Kitaab

We implemented SCOM 2012 SP1 , We imported the latest Managemnet pack for monitoring Active Directory Somehow the topology views in AD management pack always remained not monitored. Here is what i checked : The agents on DC's was installed from within SCOM console after discovery We used a domain Administrator to install the agent and then the local system account as action account the DC's started alerting and we couldn't find any errors in the event logs , however the topology views all remained not Monitored. AD helper Object was installed on all the domain controllers as the agents were pushed from SCOM Console. I ran  hslockdown /L on the Domain controllers Local System Account (our default Action account) was not denied permission. Still i tried running Hslockdown "ManagemnetGroupName" /A "NT AUTHORITY\SYSTEM" But the topology views did not update. -Verified Agent proxy was enabled on all DC's and MS -All the agent...

vSphere 5.1 vCenter Virtual Appliance AD Integration When i tried to enable Active directory in  vCVA 5.1 it failed at various stages Firstly i was not able to enable Active directory in vCVA as it gave an error shown here: Once i was able to fix this error and enable it successfully , i still couldnt see the domain while adding permissions in vSphere Web Client or vSphere Client Here is the Sequence of steps i followed to make it work in our test: 1.Created a Host and PTR record for the vcenter Appliance in our Domain DNS 2.Made sure the Time zone on vCVA is set correctly 3.Make sure the Hostname of the vCVA is the one we created in the step 1 (Under network Tab) 4.Mention the IP address for DNS servers correctly 4.The username to enable Active directory should have permissions on AD and we need to specify it as user@domain.com format 5.All Services showuld be Stared and Running 6.Rebooted vCVA and the ESXi host on which it was deployed I dont...

When we enable ACS on the in SCOM environment , after a couple of days we can see what all is being collected. For us we were seeing a lot of events being collected and most of them were not useful for us to monitor: the final NOT Query filter i applied was: AdtAdmin /setquery /query:"SELECT * FROM AdtsEvent WHERE NOT (EventId=4776 OR EventId=4689 OR EventId=4688 OR EventId=4768 OR EventId=4769 OR EventId=4770 OR EventId=4771 OR EventId=4772 OR EventId=4696 OR EventId=5159 OR EventId=5152 OR EventId=5157 OR  PRIMARYUSER LIKE '%SVC%' OR PRIMARYUSER LIKE '%$%' OR TARGETUSER LIKE '%$%')" This reduced a lot of Noise in our environment. In order to enable this filter what we need to do is . Login to the ACS collector: Open command prompt Browse to the following directory: C:\Windows\System32\Security\AdtServer> Then Run the Query that i mentioned above. In the query i used PrimaryUser and TargetUser as filter PrimaryUser = Prim...

Needed to make a SCCM collection for machines that do not have Citrix Client / receiver installed. After a lot of modifications there is what my final wql - query looked like (Sub -Select) select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System  inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId  where SMS_G_System_COMPUTER_SYSTEM.Name not in  (select distinct SMS_G_System_COMPUTER_SYSTEM.Name  from SMS_R_System  inner join SMS_G_System_COMPUTER_SYSTEM on SMS_G_System_COMPUTER_SYSTEM.ResourceID = SMS_R_System.ResourceId  inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId  where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName like  " Citrix Online plug-in %") We can utilize this query to crea...

While Implementing monitoring for Schedule tasks with SCOM 2012 , we utilized a community management pack http://rburri.wordpress.com/2008/02/14/windows-scheduled-tasks-management-pack-for-opsmgr-2007/ After we imported the MP , we started receiving a lot of alerts related to some tasks which no one knew about . It was a schedule task related to User profile manager software that we had tested. We wanted to delete this schedule task on all the machines that raised the alert In order to find the machines , we used the following SQL query against Opsmgr db SELECT  MonitoringObjectPath,MonitoringObjectName, AlertStringName, AlertStringDescription, MonitoringRuleId, Name FROM Alertview WITH (NOLOCK) WHERE TimeRaised is not NULL AND AlertStringName like 'Scheduled Task failed to complete successfully' And MonitoringObjectName like '\updater.exe' Then i created a batch file with the following content schtasks /delete /F /TN "updater.exe" wher...

Noticed a strange behavior with new SCOM 2012 SP1 Web Application transaction and Availability Monitoring If we create a Web Application monitor for internal websites without the FQDN it doesn't work. e.g if we try and create the Web Application monitor to monitor : http://ourwebsite it Fails However http://ourwebsite.domain.com Works In SCOM 2007 R2 ,we dint face this issue. Maybe a Bug of somekind Hope this helps

We needed to uninstall Java 7 from Machines.For that we created a collection based on product ID instead of Display Name in Add Remove programs. This collection query will include all machines that have 32-bit or 64-bit Java Installed select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_INSTALLED_SOFTWARE on SMS_G_System_INSTALLED_SOFTWARE.ResourceID = SMS_R_System.ResourceId where SMS_G_System_INSTALLED_SOFTWARE.ProductCode like "{26a24ae4-039d-4ca4-87b4-2f832170%" or SMS_G_System_INSTALLED_SOFTWARE.ProductCode like "{26A24AE4-039D-4CA4-87B4-2F864170%" We can then uninstall the products using a SCCM create a package to run this script: You may need to add more products depending on other versions that you have installed for Java for me we only had java 7  update 3 , 4 7, 9 ,10 strComputer = "...