As I've described in the previous two installments, the KMS is a pretty simple and straight-forward service. When you think about, this makes sense because the only thing that it does is activate clients.
So how do you track what the KMS is doing and identify any issues? The first way is a vbscript located in %systemroot%\system32 named slmgr.vbs. This little script is the main way to interact with the KMS and the activation client. Running this script with –dli as an option will list the activation information for the local system; if the local system is a KMS, then will also list KMS related data including the number of clients that it has activated in total. Remember that this number is important because Vista clients won’t activate unless the KMS has already activated at least 25 clients and Server 2008 clients won’t activate unless 5 other systems have already been activated. The following screenshot shows the output of slmgr –dli on a KMS:
Of note are the following:
VOLUME_KMS_C_channel – The type of license key that was used to activate the system. For a KMS, this also indicates what type of clients it can activate, see Windows Activation – The KMS for details.
License Status – Indicates whether the local system has been activate or not.
Current Count – The number of client systems already activated.
DNS publishing enabled – Indicates whether this KMS system is publishing its SRV record in DNS.
slmgr –dlv displays the same basic information with some extra thrown in. This in shown in the next screenshot:
The two above commands also work on clients and show the same information minus the KMS specific items.
Both the KMS server and client add event log entries to track activations and activation requests. For the KMS server, there is a dedicated log view called Key Management Service located under Application and Services LOGs in the Event Viewer:
The KMS will add an entry to this log every time it receives a request for activation. They will look like the following:
The first field in the info section (marked by the red arrow), is the success/failure code; 0x0 is success.
For clients, two events will be placed into the standard Application Event Log with EventIDs of 12288 and 12289 and provider name of Microsoft-Windows-Security-Licensing-SLC. 12288 indicates a client request and which KMS server the request is being sent to (blacked out):
12289 indicates a reply from the KMS, the success/failure code (marked by the red arrow below) is the first field in the info section and is the same code listed by the event entry on the server side:
There are a handful of common error codes, the full list is available in the Volume Activation 2.0 Operations Guide in Appendix 2.
That’s the bulk of it. Like I said at the start, its a simple service that does only one thing: activate clients.
* Deploying OpsMgr 2012 – a quick-start guide from Kevin Holman's System Center Blog* Install Operations Manager 2012 Beta
This is the step-by-step guide for adding a free Hyper-V Server 2008 R2 SP1 or a paid Windows Server 2008 R2 Server Core to the Hyper-V cluster.
- On NODE1, shrink the existing drive so that we have the second partition to host the Hyper-V Server. To differentiate with the future Hyper-V Server on the boot screen, use this command (Run As Admin)
bcdedit /set {current} description "WS08R2 Full OS"
Check the new setting with bcdedit or Computer Properties/Advanced/Startup and Recovery
- Install the Hyper-V Server
- Change hostname to NODE3, set IP to 192.168.1.13, join domain
- Enable Remote Desktop
- Select 4: Configure Remote Management, then select 2: Enable Windows PowerShell, restart
- Select 4: Configure Remote Management, then select 3: "Allow Server Manager Remote Mgmt"
- Select 4: Configure Remote Management, then select 1: "Allow MMC Remote Mgmt" (firewall exceptions will be enabled, Virtual Disk Service allowed)
- Remote Desktop to NODE3
- Check installed roles/features: oclist --> Hyper-V role is already installed
- From HN-SRV-01, in Server Manager, Feature/Add Feature: Hyper-V Tools and Failover Clustering Tools (in Remote Server Admin Tools), then connect to NODE3 Hyper-V.
- From Server Manager (connected to NODE3), go to the Hyper-V node, create a Virtual Network connecting to the physical NIC of the NODE3. Name it ProdLAN.
- From Server Manager (connected to NODE3), go to Services node, set "Microsoft iSCSI" service to Automatic, and start it
- From Remote Desktop (connected to NODE3), run iscsicpl from the Command Prompt and connect to the SAN storage at 192.168.1.1.
- From Remote Desktop (connected to NODE3), select 11 to install Failover Clustering on NODE3
- From Server Manager (connected to NODE3), go to Disk Management node, after 2 minutes, this error is displayed "The RPC Server is unavailable". Resolution: check on both (managing and managed) servers to make sure all 03 "Remote Volume Management..." rules are enabled. (In my case, it is the managing server, HN-SRV-01) If not, run this in a CMD window: netsh advfirewall firewall set rule group="Remote Volume Management" new enable=yes. Close the Server Manager.
- From the SCVMM SSP portal, stop all running VMs then delete them. Double-check using the SCVMM console.
- From Server Manager (connected to NODE3), go to Disk Management node, after 4 minutes, the Disk Configuration on NODE3 will appear. Change the quorum disk to Q: and remove drive letter of the Storage01. Note: all these 2 disks are in RAW format.
- HN-SRV-01: Launch Failover Cluster Manager (from Admin Tools), connect to PRIVATE-CLOUD cluster, right click, Add Node, select NODE3, choose to run All Tests. You may need to restart NODE3 if it cannot be accessed. The test will show that it is not suitable however we choose to go ahead and create the cluster.
- From Server Manager (connected to NODE3), add svcacct account to the Local Admins of NODE3 for SCOM agent push installation to work. Then go to Services node, set "MSI Installer" service of NODE3 to Automatic and start it (this is used for SCVMM agent installation)
- From SCVMM console, delete any existing PRIVATE-CLOUD host cluster, and use Add Host menu item again to add NODE2 and NODE3
- For troubleshooting purpose, you can disable the firewall on NODE3 using the Server Manager (connected to NODE3)
- Use SCVMM SSP portal, try to provision 2 VMs. Test Live Migration and PRO tips
This is the version 2 of the Private Cloud lab step-by-step setup guide. Instead of using a single physical machine for DC+Storage+Management roles, the VMs are used instead for easy transfer to another hardware. Note: the guide is to illustrate the concepts only so it may not follow the best practices & guidance.
* 03 physical machines:
* A 4-port gigabit hub.
Part 0. Precheck
1. On the physical machines, install display driver (for using with projector)
2. Make sure to check all physical machines are using 1GB connections. Disable any DHCP server (if any) in the hub.
Part 1. VM1: DC promotion
- Win 2008 R2 Std with SP1 installation- Activate - Rename to HN-SRV-01- Set ip (192.168.1.1) and time zone - Promote to DC (mycompany.com.vn)- Create a Domain User named "svcacct"- Prepare CPU-busy.vbs and store it to c:\shared for later use.
Part 2. VM2: SCOM & VMM installation, SCOM-VMM integration, SSP portal installation on MGMT machine1. WS08R2 Std wSP1 installation, rename to MGMT, set IP: 192.168.1.2, join to domain
2. Install SCOM 2007 R2:
- Server Manager, Features: Add Dot.Net framework 3.5
- Install SQL 2008 Std wSP1 with just Database, Analysis and Reporting services. Choose "Use the same account..." and enter "svcacct". Add Current User to DB & Analysis configuration screens.
- Use Server Manager, add "Web Server" role. The following Web Server Role Services should automatically be selected: Default Document, Directory Browsing, HTTP Errors, Request Filtering, Static Content. Click to select additional Role Services: ASP.NET, .NET extensibility, ISAPI Extensions, ISAPI Filters, Windows Authentication, IIS 6 Metabase Compatibility, IIS 6 WMI Compatibility.
- Install AJAX Extension 1.0 for ASP.NET 2.0 (or use pre-downloaded file ASP.NET AJAX extensions 1.0)
- Install Operations Manager 2007 R2: Management Group: MyCompany; SQL DB size: 500 MB; Management Server Action Account: MYCOMPANY\svcacct (the account used for agent push installation), then accept all defaults.
* Optional: Install Operations Manager 2007 R2 Reporting: Start SQL Reporting service if needed, launch Setup, type MGMT as the Root Management Server, Report DB: 500 MB, Data Warehouse Write Account & Data Reader Account: MYCOMPANY\svcacct
3. Install SCVMM 2008 R2 wSP1 x64: only VMM server component (not the Admin console yet), choose to "Install SQL 2005 Express Edition SP3", then accept all the defaults (ports 8100, 80, 443)(Note: the SQL Express instance for VMM is named MICROSOFT$VMM$)
4. Install and configure SCOM & SCVMM integration:
- Open the SCOM console, Admin tab, import the required MPs for SCVMM integration: + Download & install these files "Windows Server Base OS System Center Operations Manager 2007 MP.msi", "Internet Information Services MP.msi" & "SQL Server Operations Manager 2007 MP.msi" (or use pre-downloaded file OpsMgr2007R2_MP.iso)+ Import the following MPs: "Microsoft.Windows.Server.2003 / 2008.Discovery / 2008.Monitoring/Library; "Microsoft.Windows.Internet Information Services.2003 / 2008 / CommonLibrary"; "Microsoft.SQLServer.2005.Discovery / Monitoring / 2008.Discovery / Monitoring / Library"+ Optionally install the "Hyper-V Management Pack"+ Go back to the Monitoring tab on SCOM console. Note: there is no SCVMM folder (only 10 folders).
- Insert SCVMM 2008 R2 media, select "Configure Operations Manager" option. Type MGMT for VMM server. This will install the SCVMM console and configure SCOM (the SCVMM MP is added to SCOM, and a folder named "Virtual Machine Manager 2008 R2" is added to the Monitoring tab of the SCOM console).
- Launch the SCVMM console (use localhost), go to the Administration tab, System Center, Operations Manager Server, right click, Modify, and type MGMT for the SCOM server name. Click the Diagram button (right below the Menu bar) --> the corresponding SCOM Diagram View of the whole Private Cloud will be shown (once all setup steps are done, you will see Node1, Node2, VM1, VM2, etc...). You may need to click the SCOM icon on the Taskbar to show the Diagram.
5. To install Self-Service Portal (SSP) 2.0 on the MGMT
a. Prerequisites installation:
a.1. "Message Queuing" installation:In Server Manager, Features, install "Message Queuing Server" & "Directory Service Integration". (If MSMQ is installed on a DC, go to AD Users & Computers, View/Advanced Features, select Domain Controller server, prop, Security, Advanced, Add, (type) NETWORK SERVICE (Check Names), and tick Allow box for "Create MSMQ Configuration object")
a.2. Note: IIS 7 role, ASP.NET, Win Auth and IIS 6 MetaCompat items are already installed
b. SSP installation: - Download SSP 2.0 (or use pre-downloaded file "VMM SSP 2.0.iso") and run SETUPVMMSSP.EXE.- Choose to install both VMMSSP server and website components.- Database server: type MGMT, click the "Get Instances" button to display "Default" in "SQL Server Instance" box.- Account for server component: type svcacct, click "Test account" (on a DC, username/pwd incorrect error message may appear, configure that account to be a member of Local Admin group) - List of data center admins: mycompany\administrator - Application pool's identity: svcacct
c. Always check the Services snap-in to make sure 02 services "Virtual Machine Manager Self-Service Portal 2.0 / Helper" are started before proceeding. See the troubleshooting steps below (for "Settings/ Configure VM Templates" task for more information"
d. To open SSP portal: http://MGMT, and add this site to Trusted Zone and Favorite Bar.
e. SSP intial config: - Settings/Configure DataCenter mgmt, Configure Data Center resources, VMMServer: MGMT.mycompany.com.vn; click Add Network, enter ProdLAN in both “Network Name” and “Hyper-V Network Name” boxes, click Submit; AD domain: mycompany.com.vn; click "Add an Environment" and type "My Demo Environment", click "Save and Close"- Settings/ Configure VM Templates, click "Import template" (under Other Tasks). This error will be displayed "Could not contact the VMMSSP server. Please verify if the Virtual Machine Manager Self-Service Portal 2.0 service is running and try again". Solution: on the MGMT server, just add "mycompany\svcacct" to the Local Admin group, go to the Services snap-in, refresh and start the service "Virtual Machine Manager Self-Service Portal 2.0" and retry. The error disappears but you will not see any VMM library server to select. Solution: in VMM 2008 R2 console, Administration tab, User Roles, Administrator, properties, Members: add svcacct to that role then try again. You will now see MGMT.mycompany.com.vn in the library server drop-down list. Further SSP config will be done later.
f. Configure to allow "Domain Users" to connect to MGMT using Remote Desktop. Test RDP using mycompany\staff1. Open IE. Add http://MGMT, and add this site to Trusted Zone and Favorite Bar.
g. Optionally connect SCVMM to a standalone Hyper-V host to create a VM template.
h. Export HN-SRV-01 and MGMT VMs to a folder for easy transfer to other hardware. Create copies of "Virtual Machines" folder and config.xml file in these two VMs.
Part 3. Virtual storage preparation- Using Hyper-V Manager, create a new fixed-size VHD of 21 GB (consuming 5 min), and store it into HN-SRV-01 folder, and attach it to the SCSI controller.- Format the fixed disk as drive E:- install MS iSCSI Software Target 3.3.16554 (freely downloaded from http://www.microsoft.com/download/en/details.aspx?id=19867, or use pre-downloaded file "MS iSCSITarget 3.3 for WS08R2.iso")- right click iSCSI Targets, Create iSCSI Target, name PRIVATE-CLOUD. In iSCSI Initiators Identifiers screen, click Advanced, Add, choose IP Address, enter 192.168.1.11 then 192.168.1.12 and say Yes when asked to allow multiple initiators. - right click Devices, Create Virtual Disk, File: e:\VHD\quorum.vhd, size 1,000 MB (1G), desc: Quorum, Access: PRIVATE-CLOUD. - repeat for storage01.vhd size 20,400 MB (19.9G). Create storage02.vhd if free storage is available (for future Storage Quick Migration tests)
Part 4. Node1 & Node2 installation
1. Install WS08R2 Enterprise wSP1 - Activate, set time zone, configure IE ESC to Off (Enhanced Security Config)- Rename network card name to NIC, set IP ( 192.168.1.11 & 12 and default gateway: 192.168.1.10)- Rename to NODE1, NODE2 while joining to the AD domain, restart and remember to logon as Domain Administrator.
- Allow Remote Desktop
- Install display driver (for using with projector)- install Hyper-V role, restart, logon as Domain Admin to finish Hyper-V role installation.- In Hyper-V Manager, create a Virtual Network named “ProdLAN”, connect to External (a physical NIC), and remember to check “Allow management OS to share this NIC” (On production servers with multiple NICs, this box does not need to be checked). Make sure to use the same name (ProdLAN) on both NODE1 & NODE2.- In “Network Connections”, switch to Detailed View, and rename the newly-created-connection to ProdLAN. Check the NIC properties (only Microsoft Virtual Network Switch is checked, and IPv4 is not checked). Check the ProdLAN properties (now IPv4 is 192.168.1.11 & 12) 2. Connect to the shared storage on HN-SRV-01.- In NODE1, Control Panel/iSCSI initator, choose service auto start, Target: 192.168.1.1, click Quick Connect, status should be Connected. Click “Volume and Devices” tab, click “Auto Configure”, there should be 3 volumes listed. - In NODE1, Server Manager, Storage, Disk Mgmt: bring online and initialize 03 new disks. Create and format volume named Quorum for the quorum disk and assign Q: dive letter. Create and format Storage01 and Storage02 but choose “Do not assign a driver letter…” option (new support in WS08R2) - In NODE2, iSCSI initiator as above, bring Online, and Change to Q: drive letter for quorum device
3. Cluster installation - NODE1 & NODE2: add Failover Clustering feature
- NODE1: in Failover Cluster Manager, Validate a Configuration, Browse, select NODE1;NODE2, then choose Run All Tests, takes 5 min, click View Report. There is a Warning sign in Network (IPConfig warning: no Default gateway info & Network Comm: Nodes are reached by only one pair of interfaces due to only a single network card is used) - NODE1: Create a Cluster, Name: PRIVATE-CLOUD, IP: 192.168.1.51, takes 1 min, View Report, should be no warning/error. Quorum type should be: Node and Disk Majority (Cluster Disk 1). (The Quorum device is auto selected as Cluster Disk 1 ) - NODE1: Enable Cluster Shared Volumes, the c:\ClusterStorage will be auto created on both nodes. Click CSV node, Add storage, add Storage01 (and 02). The Volume1 (and Volume2) subfolders will be auto created in c:\ClusterStorage of both NODE1 & NODE2.
Part 5. VM Live Migration testing, creating a VM template in SCVMM and proposing VMs using SCVMM SSP portal
1. Create a VM template in SCVMM libary - MGMT: in SCVMM console: Add Host to add NODE1 & NODE2 as well as PRIVATE-CLOUD cluster to SCVMM console. At "Host Properties" screen, enter "C:\ClusterStorage\Volume1" as the path, click Add, then Next. The SCVMM agents will be installed on NODE1 & NODE2.- NODE1: create or import a reference VM in the folder C:\ClusterStorage\Volume1, for example use "Base-WS08R2 Std Fixed-09-400", memory is set to 400 MB, 1 processor, set Processor compatibility, set Network Adapter to ProdLAN, etc... You can test the Live Migration if needed.IMPORTANT: that reference VM (installed with WS08R2 Std) must use a fixed virtual disk of 9 GB. If the default dynamically expanding virtual disk (default size is 127 GB) was used, the portal would not be able to Create the VM due to the insufficient storage error. - MGMT: in SCVMM console: Virtual Machines tab, right click the reference VM (must be in the Stopped state), choose “New template” command (the source VM will be generalized (sysprep’ed) and deleted), enter "Base WS08R2 WEB" as the template name, accept all defaults for Hardware screen; for Guest OS screen: set workgroup to CLOUD-WKG, browse to select “\\MGMT.mycompany.com.vn\MSSCVMMLibrary” as the Path. This will take 13 min.- MGMT: in SSP portal, Settings, Configurate VM templates, Import templates, select MGMT as Library server, MSSCVMMLibrary, then click Search, select the listed VM template, “Add Selected”, Next and click “Submit Request”, then click "Save and Close"
2. Create BusinessUnitUser:- MGMT, in SSP portal, click User Roles tab, select BUITAdmin, click View/Edit Member (both administrator and staff1 are included); - Click "User Roles" again, select BusinessUnitUser, View/Edit Members, select Business Unit, Infra, Service…, click Add Members, enter mycompany\staff2 (previously created), Save and Close
3. Create infrastructure in SSP portal:- Requests/ Register business unit (sample data: "Core Banking Unit 01", CBU01, staff1@mycompany.com.vn, Administrators: mycompany\administrator, mycompany\staff1. Click Submit. Click Requests again, and Approve. - Requests/Create Infrastructure Request: enter "Core Banking Infra", enter some Expected Decommision Date, Memory: 1G, Storage: 18.2G, click Next to “Service and Service Roles” page, enter "Internet Banking Service", select "My Demo Environment", Memory: 1G, Storage 18.2G, select ProdLAN and click Add, click “Add Service Roles”, enter "Internet Banking Web Role", add ProdLAN, click Save and Close, click Next to “VM template” tab, select available VM template (9G/400MB), click Next, click "Submit Request"- Requests, select the Infra Request, click "Internet Banking Service", in Template Library section, click “Assign Library”, select MGMT as Library Server and MSSCVMMLibrary as Share, Submit, enter the same info for “Stored Virtual Machine Location” section, click Save and Close. Click "Internet Banking Web Role", click Save and Close. Click the selected VM template, click Save and Close, then click Approve.
4. VM Provisioning: - Close the SSP portal - Shift + Right click IE, Run as different user (or use RDP), mycompany\staff1 (as BUIT admin), add http://MGMT to Favorite Bar. Notice that the Settings tab is missing (expected).- Click Virtual Machines tab, click Create virtual machine, enter 2 as the number of VM, enter “WebServer” as Computer Name and 001 as Index suffix, then Under Template, choose the desired template, click “View Properties” to make sure the Storage is under the 21G limit, then click Create - In NODE1 HyperV Manager, WebServer001 will be created. In Node 2 HyperV Manager, CloudDemo002 will be created, and in Failover Cluster Manager/PRIVATE-CLOUD/Services and Apps node: "SCVMM WebServer001 Resources" and "SCVMM WebServer002 Resources" will be created.
Part 6. PRO Tips implemetation- MGMT: IMPORTANT: Install the SCOM Agent on NODE1, and NODE2 (note: add mycompany\svcacct to either Domain Admins or Local Admin on NODE1/2 for Agent Push Installation to work)
- MGMT: In SCVMM console, right click Private-Cloud host, click PRO tab, deselect Inherit PRO settings... box, select "Enable PRO..." and "Automatically implement PRO tips"
- MGMT: Open Admin Tools/Performance Monitor, delete all existing counters. Click Add, browse to select NODE1, press the Enter key, then choose "Hyper-V Hypervisor Logical Processor - % Guest Run Time", click OK. Do the same for NODE2. Make the line thicker and of different colors.
- In WebServer001 & 002, copy CPU-busy.vbs from c:\shared to the Desktop. Right click, Open with Command Prompt to execute. In the Hyper-V Manager of the Guest, CPU Usage will be around 48%, but in Task Manager of the Host, it is still 0%. In the Performance Monitor, the Guest Run Time lines will be around 50%.
- Use Live Migration to move all WebServer001 & 002 to a single host such as NODE2 --> NODE2 HyperV will show 2 VMs, with CPU usage of each VM is 48% (Task Manager: still 0%), and Performance Monitor counter for NODE2 will be around 99%, and counter for NODE1 will be around 1%.
- MGMT: Wait a little and a PRO Tip will be displayed in SC VMM console as well as SCOM alert view. The PRO Tip will be also executed to automatically balance the VM load.
Appendix. CPU-busy.vbs file content:
Dim goalDim beforeDim xDim yDim igoal = 2181818Do While True before = Timer For i = 0 to goal x = 0.000001 y = sin(x) y = y + 0.00001 Next y = y + 0.01 WScript.Echo "I did three million sines in " & Int(Timer - before + 0.5) & " seconds!"Loop
Part 7. SCVMM SSP Dashboard installation
- server name: DASHBOARD
- install DotNet Framework 3.5.1
- install ms.com Windows SharePoint Services 3.0 x64 wSP2, using the Advanced option, then Stand-alone, once Finished choose to run the ... Configuration Wizard.
- setup sql 2008 w sp1, only Database engine, use svcacct as the service account
- dashboard setup process
+ VMM SSP Dashboard screen. app pool identity mycompany\svcacct. DB server name: MGMT (which is SSP server name). VMM SSP dbname: DITSC (fixed)
+ WSS 30 info screen. site owner: mycompany\administrator. SharePoint DB server name: DASHBOARD ("Session Database Name" will be auto created). accept the default URL which is http://dashboard:12345/
References
- How to Integrate Operations Manager with VMM 2008 R2 http://technet.microsoft.com/en-us/library/ee236428.aspx
- Measure guest operating system processor utilization using Performance Monitor http://technet.microsoft.com/en-us/library/cc768535(BTS.10).aspx
- Guide to Setting up a 2 node Server 2008 failover cluster under HyperV
Hyper-VArchitecture diagram
Full article: http://msdn.microsoft.com/en-us/library/dd722833(v=BTS.10).aspx
* Hyper-V non-Windows OS support: Linux Distributions (VMs configured with 1, 2 or 4 virtual processor). Source: http://www.microsoft.com/windowsserver2008/en/us/hyperv-supported-guest-os.aspx
-- SUSE Linux Enterprise Server 10 with Service Pack 3 (x86 Edition or x64 Edition)-- SUSE Linux Enterprise Server 11 (x86 Edition or x64 Edition)-- Red Hat Enterprise Linux (RHEL) 5.2, 5.3 , 5.4 and 5.5 (x86 Edition or x64 Edition)
* Dynamic Memory with SQL Server: part 1, part 2, part 3
* Licensing for Virtual Environments article
Windows Server 8 virtual machines will help you build private clouds of greater scale by supporting (at least…) 16 virtual processors fully loaded with business critical workloads like SQL Server. Then we show you how you can deliver improved fault tolerance and flexibility, without the added tax or complexity of additional hardware, tools and software licenses, by using the new built-in Hyper-V Replica feature. All it takes is a few clicks, a network connection and Windows Server 8.
Watch this Online video presentation and demo.
Source: http://blogs.technet.com/b/virtualization/archive/2011/07/18/windows-server-8-sneak-preview.aspx
* Lab Reports: Microsoft Exchange 2010 and Hyper-V R2 SP1 Performance Analysis: can support 20,000 simulated Exchange 2010 users
* Lab Reports: Microsoft SQL Server 2008 R2 and Hyper-V R2 SP1 Performance Analysis: can support 80,000 brokerage customers
* Lab Reports: Microsoft SharePoint 2010 and Hyper-V R2 SP1 Performance Analysis : can support more than 450,000 simulated users on a single server
The below article is obtained from: http://pkjayan.wordpress.com/2010/05/17/agent-managed-non-trusted-servers-without-gateway/. The text in green color is my own comment. The scenario is not using any gateway server.
Preparation:
- make sure the wkg-srv has the domain suffix, that means FQDN is wkg-srv.mycompany.com.vn. also a DNS entry for wkg-srv is needed
Monitoring non-trusted servers using SCOM-Step by step
In this scenario, monitoring of a remote, untrusted workgroup or environment isolated from any Active Directory domain is desired. Certificate authentication will be required between the management server and agent-managed workgroup servers, which will authenticate and communicate directly to the management server.Five steps to complete
Testing Ports
To test if the required ports are open:
Do the same from the management server back to the non-trusted server
Certificates need to be installed
Retrieve and install the Root CA certificate
Download root certificate from the Root Certificate Authority server:
Import root certificate to Management Server certificate store
Expand certificates and right click on “Trusted Root Certification
Authorities”
Click on all tasks, Import
When the wizard opens navigate to the downloaded cert is
certnew.p7b . (change the file type to PKCS #7 to select the cert file)
Accept the defaults and finish
Perform the above steps on all Management Servers.
Copy the downloaded root certificate to non-trusted servers and import the same using above steps.
Create and Export Custom OpsMgr Certificate
Do this on the certificate server (at least on Windows Server 2008 Enterprise, or Windows 2008 R2 Standard) Create certificate template for custom OpsMgr Certificate:
In my case, the certificate server is running Windows Server 2008 Enterprise (not R2!)
In the Certification Authority snap-in, select the Local computer (the computer this console is running on) option.
Click Finish.
Click Close, and then click OK.
In the Certification Authority snap-in, verify that the Certificate Templates snap-in and the Certification Authority snap-in appear.
Click Certificate Templates.
In the details pane, right-click Computer, and then click Duplicate Template. You will be presented with 2 options, just choose Windows 2003 Server, Enterprise Edition
On the General tab, change the template name to OpsMgr2007.
Verify that the validity period meets your organization’s requirements.
Click the Request Handling tab, and then click Allow private key to be exported.
Click the Subject name tab, and then click Supply in the Request option.
Click the Security tab.
Grant Enroll and Auto enroll permissions for the following groups in all domains:
Authenticated users
Domain Admins
Domain Computers
Enterprise Admins
Click Apply, and then click OK.
To verify the settings, expand Certificate Templates.
In the details pane, right-click the template that you configured, click Properties, verify your settings, and then click OK.
Expand Certification Authority (local), and then expand your certification authority.
In the console tree, right-click Certificate Templates, point to New, and then click Certificate Template to Issue.
Select the new template, and then click OK.
Verify that the new template appears in the details pane, and then verify that the Server Authentication entry and the Client Authentication entry appear under Intended Purpose.
Close the snap-in.
Click Start, click Run, type gpupdate /force and then press Enter.
Click Start, click Run, type http://<certificateserver>/certsrv in the Open field, and then press ENTER.
If you are prompted, enter the domain administrator account name and the password.
On the Certificate Services Web page, click Request a certificate under Select a task.
Click Advanced certificate request.
Click Create and submit a request to this CA.
In the Certificate template list, verify that your new certificate template appears. In my case, I have to restart the certificate server for that new template to appear.
On the management server, use the Certificates MMC (not the web UI) to request 02 certificates of the newly duplicate template for FQDN of the management server as well as the non-domain server, then export to 2 files named RMS.cfx and WKG-SRV.pfx to be used with MOMImport utility later.
Submit the certificate request to the certification authority server:
In the Name field, type the FQDN of the Root Management Server
Select the Mark key as exportable check box. When you are using the Web certificate request UI, you must also check the Store the certificate in the local computer certificate store box (In my Web certificate enrollment UI, there is no such checkbox, so I have to use Certificate MMC: navigate to Local Computer/Personal and choose to Request a Certificate, then fill the FQDN in the Common Name and Display Name fields, that means the Web UI cannot be used)Click Submit to submit your request to the certification authority server, and then follow the instructions that appear on the screen
Depending on the security configuration on the CA, you have to wait for an administrator to manually approve the request. It is not guaranteed that the CA can be downloaded immediately
Once the certificate is issued, Export the certificate for further configuration
Click Start, click Run, type mmc, and then press Enter
On the File menu, click Add/Remove Snap-in
Click Add
Click Certificates, and then click Add
Select Computer account, and then click Finish
Select Local computer, click Finish, click Close to close the snap-in list, and then click OK to close the Add/remove snap-in window
Expand Certificates (local computer), expand Personal, expand Certificates, and then select a suitable certificate
Right-click the certificate, point to All tasks, and then click Export
Click Next
Select Yes, export private key, and then click Next
Use the default setting for the file format
Type a password for the file
Type a file name, and then click Next. For example, type C:RMS.pfx
Click Finish
Also on the management server, export the certificate of the non-domain server to a file named WKG-SRV.pfx then copy to the non-domain server.
Repeat the above step on all the non-trusted servers. Since the non-trusted servers are not part of the same domain as the CA, create the certificate on a different server and export it to a USB drive or other storage device. Then manually copy it to the gateway server and import it.
The below import step on the management server may not be needed since we are using two separate certificates for the management server and non-domain server???.
Install and configure the Custom OpsMgr Certificate on Management server
Import the custom certificate to local store:
Expand Certificates (local computer), expand Personal, expand Certificates
Right-click the certificate, point to All tasks, and then click Import
Browse and Select the copied certificate, and then click Next
Check off Mark this key as exportable
Click next, make sure the certificate store is personal, click next and finish
On the management server, use MOMCertImport utility to import the RMS.cfx (a password is needed)
Import the custom certificate to Operations Manager on Management server:
C:>MOMCertImport.exe certfilename.pfx
Do this on all SCOM management servers. Root Management Server, Management Servers.
Repeat the following step on the workgroup (non-trusted) computers
Install and configure the Custom OpsMgr Certificate issued by CA for non-trusterd server
Install the agent on the workgroup computer:
Verify that all information that you have entered is correct, and then click Install to start the installation.
When the installation is complete, click Finish.
On the non-domain server, use MOMCertImport utility to import the WKG-SRV.cfx (a password is needed)
After agent installation, Import the custom certificate to Operations Manager:
Run the momcertimport utility
Use the same pfx certificate (the custom OpsMgr certificate) that created in previous step. This tool writes the certificate serial number to the registry. This also helps OpsMgr components find the proper certificate for authenticating easily.
The momcertimport utility is on the install cd under supporttoolsi386
Copy momcertimport.exe and the pfs certificate into the same folder
Open a command prompt, navigate to the folder with both files and type the following command
C:>MOMCertImport.exe certfilename.pfx (Custom OpsMgr Certificate issued by CA for non-trusterd server)
Restart the OpsMgr Health service. On SCOM 2007 R2, the new names are "System Center Data Access/Management and Management Configuration"
Wait for the management server to see the manual installation and to request approval. This should take some time (five to ten minutes).
When you are prompted, approve the agent. The non-trusted server agent can now communicate with the Management server.
The high-level process to obtain a certificate from a stand-alone certification authority (CA) is as follows:
1. Download the Trusted Root (CA) certificate – do this from a machine that has access to the certificate server and then copy to the workgroup machine.
2. Import the Trusted Root (CA) certificate to the workgroup machine.
-------
3. Create a setup information file to use with the CertReq command-line utility –do this on the workgroup machine.
4. Create a request file – do this on the workgroup machine and then copy file to a server that has access to the certificate server
5. Submit a request to the CA using the request file from a server that has access to the certificate server
6. Approve the pending certificate request – from the certificate server
7. Retrieve the certificate from the CA – from a machine that has access to the certificate server and then copy certificate to workgroup computer
8. Import the certificate into the certificate store on the workgrou computer
9. Import the certificate into Operations Manager using MOMCertImport – on workgroup computer.
10. And then install the agent and approve install from opsmgr console
Cheers/ Graham
===========================================================
AD RMS is a Windows Server feature that can help prevent confidential information (Outlook emails, Word, Excel, PowerPoint, XPS documents) from being distributed illegally to the outside world. We can have the users manually turn on protection before sharing these information internally, or we can have these information automatically protected when sending emails internally or when puting confidential documents into some folders on File Servers or SharePoint Server.
* AD RMS overview slide download (2M)
* AD RMS and File Classification Infrastructure (FCI) (using AD RMS Bulk Protection Tool) article
As we announced yesterday we are proud to have NetApp and Cisco participating in the Hyper-V Cloud Fast Track program and delivering pre-validated private cloud solutions for customers.
The new NetApp Hyper-V Cloud Fast Track with Cisco builds upon the reference architecture and layers on the additional capabilities inherent in the NetApp and Cisco infrastructure. This joint solution exemplifies a key tenet of Fast Track which is the extensible nature of the architecture. Check out what NetApp is saying about this solution as well as Cisco.
If you happen to be at Tech Ed, Alex Jauch from NetApp, will be demonstrating some of the capabilities of their offering in Bryon Surace’s VIR327 session on Hyper-V Cloud Fast Track on Tuesday morning at 10:15 to 11:30 in Room B211 – hope to see you there.
Scott RosenbloomSr. Product ManagerServer & Cloud DivisionMicrosoft Corp.
Source: http://blogs.technet.com/b/windowsserver/archive/2011/05/17/hear-what-netapp-and-cisco-are-saying-after-joining-the-hyper-v-fast-track-program.aspx
Lee Gates, Director – Microsoft Business Unit
Today NetApp announced the NetApp Hyper-V Cloud Fast Track with Cisco data center architecture design. This pre-validated configuration is built on research and solution development by the Microsoft Technical Marketing team at NetApp. During early planning for the project, we laid out a few high level NetApp engineering goals to deliver a robust, innovative solution for private clouds:
With these goals, Cisco was a natural partner for the solution:
Great System Center integration PowerShell support for UCS Large memory advantages in the UCS architecture enable VM density and large applications Cisco technical teams have worked well with NetApp on many innovative solutions
There’s a tremendous amount of work behind the solution. It rides on the foundation NetApp made in December 2009 in when our strategic alliance with Microsoft focusing virtualization, cloud computing, and storage & data management was announced. PowerShell support has been incredibly important along with our other System Center integrations. We are particularly proud to use these in the solution and introduce Opalis support.
The team will be in the NetApp booth #1001 at TechEd. Drop by and see us and the demos we’re running every 30 minutes in the theater.
Source: http://blogs.netapp.com/msenviro/2011/05/netapp-hyperv-cloud-fast-track-with-cisco.html