The things that are better left unspoken : System Administration, System Center, Active Directory

Active Directory Domain Services Management Pack for System Center updated last week

Sander Berkouwer — Sun, 20 Jan 2013 09:40:41 GMT

On October 6, 2011 I wrote about the updated Active Directory Domain Services Management Pack for System Center. Then, it was updated to version 6.0.7670.0. Today, I want to point you to another big update for the Active Directory Domain Services Management Pack for System Center: the 6.0.8070.0 update

About System Center Operations Manager

With Microsoft System Center Operations Manager (SCOM) you can leave the monitoring and alerting to software in a confident, fast and robust way. Now you can simply create an availability or replication bandwidth report by pressing a single button. No longer do you have to follow tedious routines to check up on your servers: The products in the System Center were created to do those things for you. Before Operations Manager became a part of the System Center family, it was known as Microsoft Operations Manager (MOM).

System Center Operations Manager (SCOM) comes with the basic set of monitoring tools to monitor Windows Servers. These basic monitoring capabilities can be extended using Monitoring Packs for specific Server Roles and Server Products. Even more, Operations Manager features an extensibility framework to allow any 3rd party developer to write Monitoring Packs. Packs have been written to manage UPS’s and even Linux hosts. Of course, monitoring is of little use in big environments with repeating errors, so System Center Operations Manager is designed to work together with the other members of the System Center family of products, like System Center Configuration Manager (formerly known as SMS Server) and System Center Orchestrator (formerly known as Opalis).

About the Active Directory Monitoring Pack

Update

The version of the Active Directory Monitoring Pack, released on January 17th, 2013, is 6.0.8070.0 and is the seventh version of the Monitoring Pack since it’s original version (6.0.5000.0).

This update is conveniently referred to as the December 2012 revision.

What’s new in this release?

This release focuses fixing problems reported by customers. The accompanying guide mentions:

Added Windows Server 2012 Support
Product Knowledge improvements

Client Monitoring alerts identify problematic Domain Controllers in the description.
Inter-domain trust alert identifies which trust is broken in the alert description.
More specific action recommendations added to alert for “Could not determine FSMO role holder” and alert for “Domain Controller’s Ops Master is inconsistent.”
KnowledgeBase article information added to alert for “The Active Directory database is corrupt.”
KnowledgeBase article information added to alert for “Two replication partners have an inconsistent view of the FSMO role holders.”
Some rules with names that begin “Client Side script…“ but were not actually executed by client-side monitors were renamed.
More specific action recommendation added to description for Event ID 1000.

Excessive alert fixes

A duplicate alert that appears when a computer authentication fails was removed.
Repetitive alerts for UserEnv and Netlogon were replaced with a single alert that includes a count of the number of occurrences.
The alert for the number of allowable replication partners was increased from 100 to the maximum number of replication connections.
The alert of FSMO role holder availability was refined so that it is issued less frequently in cases where operations master role holder is temporarily unavailable.
Active Directory processor overload monitor was removed because it duplicates an existing monitor in the operating system management pack.
Duplicate alerts for KDC errors and trust verification failures were removed.
Informational alert was disabled for rule “The default security settings for the NTFS file systems have not been applied to Active Directory directory folders.”

Script error fixes

Multiple script errors were fixed to improve Active Directory site topology discovery, DNS verification, operation master role discovery, and other improvements.

Rule error fixes

Multiple rule errors were fixed to improve error handling, event logging, and server state reporting.

Download

You can download the update here.

Integrating Active Directory with System Center Orchestrator

Sander Berkouwer — Wed, 04 Apr 2012 06:49:52 GMT

With the release of System Center 2012, admins at large organization can now take advantage of the many monitoring, alerting, backup, restore, automation and remediation capabilities of this new suite. The advanced automation capabilities in System Center are delivered through System Center Orchestrator. You might know this product as Opalis, the company originally responsible for the product, that Microsoft acquired in December 2009.

The strength and possibilities, from an Active Directory point of view, of System Center Orchestrator is the capability to automate provisioning and deprovisioning through advanced run book procedures. Business people will call these ‘workflows’.

An example…

A typical example could be to automatically deprovision a user when he/she leaves the company. Within a run book you can remove an account from Active Directory, remove the entity from the SQL Server HRM database, unauthorize his/her computer from the DirectAccess group, deliver e-mails to a (former) manager after his/her consent, etc. All the stuff you could also use Z-term for, but then with advanced workflowing and on the spot delegated decision making through e-mail/SharePoint and with robust reporting. (at a significant cost)

When designing run book procedures in System Center Orchestrator, pre-defined actions are available through the picker in the Orchestrator Client. Also, commands are available. To deprovision the account in the example you would issue a couple of PowerShell, dsmod.exe or admod.exe commands. The downside of this approach is that when your command errors out (for instance: the useraccount was protected against accidental deletion) you would be searching high and low for the reason.

Introducing the new Integration Pack for Active Directory

The preferred approach is to use the new Integration Pack for Active Directory. This is an add-on for System Center 2012 Orchestrator that enables you to connect Orchestrator to your Active Directory Domain Controllers running Windows Server 2008 R2 to automate its management. This Integration Pack was first introduced on April 2, 2012 with version 7.0.

Using the picker you can now create run book steps to create and delete user and computer objects, find and update user and computer object attributes, create, delete and update groups, reset a users password, unlock a user account, disable and enable user accounts, Move user accounts, computer accounts and groups to a different OU, add or remove user accounts and computer accounts to/from groups and nest and unnest groups.

Download the Integration Pack for Active Directory

Alternatively, if you’re not running Windows Server 2008 R2 or the most recent version of System Center Orchestrator / Opalis, you can use the open source Opalis Active Directory Extension from CodePlex.

An updated Active Directory Monitoring Pack is available

Sander Berkouwer — Tue, 03 Apr 2012 17:50:51 GMT

Five months ago, I wrote a blogpost on the latest update on the System Center Active Directory Monitoring Pack (version 6.0.7670.0).

Today, hot on the heels of the System Center 2012 release, I’m going to tell you about an update on that release. (version 6.0.7822.0)

About System Center Operations Manager

With Microsoft System Center Operations Manager (SCOM) you can leave the monitoring and alerting to software in a confident, fast and robust way. Before Operations Manager became a part of the System Center family, it was known as Microsoft Operations Manager (MOM).

System Center Operations Manager (SCOM) comes with the basic set of monitoring tools to monitor Windows Servers. These basic monitoring capabilities can be extended using Monitoring Packs for specific Server Roles and Server Products. Of course, monitoring is of little use in big environments with repeating errors, so System Center Operations Manager is designed to work together with the other members of the System Center family of products, like System Center Configuration Manager (formerly known as SMS Server) and System Center Orchestrator (formerly known as Opalis).

About the Active Directory Monitoring Pack

What’s new in this release?

The accompanying guide (OM2007_NP_AD2008.doc) lists the following changes for version 6.0.7822.0:

Corrected some Publisher names (for example, changed from PublisherName=KDC to PublisherName=Microsoft-Windows-Kerberos-Key-Distribution-Center).
Updated rules to generate Alerts and not only go to the Event Viewer.
Removed unnecessary check for Event Source Name for all NTDS rules (for example, removed EventSourceName=”NTDS General”).
Corrected event parameter validation.
Updated queries to search for correct event IDs.
Fixed spelling errors.
Added missing descriptions to rules.
Fixed problems with Health Monitoring scripts.
Removed user name checks from Userenv rules.

System Center 2012

Since Management Packs and Monitoring Packs (both referred to as MPs) are compatible between System Center Operations Manager 2007 and System Center 2012, you’re good to go at that front, too.

Call to action

The previous update to the Active Directory Monitoring Pack was a significant update that addressed a lot of issues. In this version Microsoft dots the i's and crosses the t's, removing any annoying problems you might have with version 6.0.7670.0, dated September 2011 and any workarounds in place.

Download the System Center Monitoring Pack for Active Directory (AD)

Marnix Wolf, a fellow Dutch MVP gives the advice not to import the functionality of the Microsoft.Windows.Server.AD.ClientMonitoring MP since it adds a lot of complexity. Many times, the AD MP without monitoring from the client perspective already adds enough insight about the health state of an Active Directory environment.

System Center Monitoring Pack for Active Directory was updated today

Sander Berkouwer — Thu, 06 Oct 2011 21:18:00 GMT

While, as an Active Directory admin, you could monitor your Active Directory Domain Controllers by hand on a weekly basis and iron out the kinks and hope your colleagues or customers don’t get affected by problems that plague the servers running these critical networking services, you could also just use System Center Operations Manager.

About System Center Operations Manager

About the Active Directory Monitoring Pack

Active Directory Domain Services is a Server Role in Windows Server and Microsoft has deemed it fit to have its own Monitoring Pack. Even more, Microsoft has dedicated valuable time to actively maintain the Monitoring Pack for Active Directory. The version of the Active Directory Monitoring Pack, released today, is 6.0.7670.0 and is the fifth version of the Monitoring Pack since it’s original version (6.0.5000.0).

What’s new in this release?

This release focuses fixing problems reported by customers. The accompanying guide mentions:

Event-ID 333 is logged incorrectly on systems with Active Directory databases larger than 4GB.
20% of the alerts are not triggered on Windows Server 2008 and Windows Server 2008 R2 Domain Controllers due to wrong event ID mapping, due to changes in the event sources for several events.
Performance data is not collected due to wrong event ID mapping on Windows Server 2008 Domain Controllers.
Performance counter selected by default is wrong, preventing Replication Latency Performance data from appearing.
Time skew alert is not triggered due to script defect.
Operation master monitor is broken due to script defect.
Frequent operation master alert description misspelled.

This release also includes fixes to architectural issues to facilitate future System Center Operations Manager releases.

Call to Action

Unless you’re monitoring Windows 2000 Server-based Domain Controllers, you should update the Active Directory Monitoring Pack to version 6.0.7670.0 in your System Center Operations Manager environment. If you haven’t done so recently first update the Windows Server Operating System Management Pack. You should at least run version 6.0.6667.0 of this Monitoring Pack. (the hyperlink above links to version 6.0.6957.0)

Although no further management packs are required for the Active Directory Management Pack to perform, the following management packs might be of interest because they complement the Active Directory monitoring services:

Al these Management Packs are provided free of charge.

The things that are better left unspoken : System Administration, System Center, Active Directory

Active Directory Domain Services Management Pack for System Center updated last week

About System Center Operations Manager

About the Active Directory Monitoring Pack

Update

What’s new in this release?

Download

Further reading

Integrating Active Directory with System Center Orchestrator

An example…

Introducing the new Integration Pack for Active Directory

Further reading

An updated Active Directory Monitoring Pack is available

About System Center Operations Manager

About the Active Directory Monitoring Pack

What’s new in this release?

System Center 2012

Call to action

Related stories

Further reading

System Center Monitoring Pack for Active Directory was updated today

About System Center Operations Manager

About the Active Directory Monitoring Pack

What’s new in this release?

Call to Action

Further reading