The Industry Insiders : Enterprise Management

Windows 2008 protection from Accidental deletion

jamesone — Wed, 31 Oct 2007 19:18:00 GMT

Many thanks to Richard Siddaway for his article on protecting AD objects from Accidental Deletion. Well worth a read if you've ever deleted the wrong thing from AD.

Migrating WSUS to a new server without downloading updates

Eileen_Brown — Thu, 15 Mar 2007 18:34:00 GMT

Mark Wilson has written an interesting and comprehensive article on his blog which he's kindly given me permission to reproduce here. It not only talks about migrating the content and configuration from one WSUS server to another, but also includes a script to switch the modes of the server from replica to standalone mode. Mark also includes links to the WSUS Migrate tool and articles from other bloggers who have had the same challenges.

You can access his article here...

Free Microsoft Support resources

Eileen_Brown — Wed, 19 Oct 2005 16:24:00 GMT

Blake has compiled an amazing collection of all of the support resources, newsgroups, how to articles, team blogs and tips and published it here... This must have taken an amazing amount of time to review and research and is just about the most comprehensive collection of resources on one page that I've ever seen.

Read, and bookmark this collection of tips here. An absolutely fantastic job. Thank you Blake...

The Formula One car of Systems Management

Eileen_Brown — Tue, 02 Aug 2005 18:31:00 GMT

Gordon has written an article explaining why MOM 2005 is like a Formula 1 racing car. It's a good analogy

Read about it here...

A fresh approach to a technology refresh

Eileen_Brown — Wed, 27 Apr 2005 11:02:00 GMT

Mark did some work for a local authority in the UK when they were going through their technology refresh recently. His article briefly summarises what would normally be a multi page case study of how a customer brought technology to bear in order to reduce...(read more)

MOM - a solution for the SME Managed Service Provider

Eileen_Brown — Tue, 12 Apr 2005 07:09:00 GMT

Microsoft Operations Manager

A Solution for the SME Managed Service Provider

Background

The expansion of broadband availability in the UK is having a significant impact on the complexity and penetration of IT systems and technology in the Small to Medium Enterprise (SME) and Small Corporate sectors. Broadband technology such as ADSL and Cable provides fast permanent Internet connections for businesses at significantly lower prices than traditional Leased Lines of equivalent speeds. Smaller businesses can use networking and communications in a way that only a couple of years ago was viable only for larger corporates. The obvious benefit to broadband is vastly improved connection speeds to the Internet, supporting much more effective use of the Web as an information and research tool.

This is the usual driving force behind installation of broadband at smaller companies and is also the primary reason most home users switch to broadband.

However, less obvious benefits are beginning to prove even more compelling. For example, companies with more than one office can make use of secure Virtual Private Network (VPN) technology to link the networks of each site together over the Internet. The business can share information between users at the two sites as if they were in the same building. VPN technology is allowing some businesses using the approach to create a network with several sites connected together. This Wide Area Network (WAN) would traditionally been created using private circuits and would have been cost prohibitive for many companies, but low cost broadband technology enables the benefits of a WAN to be enjoyed by smaller companies.

Additionally, outsourced IT support providers can now make use of the ‘always on’ Internet connection to perform remote management and monitoring of networks and servers for supported clients. The result is a high quality IT support service, available to smaller companies who do not have the budget or resources to manage the systems themselves.

The increased demands of managing IT systems and ensuring that the network is secure means that smaller companies are increasingly turning to support providers, and outsourcing of IT services and support is now a commercial proposition in the small corporate and SME sectors.

The utilisation of available Microsoft technologies such as Microsoft Operations Manager and Systems Management Server means a high quality and fully pro-active network management solution can be provided to smaller companies at a realistic and cost effective price, bringing the level of support service traditionally only available to large, corporate customers.

Remote Server Management

The implementation of an operational management framework using Microsoft remote server management technology such as Microsoft Operations Manager (MOM) means that Windows 2000 and 2003 servers and the Microsoft based applications that run on them can be pro-actively and effectively monitored from a centralised management location. Using MOM’s sophisticated agent technology, server and application based events and performance measurements are collected from each server and are sent back to a central point allowing remote IT support personnel to monitor the health of a customers Windows 2000\2003 environment accurately and in real time. This approach provides the basis for easy identification of operational problems as they arise and allows any necessary remedial action to be taken straight away, quite often with no impact on the end user.

Automatic responses to selected events and performance thresholds can be deployed locally providing immediate remedial action to many problems that occur, allowing remote IT support personnel to focus in on and respond quicker to, the more critical issues that sometimes arise.

Extensive reporting capabilities within Microsoft Operations Manager ensure that accurate information on the general day to day running of critical servers is always available, this not only helps remote IT support personnel immediately analyse long term trends in server and application performance, allowing them to identify potential issues long before they arise, but provides invaluable capacity planning information allowing the right choices to be relayed to the customer for the upgrade and re-deployment of existing resources and future deployment of new technology.

This pro-active rather than re-active approach to server management ensures that the servers and applications always run to their maximum capacity and ensures high availability and reliability of business operations which is essential to the growth of smaller companies moving forward.

Why Microsoft Operations Manager?

Microsoft Operations Manager is a comprehensive server monitoring solution that improves the availability, performance, and security of Windows–based networks and applications. MOM can provide central monitoring and automatic problem resolution for networks of tens to thousands of computers, continuously monitoring user actions, application software, servers, and desktop computers running Microsoft Windows 2000 or later.

Microsoft Operations Manager captures and reports events throughout your network. By defining rules, you can automate responses or assign problems to a specific staff member for resolution. MOM displays information about service level exceptions, open alerts, and computers in the configuration you have selected for monitoring. You can quickly check specific alert and event details, performance data, and monitored computer status. MOM also displays useful information about computers and their alerts. You can display a view of all computers to see computer properties, alerts, events, performance, computer group membership, and the processing rules applied to each computer in the configuration group.

This centralised approach to monitoring large numbers of servers makes the tool the perfect solution for today’s service provider allowing a small number of skilled engineers to monitor a large estate of servers, accurately and efficiently, focusing in on the critical problems that arise rather than fire-fighting issues after they have been escalated by the end user. The in-built, subject matter based, knowledge that is provided by MOM’s built in management packs allows problems to be diagnosed quickly and often without the need to spend hours searching through vendor-specific knowledge base articles or talking to external support personnel, this means that engineers time is spent effectively and also ensures that they are constantly improving their troubleshooting skills which can prove vital to growing service providers who do not necessarily have the knowledge amongst their personnel to cover all of the technical areas they may be supporting. The ability to add in-house knowledge to each problem as it is being solved also addresses another key problem for the service provider, where by engineers who solve issues quite often retain that troubleshooting information in their heads or in their own notes. MOM allows you to update the knowledge base article for each alert with customised information so the in-house knowledge used to solve the problem can be added and used again when the alert is raised in future. This feature makes MOM an extremely effective support tool and ensures that it grows as your support operation does, making sure that all essential problem resolution information is captured and re-used again and again.

Streamlining the Support Operation

Microsoft Operations Manager not only provides a swift and accurate platform for effective problem resolution but it also changes the way your support operation works. Through effective use of alert ownership and MOM’s built-in SLA assignment, alerts can be sent directly to the technical personnel who deal with the particular area where the problem arises. Adding ownership to issues allows problems to be dealt with efficiently and allows management to easily see who is dealing with what problems. For many IT support providers, this can prove to be a key part of the support operation. MOM alerts are dealt with by technical support personnel, who take ownership of the problem and immediately make a decision on whether the problem can be dealt with locally, by a helpdesk engineer, or whether it should be escalated to 2^ndor 3^rd Line engineers for action. When a 2^nd or 3^rd Line engineer receives the alert he takes ownership of the problem and sees it through to its successful resolution. Because an emphasis is made on who owns the issue, customer problems are always properly escalated and are always seen through to their conclusion without any lapses. A high-level, historical view of how long alerts are being handled at their relevant stages of escalation can be viewed by management allowing them to not only track how customers are being serviced, but to gauge how effectively the support operation is running, making staffing changes where necessary. This whole framework approach using Microsoft remote management technology coupled with documented guidelines and procedures gives todays service providers a great foundation on which to expand their existing support operation and ensures that the existing operation is ran more efficiently and effectively giving maximum ROI to customers.

Gordon McKenna

Why do we test?

Eileen_Brown — Tue, 12 Apr 2005 07:05:00 GMT

Andy Taylor

A few years ago I was working for a major UK outsourcing company and I was involved with a key account within large UK organisations. I was given a project to upgrade a customers McAfee virus scanner to CA’s eTrust version 6 (like I said it was a few years back J ). The project looked straight forward although the timescales were quite aggressive after an oversight re license renewal gave us only 2 months to completely replace the antivirus software for 12,000 clients.

I started the project like I do all others with a good high level design trying to encompass all the major goals of the project and identify the main risks. Now anti-virus software is not my normal job but it does in theory fall into the category system management so myself and a colleague built up a model office environment to test the new product on a very old build, the customer used NT 4 service pack 3 (don’t ask why I would need to write an 100 pages just to try and explain). The first major item the testing drew out was that I couldn’t use both the McAfee and eTrust agent on the box at the same time, well I could but it took 40 minutes to log in if you did. So we had the challenge of how to go about removing McAfee and install eTrust without losing antivirus protection for any length of time. So we decided to:

· Disable the services and functionality of McAfee

· Install the new eTrust software, test everything worked

· If it didn’t, disable any bits of eTrust and re-enable McAfee and log the install as a failure and required checking by an operator.

Now all this was done in a very complex batch script (which ended up being at version 17 by the time we finished testing it and rolled to live !) and the script along with the required software files were software delivered to the clients on a rolling schedule to minimise impact to the network.

Now you can imagine we did a fair but of testing and most of the 2 months we had allocated for the project was testing and sample rollouts to small pilot groups of PC’s, but we didn’t do enough, we failed to test one key area of the product, network bandwidth usage.

We made some allowances for this in the lab we knew the product would need to get signature updates and send data back occasional but with most of the links being good and the actually client communication usually always back to a local site server we didn’t believe we would have a problem… how wrong we were.

We started the deployment with some of the smaller sites, no problems we were getting a good hit rate of about 95% success and the project picked up speed; we got to the final large site in a matter of weeks. This site held about 3500 clients we started rollout, the following day all hell broke out. Clients started reporting that it took anything from 10 minutes to one hour to log on each morning, we spent all day trying to figure out why and nothing major came up and the problem seemed to disappear as the day went on. Next day same thing happened again. We added some network monitoring software onto the network and the amount of LDAP queries the clients were generating each to the Domain Controller each morning was horrendous. After a lot of testing we found the problem because the clients were running SP3 the new antivirus program couldn’t mark that it had virus checked a file and unless it changed not to bother with it again, this feature of the OS didn’t come in to the until SP4

…so every morning when the client started the antivirus program would go

… ok need to check this file

… now who owns it

… I know I’ll ask the DC

... for every system file it was trying to load into memory

… ouch.

The DC’s would get swamped and the clients would start to queue there requests… After a few frantic calls to the CA, after all we were trying to do stuff with there product on an unsupported service pack, we got a hotfix and the problem went away.

Ok so what can we learn:-

When you start to look at implementing a new product try and think out of the box when it comes to drawing up your test plan. Factor in all parts of the network that may have contact to the product not just the areas you may be working on. Think about how you roll out the product and continue to test the solution as you deploy to find any vulnerability. Or in other words test test and test again.

Would we have found this in the lab… probably not as we didn’t do network tracing as part of our acceptance tests for our products before they went live… but guess what they do now…