OpsMgr, SCE And MOM Blog : OpsMgr2007-SCE

Operations manager 2007 Sp1 / Essentials 2007 SP1 support for windows server 2008 announced

CliveEastwood — Sat, 26 Jul 2008 03:19:37 GMT

Windows Server 2008 support has been announced. Please see the following resources for more information

The Knowledgebase article KB953141 announces our support of OpsMgr SP1 and SCE SP1 running on Windows Server 2008

The above article discusses 4 required Windows Server 2008 hotfixes which may have to be installed depending on the OpsMgr/SCE role installed on Windows Server 2008

The above article also provide a link to a required OpsMgrSP1/SCESP1 hotfix rollup which is described in Knowledgebase article KB954049

The hotfixes referenced are all available from the Microsoft download center.

The Support Configurations details for Operations Manager 2007 SP1 have been updated to reflect supported Windows Server 2008 roles http://tnstage.dns.microsoft.com/en-us/library/bb309428.aspx

Management Pack Releases for Windows Server 2008 will take place shortly.

The hotfix provided in KB954049 can be installed on localized OpsMgrSP1/SCESP1 installations as it does not provide any localized fixes. The hotfix MSI installer is currently provided in English, localized versions will be provided in the coming weeks.

NOTES:

Please take careful consideration of the OpsMgrSP1/SCESP1 installation notes within KB954049 , particularly:

The OpsMgrSP1/SCESP1 hotfix must be applied after installation of OpsMgr/SCE on Windows Server 2008 or after in-place upgrade of the OS to Windows Server 2008 of an affected OpsMgr/SCE role. This will ensure correct performance counter registration on RMS, SCE Server, Management Server, Gateway server roles.
If User Account Control (UAC) is enabled on Windows Server 2008 when you apply the OpsMgrSP1/SCESP1 hotfix, you MUST execute SystemCenterOperationsManager2007-SP1-KB954049-X86-X64-ENU.MSI from an elevated command prompt. Failure to do so will not allow the display of the hotfix applicaton dialog once the MSI has completed installation of the staging bits on the server.
Read carefully the Known issues section of KB954049. There are a number of requirements and known issues, several still under investigation (Issues 6/7). As more information on Issues 6/7 becomes available and hotfixes developed the KB article will be updated and details provided.

Operations Manager 2007 and Essentials Hotfixes released to solve Reporting install issues covering: (1) Install failure when SDK account is Local System KB936219 , 2) Failure to install in a disjointed namespace

CliveEastwood — Fri, 25 May 2007 20:55:00 GMT

Two hotfixes have been released and are currently only available through Microsoft Customer Support Services (CSS). You will not be charged for the support incident.

System Center Operations Manager 2007 Hotfix details

The forthcoming KB article (unpublished at the moment) will be KB936481. When requesting the hotfix from CSS please mention that you are in need of the hotfix for KB936481.

Here are essentially the details that will be covered in the KB for installing the hotfix. NOTE: This hotfix does resolve two issues as in the title.

Summary
The computer's primary DNS suffix does not match the fully qualified domain name (FQDN) of the domain where it resides. For more information on identifying this issue please read http://technet.microsoft.com/en-us/library/aa998420.aspx.

Symptoms
Installation of Operations Manager 2007 reporting fails with the error message “The specified domain does not exist or cannot be contacted” in the setup log file found in the Temp folder on the computer on which you are installing Operations Manager 2007 reporting.

Installation
This hotfix must be applied to each computer that meets any of the following criteria:

Is a System Center Operations Manager Reporting Server

Is a System Center Operations Manager Root Management Server

To apply this hotfix, you must first:

1. Copy the file SystemCenterOpsMgr07-RTM-KB9356481-X86-AMD64-ENU.MSI to either a local folder or to an accessible network shared folder.

2. Run SystemCenterOpsMgr07-RTM-KB936481-X86-AMD64-ENU.MSI on each applicable computer that meets the predefined criteria.

3. On the computer where you plan to install the reporting server component, first copy Reporting2007.msi (RTM build 5000) to local writable disk; for example, the root or C:\ folder. The Reporting2007.msi file can be found in the reporting folder on the CD image. Copy the Reporting2007.msi file from either the i386 or amd64 folder, depending on which correctly matches your system architecture.

4. When the hotfix package is run, specify the location where the Reporting2007.msi file was placed. On the reporting server, run the VBscript file WiUseXfm.vbs with the full path to the reporting Windows Installer file as the first argument and full path to the .mst file as second argument. This can be done by opening a command prompt window and specifying for example C:\>WiUseXfm.vbs Reporting2007.msi ReportinXfm86.mst. For this example the VBscript, Windows Installer (.msi), and .mst files were placed in the C:\ directory

5. The Reporting2007.msi file size should have increased from 11,383 to 11,427 KB. Run this modified Reporting2007.msi which is on the local disk and installation should succeed.

6. NOTE: When specifying the target RMS Server it must be the Full Qualified Domain Name(FQDN) of the RMS Server for this modified version of the install to succeed.

This hotfix impacts the following installed files:

Microsoft.EnterpriseManagement.OperationsManager.dll

ReportingCAManaged.dll

ReportingCAManagedPac.dll

ReportingCAPack.dll

System Center Essentials 2007 Hotfix details

The forthcoming KB article (unpublished at the moment) will be KB937831. When requesting the hotfix from CSS please mention that you are in need of the hotfix for KB937831.

Here are essentially the details that will be covered in the KB for installing the hotfix. NOTE: This hotfix does resolve two issues as in the title.

Summary
The computer’s primary DNS suffix does not match the fully qualified domain name (FQDN) of the domain where it resides. For more information on identify the issue please read http://technet.microsoft.com/en-us/library/aa998420.aspx.

Symptoms
Installation of System Center Essentials 2007 fails with the error message “The specified domain does not exist or cannot be contacted” in the setup log file found in the Temp folder on the computer on which you are installing System Center Essentials 2007.

Installation
This hotfix must be applied to each computer that meets the following criteria:
Is a System Center Essentials 2007 Management Server.
To apply this hotfix for interactive setup, you must first:
1. Copy the file SCE07-RTM-KB937831-X86-AMD64-ENU to either a local folder or accessible network shared folder.
2. Run SCE07-RTM-KB937831-X86-AMD64-ENU locally on each applicable computer that meets the predefined criteria.

Note: You can run SCE07-RTM-KB937831-X86-AMD64-ENU from either Windows Explorer or from a command prompt.

3. During installation of the Windows Installer the following file is copied to the %temp% directory: Setup.exe.config.
4. During installation of the Windows Installer the following files are copied to the %temp%\TempQFE directory:
SystemCenterOpsMgr07-RTM-KB936481-X86-AMD64-ENU.MSI
qfelist.xml
SCE 2007 hotfix supplemental notice.rtf
QFEHandler.dll
5. Start Essentials 2007 setup normally using SetupSCE.exe.

To apply this hotfix for silent setup, you must first:
1. Copy the Essentials 2007 installation media to a writeable location, such as locally to the server you are installing Essentials 2007.
2. Copy the file SCE07-RTM-KB937831-X86-AMD64-ENU.MSI to either a local folder or accessible network shared folder.
3. Run SCE07-RTM-KB937831-X86-AMD64-ENU.MSI locally on each applicable computer that meets the predefined criteria.

Note: You can run SCE2007SCE07-RTM-KB937831-X86-AMD64-ENU.MSI from either Windows Explorer or from a command prompt.

4. During installation of the Windows Installer the following file is copied to the %temp% directory: Setup.exe.config.
5. During installation of the Windows Installer the following files are copied to the %temp%\TempQFE directory:
SystemCenterOpsMgr07-RTM-KB936481-X86-AMD64-ENU.MSI
qfelist.xml
SCE 2007 hotfix supplemental notice.rtf
QFEHandler.dll
6. Copy the QFEHandler.dll to the local copy of the Essentials installation media’s Setup\i386 or Setup\amd64 directory, depending on the processor architecture of the server.
7. Start Essentials 2007 silent setup using setup.exe with the appropriate command line options.
This hotfix impacts the following installed files:
Microsoft.EnterpriseManagement.OperationsManager.dll
ReportingCAManaged.dll
ReportingCAManagedPac.dll
ReportingCAPack.dll

KB936178 - Error message when you try to import a management pack in System Center Essentials 2007: "OutOfMemoryException"

CliveEastwood — Tue, 22 May 2007 19:11:41 GMT

KB936178 has been released http://support.microsoft.com/?kbid=936178

SYMPTOMS

When you try to import a management pack in Microsoft System Center Essentials 2007, the console stops responding. Then, you receive the following error message:

OutOfMemoryException

RESOLUTION

To resolve this problem, install the hotfix for the Microsoft .NET Framework that is described in Microsoft Knowledge Base article 921217. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

921217 (http://support.microsoft.com/kb/921217/) FIX: A deadlock may occur when you use COM interop cross-context interface marshaling in the .NET Framework 2.0

REFERENCES

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

933987 (http://support.microsoft.com/kb/933987/) Error message when you try to import a management pack by using the System Center Operations Manager 2007 Operations console: "OutOfMemoryException"

Alert Resolution States / Auto-Resolve settings dialog is not present within the System Center Essentials 2007 UI

CliveEastwood — Mon, 21 May 2007 20:42:00 GMT

The System Center Operations Manager 2007 administrator console contains a settings dialog for Alert resolution states and auto-resolve settings which is not present in System Center Essentials 2007. The console dialog was removed from Essentials to reduce the overall complexity of the UI, but it's an often used feature. The dialog should be making a re-appearence in SP1.

Here's the dialog from OpsMgr

In the mean time, for those Essentials customers who do need to add new Alert resolution states, or change the auto-resolution times I wrote a command line SDK tool to add/remove resolution states and change the auto-resolution values. The tool called AlertSettingsTool is downloadable from http://home.comcast.net/~the_eastwoods/MOMDownloads/AlertSettingsTool.zip and has to be run on the Essentials management server.

For example. To add a new Alert resolution state from the command line run :

AlertSettingsTool -a <resolutionstate 1-254> <resolutionstatedescription> E.g. AlertSettingsTool -a 150 "Escalate to Exchange Operators"

To list the current resolution states and auto-resolution settings run AlertSettingsTool -q

The utility is unsupported, but simply uses the Operations Manager SDK. For example: http://msdn2.microsoft.com/en-us/library/microsoft.enterprisemanagement.administration.managementgroupadministration.insertmonitoringalertresolutionstate.aspx

KB934757 - Error message when you click Record after you start the Web Application Editor in Operations Manager 2007: "The requested lookup key was not found in any activation context"

CliveEastwood — Wed, 16 May 2007 20:41:58 GMT

KB934757 (http://support.microsoft.com/?kbid=934757) has been released

SYMPTOMS

When you open the Web Application Editor - ApplicationName dialog box, and then you click Start capture to monitor a Web browser session in Microsoft Systems Center Operations Manager 2007, the Web page opens as expected. However, when you click Record, you receive the following error message:

The requested lookup key was not found in any activation context.

You experience this problem if the following conditions are true:

•
You install Windows Internet Explorer 7 on the computer that is running Operations Manager 2007.

•
You do not restart the computer after you install Internet Explorer 7.

RESOLUTION

To resolve this issue, restart the computer after Internet Explorer 7 has been installed.

KB934756 - How to test notification settings after you configure e-mail notifications for a recipient or for a subscription in Operations Manager 2007

CliveEastwood — Wed, 16 May 2007 20:40:34 GMT

KB934756 (http://support.microsoft.com/?kbid=934756) has been released

INTRODUCTION

This article describes how to test the notification settings after you configure e-mail notifications in Microsoft System Center Operations Manager 2007.

MORE INFORMATION

After you configure e-mail notifications for a recipient or for a subscription in Operations Manager 2007, you may want to test the notification settings to verify that they are configured correctly. To do this, follow these steps.

Step 1: Create a task that logs an event to the event log

Microsoft provides programming examples for illustration only, without warranty either expressed or implied. This includes, but is not limited to, the implied warranties of merchantability or fitness for a particular purpose. This article assumes that you are familiar with the programming language that is being demonstrated and with the tools that are used to create and to debug procedures. Microsoft support engineers can help explain the functionality of a particular procedure. However, they will not modify these examples to provide added functionality or construct procedures to meet your specific requirements.

a.
Start the System Center Operations Manager 2007 Microsoft Management Console (MMC) snap-in.

b.
Click Authoring, expand Management Pack Objects, and then click Tasks.

c.
In the Actions pane, click Create a new task.

d.
In the Select the type of task to create tree, expand Agent Tasks, and then click Run a script.

e.
In the Select destination management pack list, click a management pack, or leave the Default Management Pack option selected, and then click Next.

f.
In the Task name box, type Test task 1, and then click Select.

g.
In the Look for box, type Windows computer, click Windows Computer in the Target list, and then click OK.

h.
Click Next, and then type testevent.vbs in the Name box.

i.
Type or paste the following code in the Script box.

Set objSh = CreateObject("WScript.Shell")
'Write entry to the Application event log
objSh.LogEvent 4, "Operations Manager 2007 test event log entry written successfully." & chr(13)

j.
Click Create.

When this task runs, the following event is logged in the Application log:

Event Source: WSH
Event Category: None
Event ID: 4
Date: date
Time: time
Type: Information
User: N/A
Computer: ServerName
Description: Operations Manager 2007 test event log entry written successfully.

Step 2: Create an alert rule that is triggered by the event ID from the task

Create an alert rule that is triggered when the task writes event ID 4 to the Application log. To do this, follow these steps:

a.
In the System Center Operations Manager 2007 MMC snap-in, click Authoring, and then click Rules.

b.
In the Actions pane, click Create a rule.

c.
Expand Alert Generating Rules, expand Event Based, and then click NT Event Log (Alert).

d.
In the Select destination management pack list, click a management pack, or leave the Default Management Pack option selected, and then click Next.

e.
In the Rule name box, type Test rule 1, and then click Select.

f.
In the Look for box, type Windows computer, click Windows Computer in the Target list, and then click OK.

g.
Click Next, leave the default Application entry in the Log name box, and then click Next.

h.
In the Value column that corresponds to Event ID, type 4.

i.
In the Value column that corresponds to Event Source, type WSH.

j.
Click Next, and then click Create.

k.
In the Rules pane, click Test rule 1, and then click Disable.

Step 3: Create a test subscription to match the alert

Step A: Create a test notification recipient

1.
In the System Center Operations Manager 2007 MMC snap-in, click Administration, expand Notifications, and then click Recipients.

2.
In the Actions pane, click New Notification Recipient.

3.
On the General tab, type the user to whom you want to send e-mail notifications. For example, type Example\Administrator.

4.
Click Notification Devices tab, and then click Add.

5.
In the Notification channel list, click E-mail.

6.
In the Delivery address for the selected channel box, type the recipient e-mail address, and then click Next.

7.
Click Next, type test e-mail notification device in the Notification device name box, and then click Finish.

8.
Click OK.

Step B: Subscribe to the alert

1.
In the System Center Operations Manager 2007 MMC snap-in, click Administration, expand Notifications, and then click Subscriptions.

2.
In the Actions pane, click New Notification Subscription.

3.
In the Subscription name box, type test subscription 1, and then click Add

4.
In the Notification Recipients list, click to select the check box of the test notification recipient that you created, and then click OK.

5.
Click Next four times.

6.
On the Alert Criteria page, click to select all the check boxes in the Alerts of any of checked severity box.

7.
In the AND any checked category box, click to clear all the check boxes except the Alert check box.

8.
Click Next two times, and then click Finish.

Step 4: Enable the event rule

Enable the rule that you created in the "Step 2: Create a rule that is triggered by the event ID from the task" section. To do this, follow these steps:

a.
In the System Center Operations Manager 2007 MMC snap-in, click Authoring, and then click Rules.

b.
In the Rules pane, click Test rule 1.

c.
In the Actions pane, click Enable.

Step 5: Run the task to generate the event

Run the task that you created in the "Step 1: Create a task that logs an event to the event log" section. To do this, follow these steps:

a.
In the System Center Operations Manager 2007 MMC snap-in, click Monitoring.

b.
Expand Monitoring, and then click Task Status.

c.
In the Actions pane, click Test task 1 under Windows Computer Tasks.

d.
In the Actions pane, click Enable.

e.
In the Run Task - Test task 1 dialog box, click Run.

f.
Verify that Succeeded appears next to Status in the Task Output box, and then click Close.

g.
Examine the Application log to verify that event ID 4 was written to the Application log.

h.
In the System Center Operations Manager 2007 MMC snap-in, click Active Alerts under Monitoring.

i.
Verify that a Test rule 1 alert appears in the Active Alerts pane.

Verify that the recipient received the notification e-mail message.
For more information about how to configure alerts, notifications, and subscriptions in Operations Manager 2007, visit the following Microsoft Web site:

http://www.microsoft.com/technet/prodtechnol/mom/opsmgr/webcasts.mspx (http://www.microsoft.com/technet/prodtechnol/mom/opsmgr/webcasts.mspx)

KB934760 - Error message when you try to install a management agent in Operations Manager 2007: "Unknown error 0x80072971"

CliveEastwood — Wed, 16 May 2007 20:38:31 GMT

KB934760 (http://support.microsoft.com/?kbid=934760) has been released

SYMPTOMS

When you try to install a management agent on a remote computer in Microsoft Systems Center Operations Manager 2007, you receive the following error message in the Agent Management Task Status dialog box:

The MOM Server failed to acquire lock to remote computer computer_name. This means there is already an agent management operation proceeding on this computer, please retry the Push Agent operation after some time.
Operation: Agent Install
Install account: account_name
Error Code: 80072971
Error description: Unknown error 0x80072971

You experience this problem when you try to install the management agent on a computer on which a previous management agent installation has failed.
Note You may also experience this problem when you try to remove a management agent from a remote computer. If you experience this problem when you try to remove the management agent from a remote computer, Agent Uninstall appears next to Operation in the error message.

CAUSE

This problem occurs if the LockFileTime.txt file is located in the following folder on the remote computer:

%windir%\422C3AB1-32E0-4411-BF66-A84FEEFCC8E2

When you install or remove a management agent, the Operations Manager 2007 management server copies temporary files to the remote computer. One of these files is named LockFileTime.txt. This lock file is intended to prevent another management server from performing a management agent installation at the same time as the current installation. If the management agent installation is unsuccessful and if the management server loses connectivity with the remote computer, the temporary files may not be removed. Therefore, the LockFileTime.txt may remain in the folder on the remote computer. When the management server next tries to perform an agent installation, the management server detects the lock file. Therefore, the management agent installation is unsuccessful.

RESOLUTION

To resolve this problem, remove the LockFileTime.txt file from the remote computer. To do this, follow these steps:

1.
On the remote computer, click Start, click Run, type %windir%, and then click OK.

2.
Double-click the 422C3AB1-32E0-4411-BF66-A84FEEFCC8E2 folder. Typically, the following files and folders are located in this folder:

•
The InstallHelpers folder

•
The x86 folder

•
The LockTimeFile.txt file

•
The MOMAgent.msi file

•
The MOMAgentInstaller.exe file

•
The MOMAgentInstallerPS.dll file

3.
If a management agent installation is currently not queued in Operations Manager 2007, remove the LockTimeFile.txt file. To do this, right-click LockTimeFile.txt, click Delete, and then click Yes to confirm the removal of this file.

KB937292 - Error message when you run the Operations Manager Prerequisite Viewer for the Server component: "Microsoft.interop.security.azroles.dll is not registered in the global assembly cache"

CliveEastwood — Wed, 16 May 2007 20:26:53 GMT

KB937292 has now been published http://support.microsoft.com/?kbid=937292

SYMPTOMS

When you run the Microsoft System Center Operations Manager 2007 Prerequisite Viewer for the Server component, the prerequisite check returns the following failure status:

Microsoft.interop.security.azroles.dll is not registered in the global assembly cache

CAUSE

This problem occurs if the primary interoperability assembly (Microsoft.interop.security.azroles.dll) is no longer registered in the global assembly cache after you install Microsoft Windows Server 2003 with Service Pack 1 or Windows Server 2003 with Service Pack 2.

RESOLUTION

To resolve this problem in Windows Server 2003 with Service Pack 1, apply the hotfix that is mentioned in article 915786. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

915786 (http://support.microsoft.com/kb/915786/) Authorization Manager-enabled applications may not work after you install Windows Server 2003 Service Pack 1

To resolve this problem in Windows Server 2003 with Service Pack 2, re-register the primary interoperability assembly in the global assembly cache. To do this, follow these steps:

1.
Click Start, click Run, type cmd, and then click OK.

2.
At the command prompt, type the following commands. Press ENTER after each command.

cd %windir%\Microsoft.NET\AuthMan\1.2
azrlreg register Microsoft.interop.security.azroles.dll

3.
Run the Operations Manager Prerequisite Viewer to execute the check again for the Server component.

MORE INFORMATION

To run the Operations Manager 2007 Prerequisite Viewer on the computer that you want to evaluate, follow these steps:

1.
Double-click the Setupom.exe file on the Operations Manager 2007 installation disc.

2.
On the Start page, click Check Prerequisites.

3.
Click to select the Server check box for the server for which you want to evaluate prerequisites. Then click Check to display the status of prerequisites for the selected Operations Manager 2007 components.

Windows Vista Client Monitoring MP for OpsMgr07 Released to the Web

CliveEastwood — Tue, 15 May 2007 07:46:53 GMT

The Vista monitoring MP is now available from http://www.microsoft.com/downloads/details.aspx?FamilyID=a2d42208-d4fd-46a6-9e8d-0ff7694b5634&DisplayLang=en

Overview

The Windows Vista Client Monitoring Management Pack is built on the Windows Diagnostics Infrastructure in Windows Vista that detects, diagnoses and tries to resolve hardware and software problems. Information and analysis on the issues that the system detected are collected by the MP through an agent on the client and sent to OpsMgr where this data is converted into health state, alerts (if need be) and processed for aggregate reports. The MP monitors the following areas:
• Disk reliability and utilization
• Memory reliability and utilization
• System performance
o Runtime performance
o Bootup performance
o Shutdown performance
o Sleep performance
o Resume performance
And surfaces information in these areas by:
1. Raising individual alerts when there are impending catastrophic failures
2. Raising trend-based alerts on significant changes to any OEM or computer group in one of the monitored areas
3. Health monitors giving an in-depth view of the health of individual machines with knowledge articles to guide the admin.
4. Reports giving a landscape view of the health of all monitored clients in all the monitoring areas

SMS 2003 SP3 MP Guide For OpsMgr07 Available for download

CliveEastwood — Tue, 15 May 2007 07:45:17 GMT

The SMS 2003 MP Guide for OpsMgr07 http://www.microsoft.com/downloads/details.aspx?FamilyID=5a512803-01d2-4ae0-8c9e-4030271fb4ce&DisplayLang=en

WSUS 3.0 MP For MOM 2005 released

CliveEastwood — Tue, 15 May 2007 07:41:51 GMT

The WSUS 3.0 MP for MOM 2005 has been released http://www.microsoft.com/downloads/details.aspx?FamilyID=b9eb24e0-93df-430e-9ea7-e46f09a6ab80&DisplayLang=en

Overview

The WSUS 3.0 Management Pack helps you diagnose and resolve the issues reported as events by the WSUS 3.0 server. There are four major event categories: core, database, Web services, and client-related issues.
• Core issues: content directory permissions, disk space, catalog synchronization, content synchronization, the WSUS service, and e-mail notification.
• Database issues
• Web services issues: events raised about the Reporting Web Service, API Remoting Service, Client WebService, Simple Web Authorization Service, Server Synchronization Service, and the Downstream Server Authentication Service.
• Client issues: update installation, the Windows Update Agent, client inventory, client self-update, and clients not reporting
Release History:
5/4/2007 Original release of MP

Operations Manager 2007 Web Console returns Server Error in '/' Application - Requested value 'UrlViewType' was not found.

CliveEastwood — Mon, 14 May 2007 20:07:18 GMT

This issue occurs when a new Web Page View is created in the Operations Manager 2007 console. This view is not supported in the Web console which causes this error to be displayed.

Microsoft are currently working on a fix for this issue. I'll blog details when the fix is released.

Currently the workaround is to remove Web Page Views if any have been defined from the operations console.

Operations Manager 2007 and System Center Essentials Reporting features will fail to install in a disjointed DNS namespace

CliveEastwood — Mon, 14 May 2007 19:59:42 GMT

This is currently a known issue. The Reporting install will roll back when installed in a disjointed namespace.

The symptoms can be the same as those for http://support.microsoft.com/?kbid=936219 (Error message when you try to install System Center Operations Manager 2007 Reporting: "The wizard was interrupted before Operations Manager 2007 could be installed") so there is the possibility that you installed Operations Manager 2007 with the SDK configured as local system and see the timeout issue here, then workaround the problem using the KB article 936220 referred to from 936219, but still fail to install reporting due to the problem below:

Viewing the MOMReportingN.log in the installing users %TEMP% folder you should likely find the following is searched:

Property(S): UnableToGetUserNameFromManagementServerActionAccount = SetPropertiesToManagementServerActionAndSDKAccountCA error: System.DirectoryServices.ActiveDirectory.ActiveDirectoryObjectNotFoundException : The specified domain does not exist or cannot be contacted.
Property(S): UnableToGetUserNameFromManagementServerSDKAccount = SetPropertiesToManagementServerActionAndSDKAccountCA error: System.DirectoryServices.ActiveDirectory.ActiveDirectoryObjectNotFoundException : The specified domain does not exist or cannot be contacted.
MSI (s) (F4:E0) [17:51:21:688]: MainEngineThread is returning 1603

If you are experiencing this problem, a hotfix is being worked upon for both Operations Manager 2007 and Essentials 2007. The hotfix will also incorporate a fix for the issue in http://support.microsoft.com/?kbid=936219

I'll blog the details when the fix is ready for release, which shouldn't be too long from now.

How to configure Audit Collection System (ACS) to use Certificate based authentication

CliveEastwood — Sat, 12 May 2007 00:11:00 GMT

The documentation for this is yet to be published. Since I configured this recently and it's fresh in my mind I thought I'd commit to blog for posterity. Let me know if you found it useful and specifically if you did use the steps and found they need "tweaking".

Options?

In a situation where you are not able to use mutual authentication and also need to collect security events from agents, you can configure ACS forwarders in an untrusted domain to communicate with the collector running on a management server using certificates. Communication between forwarders and a collectors where kerberos mutual autentication is not available is only possible using certificates. If you have implimented a Gateway server, the communication channel used for agent communication and ACS Forward communication is different. ACS forwarder communication will not pass via the gateway server which could be an expectation. If you're using a Gateway Server you can of course install the ACS Collector role on the Gateway, if required. The ACS Collector database role could also reside here, or be located elseware with the option of using SQL Auth if required rather than Integrated security, again if there is no trust and the default SQL port is open on any firewalls. ACS Forwarders would then communicate with the Collector on the Gateway server without the need for certificates.

When a gateway server isn't used, or the Collector role cannot be installed on the Gateway. Each Forwarder can communicate to a Collector in an untrusted domain via certificates (a requirement).

Here's how to do it:

The steps below assume certificate based communication between agent and management server is already configured and is working correctly (See the links at the end of this posting if you need more on configuring certificates for agent communication).

Steps to enable certificate use on the ACS Collector.

The ACS Collector has to be installed on a Management Server role and has to be a member of an active directory forest. It is assumed here that the Management Server is configured to use certificates already for communcation to the agents in the untrusted domain. The same certificate used for Management Server authenication can be used for ACS Collector authenication (this fortunately reduces the amount of certificate maintenance you may have to perform). Recall, the intended purpose of the certificate is Server Authentication and Client Authentication and the Subject name must contain the FQDN of the server to which it is issued.

On the Management Server housing the ACS Collector role execute CMD and from the command prompt navigate to the %systemroot%\system32\security\adtserver folder.
Stop the ADTServer Windows service (e.g. NET STOP ADTSERVER)
Execute ADTServer -c . This should display a list of certificates in the computers personal certificate store and title each with a numeric reference (1...n). If you have more than one listed select the certificate already used for Management Server authenication by selecting its number (e.g. 1 , if there is only one). Selecting 0 will abandon the selection and not make any changes. Also confirm the Issued to (subject) is the FQDN.
Restart the ADTServer Windows Service (e.g. NET START ADTSERVER) . Confirm successful startup in the event log.

Steps to perform on the ACS Forwarders

Assumption is that each of the agents already has a certificate and is communicating normally to the management server.

Launch a copy of MMC.exe and add the Certificates snap-in for the Computer Account (Local Computer)
Locate the certificate in the personal computer store used for OpsMgr agent authentication and export the certificate without the private key in DER encoded binary X.509 format to file. (Recommend the file name is the computer name for identification later)
Transfer the certificate file to a computer in the ACS Collectors domain which has administrator access to Active Directory Users and Computers.
Within Active Directory Users and Computers you will need to create a Computer account matching each server in the untrusted domain for certificate mapping purposes
Once you have this dummy computer account created use the "Name Mappings.." option (you will need Advanced Options enabled from the View menu) against the computer account, and from the X.509 panel select Add and add the certificate file you exported for that computer in the second step above.
Once each agent has an account in AD and the certificate mapping in place, on the agent using a CMD prompt run ADTAgent -c . This should display a list of certificates in the computers personal certificate store and title each with a numeric reference (1...n). If you have more than one listed select the certificate already used for Management Server authenication by selecting its number (e.g. 1 , if there is only one). Selecting 0 will abandon the selection and not make any changes. Also confirm the Issued to (subject) is the FQDN.
The ACS Forwarder should now be in a position to use certificate based authentication.

Steps to enable ACS Forwarders

These steps assume the ACS Forwarder hasn't yet been enabled.

Within the Operations Manager administrator console select the Monitoring space and click the Discovered Inventory node.
From the Actions menu choose State Actions and then Change target type from the sub-menu
In the Look for text entry box type Agent and select Agent from the list and click OK
The Discovered Inventory list will be rebuilt and now entitled Discovered Inventory (Agent)
Select each agent in turn (sorry no multi-select) and from the Actions menu select Health Service Tasks, Enable Audit Collection.

Once the ACS Forwarder starts it should now use certificate based auth to the Collector.

Additional references:

See the Operations Manager 2007 Security Guide for discussion on obtaining and using certificate based authentication using an Enterprise or Standalong CA http://www.microsoft.com/technet/opsmgr/2007/library/proddocs.mspx

How to import a certificate using MOMCertImport using a .PFX file (http://technet.microsoft.com/en-us/library/bb309600.aspx)

Or simpler still

How to import a certicate using MOMCertImport from the certificate store itself (MOMCertImport /SubjectName <thesubjectnameofthecert=FQDN> . E.g. MOMCertImport /SubjectName dc1.contoso.com >

OpsMgr07 PreReq returns Microsoft.interop.security.azroles.dll is not registered in the global assemby cache

CliveEastwood — Wed, 09 May 2007 20:00:36 GMT

KB is forthcoming on this issue.

If you receive the above prereq error when running the Operations Manager 2007 Prerequisite checker you are likely seeing the issue documented in http://support.microsoft.com/kb/915786 (Authorization Manager-enabled applications may not work after you install Windows Server 2003 Service Pack 1)

When Windows Server 2003 is upgraded to Service Pack 1 the assembly Microsoft.interop.security.azroles.dll may no longer be registered in the assembly cache. This file is required by Operations Manager.

If you have Windows Server 2003 SP1 and are affected download the appropriate platform hotfix discussed in the above KB article.

NOTE: If you are running Windows Server 2003 Service Pack 2 and see the same issue this does also apply BUT not the resolution from the KB article. Use the following steps to re-register the assembly in service pack 2:

From a CMD prompt on the system drive type CD %windir%\Microsoft.NET\AuthMan\1.2
Execute the command
azrlreg register Microsoft.interop.security.azroles.dll
From the Operations Manager Prequisite viewer execute the Check again for the Server component.

The utility azrlreg is not present on Service Pack 1 only on SP2. The problem is known to affect Windows Server 2003 SP2 slipstream builds only and not SP1 to SP2 upgrades.