are not supported.

4) For the domain account, for example, SM_Acct, make sure of the following:

The domain account is a member of the group you created in step 1. For example, make the domain account SM_Acct a member of the SM_Admins group.
The domain account is a member of the local administrator group on the computer that will host the Service Manager management server and the data warehouse server.
The domain account is a member of the sysadmin role for the data warehouse SQL Server as well as for the Service Manager database SQL ServerThe domain account is a member of the Content Manager role (or higher) in SQL Server Reporting Services.

5)Make sure that the SQL instances used for Service Manager databases are using port number 1433.
6)If you are installing the databases on a remote computer running SQL Server, the computer account (for example, $) of the computer you are running Setup on must be a local administrator on the SQL Server computer.

How do I know whether my Active Directory Connector successfully sync data ?

2009-02-18T16:22:00.007+08:00

One of the key configuration activity that you need to do when you setup Service Manager Beta 1 is to import objects from Active Directory into Service Manager. This can be achieved via the Active Directory connector which will act as the synchronization engine between both components.

However regardless whether it's is successfully synchronized or not, you will always get a successful sync message.

But then, my objects is still not synchronized? So what is the problem ? How do I know whether it is an error or synchronization is still running ?

To have a detailed view on what happened and whether the synchronization is successful, go over to Event Viewer and open the Operations Manager log.
(Yes, Service Manager uses the same framework/engine model as Operations Manager R2)

Find events where the Event Source is "Lfx Service" and if there is an error you will be able to see something like this:

By now, you should be able to see what is the details of the error for the synchronization process.

huh, my HyperV images can't be imported ! wtf !!!

2009-02-12T14:29:00.003+08:00

Like most other posts, this is a reminder as well as some form of sharing with folks out there with regards to HyperV images.

I have a few HyperV images which I exported from my Server. Copied them to my notebook and starts importing them and it failed. All 3 of em' !!! My import failed with the following error

"Failed to import the virtual machine from import directory 'E:\VM\OpsMgr\'. Error: One" or more arguments are invalid(0x80070057) "

Good old friend Google came to the rescue and after a few searches, managed to find a solution from this blog entry in http://blogs.msdn.com/rextang/archive/2008/11/27/9146157.aspx (Clap clap)

The trick here is to 'tweak' the .EXP file inside the VM folder.

Open the .exp file with notepad (the file should be in the Virtual Machine folder).
The .exp file is actually an xml file so for those who are familiar with xml, this should be peanuts.
Search for "Msvm_VirtualSystemGlobalSettingData" and you will be able to see the following :
<INSTANCE
CLASSNAME="Msvm_VirtualSystemGlobalSettingData">
...
ScopeOfResidence" TYPE="string">

e7668fbc-216e-4ed1-8ce3-3b932b42e22b
Delete the entire VALUE tag ... and save your file. (Yes from to )
Import the VM again. Voi'la ! the import succeeds !

Pssst .... remember to backup your exp file before you do that and save the backup copy on another location which is not inside the Virtual Machine folder else you will have another error.

Remove ancient VM Additions

2009-02-06T11:21:00.004+08:00

I have a couple of Windows 2003 SP2 sysprep VMs created from Virtual PC 2004 SP1. ( Yes, I know those are ancient vhds) ... and plans to move these into Hyper V.

So VM migration 101, remove the VMAdditions but wait a minute those VMAdditions are so ancient ... and I only have Virtual Server 2005 SP1 ! Looks like I need to do it the hard way !

- Downloaded VPC 2004 SP1.
- Extract the VM Additions.msi
- Get the VMAdditions.iso file
- Load my VMs on Virtual Server, and load the VMAdditions which was extracted earlier. Remove VM Additions.

Just in case that if you want to skip the steps, I have uploaded the VMAdditions.iso in my skydrive. You can download this and have a much easier experience. :D

http://cid-8b468d6e5c4e0782.skydrive.live.com/self.aspx/Public/VMAdditions.iso

Unseal Management Pack

2009-02-03T16:58:00.004+08:00

I have trouble remembering this so I am going to blog this as a REMINDER !
To unseal a Management Pack you need to firstly get a PowerShell script which you can download from Boris's blog, there is an attachment MPtoXML.zip Copy the file into a location in your computer say C:\

Run the following as an example:

powershell C:\MpToXml.ps1 -mpFilePath:'d:\Microsoft.Exchange.Server.2003.Monitoring.mp' -outputDirectory:'d:\'

Thanks Boris for this wonderful script and blog entry.
I need to make sure I will not forget this AGAIN.

TechNet 2009 Malaysia !!! Here I come !!!!!

2009-01-12T22:47:00.003+08:00

I am writing this blog full with excitement. Why? Because me and my team would be going to showcase loads of exciting stuffs to the folks who are attending this event.

The cool stuffs which we are going the share are:

i) Cross Platform Monitoring via OpsMgr 2007 R2 Beta1
Here we will demo how OpsMgr will be able to monitor and manage non-windows servers. We setup 3 Linux servers (2 SUSE 1 Red Hat) and all of them would be monitored natively from OpsMgr

ii) SLA Dashboard
How would your IT managers be able to measure actual Service Availabilty against predefined Service Level Agreement ? SLA Dashboard in OpsMgr provides you all the reports that you need for you to do this !

iii) Desired Configuration Management (DCM)
How do I know whether the configurations of my servers complied to my standards defined in my organization ? If they are "drift" in the configurations, how do we detect them ? DCM is a feature within ConfigMgr2007 that scans for configurations drifts in your machines (not only servers but desktops and laptops as well !!!) and reports back to your ConfigMgr server

iv) Introduction to System Center Service Manager
The new kid on the block ... well it will be in about a year's time. Not only it will be the Service Management offering from Microsoft, it will also be the central integration point that connects the different solutions within Microsoft Sytem Center suit of applications !

v) Patch Management
How do I make sure that my machines are properly patched with the latest definitions ? And what if I want to patch non-Microsoft applications or even in-house developed applications ? We are going to share Patch Management using ConfigMgr2007 that would be able to not only manage the deployment of Microsoft patches but to a certain extent patches from non-Microsoft applications as well !

vi) Offline Virtual Machine Servicing Tool
We need to treat Virtualized servers with the same treatment and respect as Physcial servers. Hence when it comes to patch management, we will need to ensure that virtualized servers would need to be properly patched as well even those offline ones. The Offline Virtual Machine Servicing tool will enable to patching of offline virtual images within your environment

vii) Data Protection and Recovery
I am a backup administrator and my boss told me that I need to make sure that our Exchange Servers should be properly backedup. But I am no Exchange expert ?!!!! How do I know whether I can adequate backup Microsoft applications ?! With Data Protection Manager or DPM, the solution has all those "knowledge" built in the system so it basically knows what needs to be backed up not only for Exchange but the entire range of Microsoft solutions such as HyperV, SQL Server and the list goes on ! ALL IN ONE SINGLE AND EASY TO USE CONSOLE !

viii) Provisioning of Virtual Machines - Self Service Portal
How long does it take for your IT administrator to provision a virtual machine that you requested ? 1 week ? With Self Service Portal in Virtual Machine Manager or VMM, end user can literally provision a virtual machine by themselves and its really very quick and easy to do so !!!

ConfigMgr: Manually trigger auto-provisioning of vPro machine

2008-12-20T22:17:00.004+08:00

I bumped into this whilst playing with Out of Band Management in ConfigMgr2007 SP1. My vPro machine just couldn't get provisioned by my ConfigMgr server. I was reading through the logs and the provisioning task failed once and did not resume even I ran the Refresh Machine Policy from my client.

Then my good friend from Intel Paul Haines and Ow Haw Kuang shared with me that the auto-provisioning only executes every 24 hours but then you can still trigger it manually using WMI to force the provisioning task.

This topic is covered in the following link:
http://communities.intel.com/community/openportit/vproexpert/microsoft-vpro/blog/2008/10/01/using-wmi-to-force-the-sccm-agent-to-check-for-its-amt-auto-provisioning-policy

I did the simple method of copying the following code into a vbs file and running it from the client machine and it works !

Option Explicit
Main
Sub Main()
Dim oLocator
Set oLocator = CreateObject("WbemScripting.SWbemLocator")
Dim oServices
Set oServices = oLocator.ConnectServer( , "root\ccm\policy\machine\actualconfig")
Dim oObjectSet
Set oObjectSet = oServices.InstancesOf("CCM_OutOfBandManagementSettings")
Dim oObject
For Each oObject In oObjectSet
Wscript.Echo "Name: " & oObject.AutoProvision
oObject.AutoProvision = False
oObject.Put_
WScript.Sleep 500
Wscript.Echo "Name: " & oObject.AutoProvision
oObject.AutoProvision = true
oObject.Put_
Next
End Sub