Rory's profileSystem Center TrainingPhotosBlogListsMore Tools Help

Blog


    September 27

    Monitoring AD Security with MOM 2005

    Last night I have the opportunity to deliver a TechNet Monthly session in Microsoft's Mississauga (Toronto, Canada) office in conjuction with Jeremiah Beckett of Secure Vantage and it went over really well!! If you didn't have a chance to attend the event was captured and will be posted shortly for viewing on the TechNet web site but until then, please feel free to have a look at the PowerPoint deck we used for the session which is available for download (no registration required) at http://www.infrontconsulting.com/events.htm.
     
    Have fun... learn MOM!!
     
    Rory McCaw
    Infront Consulting Group www.infrontconsulting.com
     

    New MPs released to the MOM MP Catalog

    I don't know about you but I don't rely on the handy-dandy MP Notifier for updates to MPs as I have learned from experience that the notifier isn't updated as often as it should be. It's usually weeks if not longer before you are alerted via the MP Notifier of updates to MPs released to the MP catalog on the Microsoft site. Instead, I rely on emails from fellow MVP Stuart Renes. Thanks Stuart!! :)
     
    Here's Stuart's MP update news as of Sept 26, 2006...
    There appear to be a whole slew of new/updated MP's available on \downloads, only a few of which have made it into the MOM MP catalog (Availability, ISA 2000-2006 and Base OS) and of those, the Base OS MP has the wrong "Last Updated" date.
     
    Microsoft Availability Reporting Management Pack for Microsoft Operations Manager 2005 (9/25/2006)
    This management pack monitors availability and reliability for SQL, Exchange, IIS, AD and Windows and allows to determine whether the availability and reliability objectives are met.
     
    Microsoft OH-SBE 3.0 Management Pack for MOM 2005 (9/20/2006)
    Microsoft OH-SBE 3.0 Management Pack monitors Order Handling SBE 3.0 services and their availability.
     
    Microsoft Connected Services Framework 3.0 Management Pack for MOM 2005 (9/20/2006)
    Microsoft Connected Service Framework 3.0 (CSF 3.0) Management Pack monitors CSF 3.0 services and their availability.
     
    Microsoft BTS WSE Adapter 3.0 Management Pack for MOM 2005 (9/19/2006)
    Microsoft BTS WSE Adapter 3.0 Management Pack monitors BTS (BizTalk Server) WSE Adapter 3.0 runtime events.
     
    Microsoft OLM WES Adapter 3.0 Management Pack for MOM 2005 (9/19/2006)
    Microsoft OLM WES Adapter 3.0 Management Pack monitors OLM (Office Live Meeting) WES Adapter 3.0 services and their availability.
     
    Microsoft IPTV WES Adapter 3.0 Management Pack for MOM 2005 (9/19/2006)
    Microsoft IPTV WES Adapter 3.0 Management Pack monitors IPTV WES Adapter 3.0 services and their availability.
     
    Windows Base Operating System Management Pack for MOM 2005 (9/18/2006)
    Monitors for conditions that adversely affect the availability, reliability, performance, configuration, and security of Windows Server 4.0, 2000, 2003, and 2003 R2 operating systems. The events detected indicate exceptional conditions associated with various components of Windows operations. Assists with proactive management of Windows Server 2000, 2003, and 2003 R2 systems.
     
    Windows SharePoint Services 3.0 Beta 2 Technical refresh Pack for Microsoft Operations Manager 2005 (9/14/2006)
    This download contains a Microsoft Operations Manager (MOM) management pack and associated documentation for Microsoft Windows SharePoint Services 3.0 Beta 2 Technical Refresh.
     
    SharePoint Server 2007 Beta 2 Technical Refresh Pack for Microsoft Operations Manager 2005 (9/14/2006)
    This download contains a Microsoft Operations Manager (MOM) management pack and associated documentation for Microsoft Office SharePoint Server 2007 Beta 2 Technical Refresh.
     
    Project Server 2007 Beta 2 Technical Refresh Pack for Microsoft Operations Manager 2005 (9/14/2006)
    This download contains a Microsoft Operations Manager (MOM) management pack and associated documentation for Microsoft Office Project Server 2007 Beta 2 Technical Refresh.
     
    Microsoft ISA Server 2000, 2004, and 2006 Management Pack for MOM 2005 (9/12/2006)
    The ISA Server Management Pack for MOM enables you to effectively monitor and maintain your ISA Server infrastructure.
     
    Have fun... learn MOM!!!
    Got to www.infrontconsulting.com/events.htm for information on MOM 2005 / Ops Mgr 2007 training.
    September 11

    Parameters in MOM 2005 in a File Transfer Response

    I am having a bit of an issue getting MOM 2005 parameters to work in the path statement in a file transfer response rule in MOM 2005. Have you ever successfully gotten this to work? Here's the scenario...
     
    Ah, the fun of the BITS upload in MOM as a file transfer response…

     

    Have you ever tried to upload a file in MOM from a MOM agent to a server running IIS with BITS enabled and configured to allow uploads?

     

    Well this is something that I have found requires a great deal of patience and is best tested with bitsadmin prior to implementing in your MOM rules. Not so unlike the need to test your regular expressions outside of MOM before incorporating those into your MOM rules or testing your MOM scripts outside of MOM prior to their incorporation. Are you beginning to sense a theme here? J

     

    So let’s start with a high level overview of what I am trying to do. I have a MOM server named MOM1 with IIS and BITS installed and configured on a virtual directory named VDir (original, I know). I have a MOM agent, deployed to a server on which I have a text file named test.txt in the directory %Programfiles%\Microsoft Operations Manager 2005\Downloaded Files\Mgmt1\. I simply want to transfer this text file using a timed event that runs daily from the MOM agent in the path defined above to the BITS enabled virtual directory located at http://mom1/vdir/test.txt.

     

    Notes: A couple of interesting things to point out. First, the name of the file that you create via the BITS transfer does not have to be the same as the file name you reference on the MOM agent. In other words, we are transferring test.txt from the MOM agent but in your file transfer response, you can rename this to test1.txt if you like. Second, if you use a system variable like %programfiles% or a directory path with spaces in the path, you must put quotes around the whole path such as “%Programfiles%\Microsoft Operations Manager 2005\Downloaded Files\Mgmt1\test.txt”.

     

    The other thing that I learned when getting this to work was to use bitsadmin to test the BITS transfer prior to creating the rule in MOM 2005. Thanks to Dwight Rau and his blog post which provides a sample batch file to test your bits transfer and to Marcus Oh for directing me to Dwight’s post.

     

    So what’s involved in getting this all to work…

     

    1) Create a virtual directory and BTIS enable it for upload. This means going into the Properties of the virtual directory and on the BITS Server Extension tab selecting “Allow clients to transfer data to this virtual directory”

    2) Confirm on the virtual directory tab that no Execute or Script source access permissions have been defined.

    3) If your IIS installation has been further secured using URLscan, add the "BITS_POST" verb to UrlScan's list of allowed HTTP verbs in c:\windows\system32\inetsrv\urlscan.ini. Otherwise, BITS client uploads will fail. For further details see the UrlScan documentation.

    4) Enable anonymous and Integrated Windows authentication on the virtual directory.

     

    So this all works great until you try to be fancy and incorporate the use of a parameter into your MOM rule.

     

    For example, if I define the following settings in my File Transfer Response I continue to receive BITS failures:

    Upload one file from local agent computer to remote virtual directory.

    (Local source path) “%programfiles%\Microsoft Operations Manager 2005\Downloaded Files\MgmtGrp\test_$Logging Computer$.txt”

    Remote destination file name:

    Test_$Logging Computer$.txt

     

    Now, from the help, I do note that I should stay clear of the following parameters; Event Time, First Time, Last Time, Start Time, and Event URL because each of these parameters contain characters that are not allowed by the file system such as colon and forward slash but I am still unable to get this to work with the $Logging Computer$ or $Source Computer$ parameters. But even so, I am unable to get this to work at this time.

     

    If you care to offer any ideas, I welcome them.

     

    Have fun, learn MOM!!

    September 10

    Some great information on MOM 2005

    If you don't regularly visit the TechNet website, you really are missing out as they post some pretty good technical content on a variety of technologies.
     
    If you are interested in some detailed information on MOM 2005, check out the following articles...
     
    Essential Tools for MOM Administration
    The MOM 2005 Resource Kit was recently refreshed and some handy new tools were added. Here's a quick overview of some of the best utilities that will help you get a lot more out of MOM.
    Unlocking the Mystery of WMI Events in MOM
    Virtually every noteworthy Windows event generates a WMI event. Find out how you can monitor WMI events with MOM to provide an even more powerful solution for systems management.
    Integrating MOM into Your Existing Infrastructure
    A solid monitoring solution must be highly available and it must integrate with existing systems. From fault tolerance to connectors, here's what you need to know for planning a MOM deployment that meets both of these requirements.
    Monitoring Security Events with MOM
    Looking for ways to maintain regulatory compliance? Learn how you can use MOM Management Packs to monitor security events and report data as required by HIPAA and Sarbanes-Oxley.

    Tiger Direct SUCKS!!

    I think the title of this post appropriately sums up how I truly feel about Tiger Direct. I have recently had a number of bad experiences from this company, the store locations, their online site and their delivery company.
     
    Starting with the online site, I place an order for a number of systems and UPS completely fumbled the delivery, sending a number of my items to the wrong address and sending me equipment destined for the address that my equipment ended up at. Sufficied to say, their order was not what I was looking for. When I explained the situation to Tiger Direct, it was like this had never happened to them and they didn't know what to do. It took days to get this corrected and have my original order shipped.
     
    What I was told would be a maximum of 3 days for delivery took almost two weeks. And not all of the components I ordered arrived, making building a system without hard drives pretty much useless.
     
    Then when my original order did show up, UPS (against my instructions) left the equipment in an unsecured location. Thankfully nothing was stolen but you really have to question some people's thinking.
     
    I am in shock at how poor the level of professionalism is at Tiger Direct. I will not be shopping there again.
     
     
    September 04

    More Windows issues - This program requires at least Windows 2000 with STPD 1.24 or higher...

    So, today I installed a bunch of new patches from Microsoft on one of my 64-bit Windows Server 2003 R2 systems that I had Daemon Tools installed on to allow me to mount ISO images as virtual CD/DVDs. I am using Daemon Tools because VCD, Microsoft's Virtual CD program isn't able to run on Windows Server 2003 R2. When I attempt to install the vcdrom.sys file, I am informed that the driver is blocked from running.
     
    Upon rebooting my system and logging on, I am presented with a dialog box stating something to the effect "Initialization Error: This program requires at least Windows 2000 with STPD 1.24 or higher. Kernel Debugger must be deactivated."
    To solve this problem, I searched for stpd.sys and found an updated version (Download SPTDinst-v125-x86 or Download SPTDinst-v125-x64)
    available for download at http://forum.alcohol-soft.com/index.php?s=9c9fbfbd5dce69c6893e3a1773d371a5&showtopic=23803. Installing the x64 version in my case and rebooting, solved my problem!
     
    Not sure which patch caused the problem but I ran into the same error after installed the Windows Server 2003 SP2 beta. I haven't tried the above fix on that machine yet but will give that a try later.
     
    Software... always a lot of fun.

    64-bit Woes

    So I went ahead and decided to get with the times and buy a 64 bit O/S to use in the MOM Bootcamp. Wouldn't you know it though, you can't install Virtual PC 2004 SP1 on a Windows XP Professional 64bit system. You can try but you will likely get the same error I did "Attempting to load an X86-64 operating system, however this CPU is not compatible with X86-64 mode." Nice!! Well, there you have it, even Microsoft products don't work on their own 64-bit platform. That's disappointing!! If anyone does know of a way to get this installed, I would welcome your feedback. I hear that SP2 for VPC 2004 will add this support but that's like the famous 'it's in the next version answer' everyone is so tired of hearing.
     
    While I am squawking about 64-bit woes I have another beef with Microsoft's 64-bit o/s but this isn't specific to Windows XP SP2 64bit but also applies to Windows Server 2003, Windows Server 2003 SP1 and Windows Server 2003 R2 as I have tried all of these to try to fix a problem I have with my Nvidia GeForce 6100 integrated graphics card on my Biostar motherboard. I have downloaded and installed every possible driver that is available from both Nvidia and Biostar and tried the default Microsoft drivers but I continue to see the nvidia display device show up in Device Manager with a yellow exclamation mark and darn it, it's driving me crazy. I spent a significant part of my long weekend trying to fix the problem and have had no luck.
     
    The message I continue to see across all 64-bit operating systems is "This device cannot find enough free resources that it can use. (Code 12)" Well I have looked high and low and cannot for the life of me find a way fix this. Credit where credit is due, the Microsoft troubleshooting information is excellent (no, seriously) on this issue however the action they suggest I take, which is to configure the resource manually is greyed out, even when I am logged on as an administrator, so thus far I am stuck!! I have tried applying a hotfix from Microsoft described in KB810186 but wouldn't you know it, this doesn't come in a 64-bit version (AMD socket 939 CPU), only an IA64-bit and x86, neither of which will install on my system, I tried.
     
    So if you know how to solve this one, again I would welcome your feedback!!

    System Center Operations Manager 2007

    Interested in a high level review of System Center Operations Manager, check out http://www.eweek.com/article2/0,1759,1997353,00.asp. MOM's getting a makeover you're going to love it!!