System Center Essentials Team Blog

Management Packs for System Center Essentials

A management pack is a definition file (either with an .xml or .mp extension) that contains predefined monitoring settings that enable an agent to monitor a specific service or application in Operations Manager 2007 or Essentials 2007. These predefined settings include discovery information that allows Operations Manager and Essentials to automatically detect and begin monitoring services and applications, and a knowledge base that contains error and troubleshooting information, alerts, and reports to help you correct the problems detected in your environment.  You import a new or updated management pack into Essentials using the Management Pack Import Wizard (found in the Administration space in the Essentials console).

Almost all of the management packs developed for Operations Manager 2007 can also be used in Essentials 2007.  To help you identify these management packs, you can filter the System Center Pack catalog on Essentials:

http://technet.microsoft.com/en-us/sce/cc462787.aspx

One management pack that you might want to import into Essentials straight away is the updated Essentials 2007 management pack that resolves an issue that was preventing the Remote Assistance task from running on Windows Vista and Server 2008. You can download this management pack from this location:

http://www.microsoft.com/downloads/details.aspx?FamilyId=8F74CC26-5E0E-42F1-96CC-7AE064099190&displaylang=en&displaylang=en

Announcing the System Center Essentials Technology Adoption Program

This announcement is to alert you that the next version of System Center Essentials Technology Adoption Program (TAP) is now accepting nominations.

Do you want to be part of making the next generation of the System Center Essentials product great?  If you are a responsible for managing the IT assets and services for a midsized business and have a passion for providing feedback, you could be a great candidate for our Technology Adoption Program (TAP).  We view our TAP program as one of the most important investments we make as a product team.  We are very selective in which customers we invite to participate and we intend is to partner very closely with you.  Our goal is to develop a mutually beneficial and long term relationship with you to enable building the next version of the System Center Essentials product that is designed to meet your needs to the best of our abilities.

For more information and to nominate yourself for the TAP please click this link.

Thank you!  The System Center Essentials Team.

Using the Remote Assistance task with Vista and Server 2008 computers

(thanks to Essentials team member Stephanie for this article!) 

If you've tried to use the Remote Assistance task in the Essentials Computer space to connect to a Vista or Windows Server 2008 computer, you've found that the task to initiate a Remote Assistance session does not work.  The task does not work because of a change in how Remote Assistance works in Vista and Server 2008.

In Windows XP and Server 2003, Remote Assistance was initated by using helpctr.exe.  In Vista and Server 2008, Remote Assistance is initated by using msra.exe.  helpctr.exe cannot be used to connect to Vista and Server 2008 computers.  msra.exe can be used to connect to XP, Server 2003, Vista and Server 2008 computers.  Also, msra.exe can only be executed on Vista and Server 2008 computers.

The Remote Assistance task in the Essentials computer space only uses helpctr.exe.  That said, you do not need to wait for a new management pack release to get this functionality.  Below are instructions on how to create your own task for Remote Assistance that will display in the Computer space and work with Vista and Server 2008.

In the Authoring space (the paper and pencil in the bottom of the wunderbar) expand Management Pack objects and right click on 'Tasks'.  Choose create a new task.  Choose Console Tasks\Command Line.  Click next. Name the task "Remote Assistance for Vista/Server 2008".  Chose a task target by clicking the Select... button and target "Windows Computer".  Chose next.  In the Application field, enter %SystemRoot%\system32\msra.exe.  In the parameters field, add:

/offerra $Target/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$ 

In the working directory, chose %SYSTEMROOT%\system32.  Uncheck the option to display output when the task is run.

Now from the Computers space, choosing a computer in a view such as All Computers, your task will appear in the available tasks lists next to the Remote Assistance task that uses helpctr.exe.  Note that this new Remote Assistance task will only work if you are using the Essentials console on a Vista or Server 2008 computer.

Want to receive emailed reports from Essentials?

Check out this blog post from Essentials MVP Bjorn Axell on how to use SQL Server Standard Edition or Enterprise Edition reporting services to scheduled Essentials reports to be delivered via subscriptions. 

http://advisec.wordpress.com/2008/08/13/would-you-like-to-be-able-to-schedule-reports-in-sce/

Moving from WSUS to System Center Essentials? Be sure to clean up your Group Policy settings!

If you used WSUS to keep your computers secure before upgrading to System Center Essentials, you probably used Group Policy to configure the Windows Update agent settings on the computers in your environment to connect to your WSUS server.  System Center Essentials, which includes WSUS technology, uses the same Group Policy settings to configure managed computers to connect to the Essentials server..  If you install Essentials, without removing these Windows Update settings from your existing Group Policies, you may notice this symptom in the Computer space of the Essentials console.

Computers will be listed, but their hardware inventory will be listed as unknown, and they will also show as 'Not yet contacted'.  This is because the Windows Update agent on that computer it not connecting to the Essentials server for updates and to submit inventory.

To correct this condition, check your Group Policy objects that are applicable to computers being managed by Essentials to see if the Windows Update are still configured configured (these settings are in 'Computer Configuration\Administrative Templates\Windows Components\Windows Update' in each GPO).  If you do find these, carefully consider whether they can be removed and if they are interfering with the same settings that are being applied by the the 'SCE Managed Computers (<essentials server name_MG>)' Group Policy Object.  This is the GPO that Essentials uses to configure the Windows Update agent on Essentials managed computers.  Once these settings are removed from other Group Policy objects, you should notice that your computers will start reporting inventory within a few hours (due to the Group Policy refresh interval of 2 hours plus a random 0-30 minutes).

Microsoft Updates and Windows Server Updates Services

System Center Essentials is built on top of Windows Server Updates Services (WSUS) technologies.  This allows Essentials to take advantage of the standardized Microsoft software updates technologies, content on Microsoft Update (MU), and deliver additional value by building on top of the WSUS platform.

However, it also means that System Center Essentials is sometimes affected by issues that affect WSUS and MU.  Over the last few weeks, two issues have been discovered that do affect Essentials.  Please read through the linked articles on this page to understand the issues and if you're affected.

Some Computer do not receive updates from the WSUS server

If you've deployed Office 2003 SP1 using Essentials, you may encounter this problem.

Consider the following situation. You use Microsoft Windows Server Update Services (WSUS) 3.0 to deploy software updates and hotfixes to computers that are in your organization. However, some computers do not receive updates from the WSUS server. This problem occurs if the computers have Microsoft Office 2003 or components of Office 2003 installed.

KB 954960 has been released  to address this issue and the WSUS team blogged about it here: http://blogs.technet.com/wsus/archive/2008/07/10/a-fix-for-client-server-synchronization-issues.aspx.

Millions of drivers, drivers for me...Millions of drivers, drivers for free..

If you've configured Essentials to synchronize driver content, you may not have noticed that many thousands of Realtek drivers were synchronized over the last week. Please see this article on the WSUS for the details http://blogs.technet.com/wsus/archive/2008/07/17/so-many-drivers.aspx.  Bottom line - the drivers are targetted at the right hardware, this is causing many, many instances of the driver to be distributed, and we're working on a long-term fix.

Essentials Team at TechEd US 2008!

We'll be at TechEd again this year with our demo packed sessions!  We'll also have a booth on the expo floor that you can drop by anytime to ask questions of the Essentials product team.

Check out our sessions and more at http://www.msteched.com!

Caching Microsoft Update content in System Center Essentials

A question came up in the Technet forums around content caching, and what variables exist to adjust it.   The footprint of cached content on the wSUS/SCE server take into consideration four variants:

• Products (XP/2K3 as examples)
• Classifications (Seciruty / Critical / Service packs)
• Languages (EN, DE, JA, etc..)
• Choosing to utilize Express files ( I will explain this one in more detail below)

SCE default configuration will bring in nearly 8GB of content; provided your needs stay within one language. 

...Now about Express files..

There are two ways that a package can install on your managed systems; Stand-alone, or Express.  For stand-alone, all the possible changes which can happen during that installation are contained in the package.  Let's say Foo.Dll is revising to 1.2, and Bar.Exe is revising to 1.3.  In this case, the old Foo.Dll and Bar.exe would be removed from the system, and the new ones applied.  This is the safest, and most common way patching happens.  However, it means that the entire package travels across the LAN/WAN when installation is necessary.

In the Express scenario, it may be that Workstation1 already had Foo.dll version 1.2, but not the latest version of Bar.dll.  It's neighbor, Workstation2 had just the opposite.  If the EXPRESS files were present, Workstation1 and 2 would ask the SCE/WSUS server for only the binary ranges it needed, and the acutal bytes which went across your LAN/WAN would be very close in footprint to the bytes which were needed to simply replace the specific files targeted. 

So, Express seems to be the winner here (almost).  In order to provide this optimization, the Update Services infrastructure needs to have fault tolerance.  Express packages will not work for 100% of the systems in need of patching.  Therefore, enabling express option means that the system will download the standalone version of an update as well as the Express version of that update.  Should it need to fall-back due to failure, the standalone version will be locally available.  Also, the express files are 2-4 times as large as the standalone packages. 

The tradeoff question is:  Should the optimization target ingress to the WSUS server at the cost of more LAN/WAN traffic, or the converse? 

Determining which packages are "Needed" across your managed environment

Over the past six months, many within the System Center Essentials community provided feedback on the inability of SCE to show which updates and software are needed by managed systems.  Workarounds exist today for Microsoft Update content, but when it comes to locally-published content, or driver content obtained from a partner catalog the question remains unanswered. 

It is possible to call into the WSUS 3.0 APIs and obtain this information through the use of Powershell scripting using the steps below.

1. Install PowerShell on your SCE server, or workstation running the SCE remote management console. 
2. Copy the attached script, and save it as 'NeededContent.ps1'
3. Launch the powershell console window 
4. Sign the file, or set script execution to 'unrestricted' by running the following command:  Set-ExecutionPolicy UnRestricted  !! Note - It is important to understand the possible risks of running unsigned scripts.  More details at:  http://technet.microsoft.com/en-us/magazine/cc137728.aspx 
5. Call the file from the powershell console window.  If it was located at d:\myscripts\ , the command would read:  PS > D:\myscripts\NeededContent.ps1

Additional notes -

• You will need to execute the script in the context of a WSUS administrator, or WSUS reporter role. 
• The script allows for the display of Microsoft Update content as well, but it will take considerably longer to execute due to the large volume of updates. 
• The script will filter out packages which are declined.

Hope this helps! 
/Ty

System Center Essentials team at MMS 2008!

If you're attending the Microsoft Management Summit this week in Las Vegas, be sure to stop by the Essentials booth on expo floor, or catch us at one of the many sessions we are hosting this week.

 http://www.mms-2008.com

"Performance Module could not find a performance counter" temporary workaround

If you are receiving alerts “Performance Module could not find a performance counter” in the Essentials Console, please perform thefollowing steps to disable the rule via override.

1.       Navigate to the Authoring Space in the Console.

2.       Select “Rules” under “Management Pack Objects”.

3.       Type “Performance Data Source Module” in the “Look for:” box and click “Find Now”.  Be sure a Scope is not set or filtering the “Health Service” Target.

4.       Find the rule, “Performance Data Source Module could not find a performance counter” under “Type: Health Service (2)”, right-click, select “Overrides”, “Disable the Rule”, “For all objects of type:  Health Service”.

5.       When prompted, “Are you sure you want to disable this rule for Health Service?” click “Yes”.

Microsoft is working on the long-term solution to address this problem.

Thanks, Dustin Jones

Microsoft user research study requesting participants!

Microsoft User Research is inviting IT professionals in the contiguous US to participate in a user research study.  We are looking to learn from those who perform IT services for their company; such as routine server maintenance tasks, various levels of troubleshooting, daily server, network or desktop management, and the planning and implementation of technology.  We want to meet at your office to learn from you, the experts, so that we can determine what needs to be improved in our software.  This gives you the chance to tell us what your needs are and meet with some members of our product team.  We highly value your feedback and will be offering Microsoft software in appreciation of your time and participation.  If this is something that you or others at your company would be interested in, please reply to ms_sitev@microsoft.com at your earliest convenience.  We are scheduling site visits to start in mid-April.

Essentials 2007 SP1 Released!

The entire System Center Essentials team is proud to announce that System Center Essentials 2007 Service Pack 1 (SP1) is released and available!  SP1 incorporates the following the improvements and major changes in functionality:

• Support for managing workgroup-joined computers
• Support for monitoring SNMPv1 network devices
• Support for using multiple auto-approval rules in update management
• Support for using a remote SQL Server 2005 instance on a computer with a different architecture (x86 or x64) than that of the computer running the Essentials 2007 management server
• Support for running the Essentials 2007 management server, console and agent on computers running Windows Server 2008 within 90 days of the release of Essentials 2007 SP1. Management packs for Windows Server 2008 and its role will be available shortly after the release of Windows Server 2008.
• Improved backup and disaster recovery guidance
• Improvements in management pack quality
• Improvements in performance, usability, and supportability

You can obtain the SP1 upgrade package here: http://www.microsoft.com/downloads/details.aspx?FamilyId=20824F84-B98A-4E42-93A7-045A7A58E289&displaylang=en

If you've not yet had an opportunity to check out Essentials, download and evaluate the slipstreamed SP1 edition of the Essentials 2007 evaluation here: http://www.microsoft.com/downloads/details.aspx?FamilyID=246df207-f051-47c3-bd64-c9072281c3c8&DisplayLang=en

Vista SP1 will be distributed via Microsoft Update Catalog

[Correction:  The Vista SP1 package will be availabe via the Microsoft Update Catalog - I'll provide a link to the KB article detailing how to import Vista SP1 into Essentials once the article is live!] 

Windows Vista SP1 will be released as an update on Microsoft Update (MU) Catalog. The patch is very large and there is a bug in Windows Server 2003 in the WinVerifyTrust API that will cause signing validation to fail.

What this means is that once you approve this update on a System Center Essentials 2007 server on a Windows Server 2003 server, every time the server sync’s from MU it will redownload the package, fail the cert validation, and so the download will fail. The problem will continue until you install the WinVerifyTrust patch on the System Center Essentials server. This patch is a hotfix (not a public GDR), so is not intended to be widely distributed. We recommend it only be installed on the System Center Essentials server itself.

You can obtain this hotfix here:

Windows Server Update Services cannot download large Windows update files in Windows Server 2003
http://support.microsoft.com/kb/888303/en-us

Internet Explorer 7 to be distributed via WSUS in February

Hi Folks,

IE 7 will be distributed via WSUS in February as an update rollup package.  If you chose the default settings when configuring Updating Management in Essentials 2007, this package will not be automatically downloaded and distributed to computers in your company.  If you wish to have it distributed automatically, check out this KB article.  Its instructions are for WSUS, but will also work for Essentials by changing its Update Management settings to include update rollup packages.

Windows Internet Explorer 7 to be distributed via WSUS February 12, 2008; May require administrator action to manage the rollout
http://support.microsoft.com/kb/946202/en-us