The things that are better left unspoken : System Center

Active Directory Services and their System Center Management Packs

Sander Berkouwer — Mon, 13 May 2013 06:06:32 GMT

As you might be aware, every Microsoft technology has the requirement to be manageable through PowerShell and System Center. Manageability through System Center is done through Management Packs. (MPs).

While I discussed the PowerShell manageability stories for the five Active Directory services last Saturday, below is the overview of the availability and functionality of the Management Packs (MPs) for the five Active Directory services:

Active Directory Domain Services

For Windows Servers running the Active Directory Domain Services as Domain Controllers, a System Center Management Pack has been available for ages, even before the products responsible for management were labeled ‘System Center’ (System Center Operations Manager was called MOM Server and System Center Configuration Manager was called SMS Server).

The Active Directory Domain Services Management Pack for System Center provides both proactive and reactive monitoring of your Active Directory deployment. It monitors events that various Active Directory components and subsystems place in the Application, System, and Service event logs. It also monitors the overall health of the Active Directory system and provides alerts for critical performance issues.

When used with the Management Pack for the Windows Server Operating System, the DNS Server Role, File Services, Group Policy and DFS Replication, a complete management view starts to emerge, where you can monitor the health of your Domain Controllers.

The latest version (v6.0.8070.0) adds support for Windows Server 2012.

Download MP for AD Domain Services v6.0.8070.0

Also available is a System Center Integration Pack, that allows System Center 2012 - Orchestrator to connect to your Active Directory Server to automate Identity and Access management tasks.

Download System Center Integration Pack for Active Directory v7.0

Active Directory Lightweight Directory Services

The Active Directory Lightweight Directory Services (AD LDS) Management Pack provides both proactive and reactive monitoring of your AD LDS deployment running on Windows Server 2008 and Windows Server 2008 R2. It monitors events that are placed in the Application, System, and Service event logs by various Active Directory Lightweight Directory Services components and subsystems. It also monitors the overall health of the Active Directory Lightweight Directory Services system and alerts you to critical performance issues.

Download MP for AD Lightweight Directory Services v6.0.7220.0

Active Directory Certificate Services

The System Center Management Pack for Active Directory Certificate Services provides an early warning to administrators on issues that could affect services so they can investigate and take action, if necessary.

Two Management Packs for Active Directory Certificate Services are currently available. An ‘old’ Management Pack exists to manage Certification Authorities running on Windows Server 2008 and Windows Server 2008 R2. This Management Pack follows the 6.x version numbering. A completely new 7.x Management Pack is available alongside the 6.x version and enables management of Certification Authorities on Windows Server 2008, Windows Server 2008 R2 and Windows Server 2012.

Note:
The Management Packs for Active Directory Certificate Services monitors the core Certification Authority, but does not monitor Certificate Services role services (such as the Online (OCSP) responder, Network Device Enrollment Services (NDES), Certificate enrollment web services, NDES, or CA web enrollment).

Download MP for AD Certificate Services v6.0.7231.0
Download MP for Windows Server 2012 AD Certificate Services v7.0.8560.0

Active Directory Federation Services

The System Center Management Pack for Active Directory Federation Services 1.x has been available since September 2007 and for Active Directory Federation Services 2.x since June 2010.

The Management Pack for Active Directory Federation Services offers the ability to detect service outages, operational errors and operational warnings. It also alerts on configuration issues and background tasks failures. Auditing can also be monitored, as well as the communication between the federation server and the federation server proxy. With the Management Pack you can be notified of malformed access requests and the health of the Secure Sockets Layer (SSL) certificate of the federation passive website in Internet Information Services (IIS).

Depending on the version of Active Directory Federation Services, you can choose between the 6.x version and the 7.x version of the Management Pack, where version 6.x can be used to monitor Active Directory Federation Services 1.0 and version 7.x can be used to monitor Active Directory Federation Services 2.0 (available as a separate download for Windows Server 2008 R2) and 2.1 (bundled with Windows Server 2012).

Download MP for Windows Server 2003 R2 AD Federation Services v6.0.5000.0
Download MP for AD Federation Services 2.0 and 2.1 v7.0.8560.0

Active Directory Rights Management Services

The System Center Management Pack for Active Directory Rights Management Services (AD RMS) has been available since July 2011 and monitors the performance and availability of the Windows Server 2008 SP2 or Windows Server 2008 R2 versions of AD RMS. By detecting, alerting on, and automatically responding to critical events and performance indicators, this Management Pack helps indicate, correct, and prevent possible AD RMS related service outages. The System Center Monitoring Pack for Active Directory Rights Management Services for Windows Server 2008 SP2 or Windows Server 2008 R2 helps ensure that your AD RMS components are available and working correctly.

In September 2012, Microsoft released a version 7.x of the Management Pack for Active Directory Rights Management Services. This Management Pack can be used to manage Rights Management Services, running on Windows Server 2012. For Rights Management Services running on Windows Server 2008 and Windows Server 2008 R2, the 6.0.7xxx.x version of the Management Pack is the one to use. For sturdy Rights Management Servers on Windows Server 2003, the 6.0.5000.0 version of the Management Pack offers the desired monitoring capabilities.

Download MP for Windows Server 2003 Rights Management Services v6.0.5000.0
Download MP for AD Rights Management Services v6.0.7597.0
Download MP for Windows Server 2012 AD Rights Management Services v7.0.8560.0

Related blogposts

Active Directory Domain Services Management Pack for System Center updated last week
System Center Monitoring Pack for Active Directory was updated today

Related downloads

System Center Management Pack for Windows Server Operating System
System Center Management Pack for Windows 8 Client Operating System

Active Directory Domain Services Management Pack for System Center updated last week

Sander Berkouwer — Sun, 20 Jan 2013 09:40:41 GMT

On October 6, 2011 I wrote about the updated Active Directory Domain Services Management Pack for System Center. Then, it was updated to version 6.0.7670.0. Today, I want to point you to another big update for the Active Directory Domain Services Management Pack for System Center: the 6.0.8070.0 update

About System Center Operations Manager

With Microsoft System Center Operations Manager (SCOM) you can leave the monitoring and alerting to software in a confident, fast and robust way. Now you can simply create an availability or replication bandwidth report by pressing a single button. No longer do you have to follow tedious routines to check up on your servers: The products in the System Center were created to do those things for you. Before Operations Manager became a part of the System Center family, it was known as Microsoft Operations Manager (MOM).

System Center Operations Manager (SCOM) comes with the basic set of monitoring tools to monitor Windows Servers. These basic monitoring capabilities can be extended using Monitoring Packs for specific Server Roles and Server Products. Even more, Operations Manager features an extensibility framework to allow any 3rd party developer to write Monitoring Packs. Packs have been written to manage UPS’s and even Linux hosts. Of course, monitoring is of little use in big environments with repeating errors, so System Center Operations Manager is designed to work together with the other members of the System Center family of products, like System Center Configuration Manager (formerly known as SMS Server) and System Center Orchestrator (formerly known as Opalis).

About the Active Directory Monitoring Pack

Update

The version of the Active Directory Monitoring Pack, released on January 17th, 2013, is 6.0.8070.0 and is the seventh version of the Monitoring Pack since it’s original version (6.0.5000.0).

This update is conveniently referred to as the December 2012 revision.

What’s new in this release?

This release focuses fixing problems reported by customers. The accompanying guide mentions:

Added Windows Server 2012 Support
Product Knowledge improvements

Client Monitoring alerts identify problematic Domain Controllers in the description.
Inter-domain trust alert identifies which trust is broken in the alert description.
More specific action recommendations added to alert for “Could not determine FSMO role holder” and alert for “Domain Controller’s Ops Master is inconsistent.”
KnowledgeBase article information added to alert for “The Active Directory database is corrupt.”
KnowledgeBase article information added to alert for “Two replication partners have an inconsistent view of the FSMO role holders.”
Some rules with names that begin “Client Side script…“ but were not actually executed by client-side monitors were renamed.
More specific action recommendation added to description for Event ID 1000.

Excessive alert fixes

A duplicate alert that appears when a computer authentication fails was removed.
Repetitive alerts for UserEnv and Netlogon were replaced with a single alert that includes a count of the number of occurrences.
The alert for the number of allowable replication partners was increased from 100 to the maximum number of replication connections.
The alert of FSMO role holder availability was refined so that it is issued less frequently in cases where operations master role holder is temporarily unavailable.
Active Directory processor overload monitor was removed because it duplicates an existing monitor in the operating system management pack.
Duplicate alerts for KDC errors and trust verification failures were removed.
Informational alert was disabled for rule “The default security settings for the NTFS file systems have not been applied to Active Directory directory folders.”

Script error fixes

Multiple script errors were fixed to improve Active Directory site topology discovery, DNS verification, operation master role discovery, and other improvements.

Rule error fixes

Multiple rule errors were fixed to improve error handling, event logging, and server state reporting.

Download

You can download the update here.

System Center 2012 ServicePack 1 has arrived for TechNet and MSDN subscribers

Sander Berkouwer — Mon, 24 Dec 2012 11:58:40 GMT

System Center 2012 was released in April 2012, well before Windows 8 and Windows Server 2012 were released. As a consequence, these Operating Systems weren't supported. This functionality was slated for System Center 2012 with ServicePack 1, among other new exciting new functionality. This makes ServicePack 1 for System Center 2012 not just an ordinary ServicePack.

Per December 20, 2012, TechNet and MSDN subscribers can download System Center 2012 with ServicePack 1 in the following packages:

System Center 2012 – Virtual Machine Manager with SP1
(x64, ISO file, 1320 MB)
System Center 2012 – Data Protection Manager with SP1
(x64, ISO file, 4721 MB)
System Center 2012 – Configuration Manager and Endpoint Protection with SP1
(x86 and x64, ISO file, 904 MB)
System Center 2012 – Service Manager with SP1
(x64, ISO file, 404 MB)
System Center 2012 – Operations Manager with SP1
(x86 and x64, ISO file, 1059 MB)
System Center 2012 – Orchestrator with SP1
(x86, ISO file, 157 MB)
System Center 2012 – App Controller with SP1
(x64, ISO file, 77 MB)

All these downloads include the Chinese-Simplified, English, French, German, Italian, Japanese, Portuguese-Brazil, Russian, and Spanish languages, except for Configuration Manager and Endpoint Protection (this download doesn’t include the Italian, Portuguese-Brazil and Spanish language) and both Operations Manager and Orchestrator (English only).

What’s New

Service Pack 1 for System Center 2012 is not just a maintenance release, it also includes a lot of new features:

Integrating Active Directory with System Center Orchestrator

Sander Berkouwer — Wed, 04 Apr 2012 06:49:52 GMT

With the release of System Center 2012, admins at large organization can now take advantage of the many monitoring, alerting, backup, restore, automation and remediation capabilities of this new suite. The advanced automation capabilities in System Center are delivered through System Center Orchestrator. You might know this product as Opalis, the company originally responsible for the product, that Microsoft acquired in December 2009.

The strength and possibilities, from an Active Directory point of view, of System Center Orchestrator is the capability to automate provisioning and deprovisioning through advanced run book procedures. Business people will call these ‘workflows’.

An example…

A typical example could be to automatically deprovision a user when he/she leaves the company. Within a run book you can remove an account from Active Directory, remove the entity from the SQL Server HRM database, unauthorize his/her computer from the DirectAccess group, deliver e-mails to a (former) manager after his/her consent, etc. All the stuff you could also use Z-term for, but then with advanced workflowing and on the spot delegated decision making through e-mail/SharePoint and with robust reporting. (at a significant cost)

When designing run book procedures in System Center Orchestrator, pre-defined actions are available through the picker in the Orchestrator Client. Also, commands are available. To deprovision the account in the example you would issue a couple of PowerShell, dsmod.exe or admod.exe commands. The downside of this approach is that when your command errors out (for instance: the useraccount was protected against accidental deletion) you would be searching high and low for the reason.

Introducing the new Integration Pack for Active Directory

The preferred approach is to use the new Integration Pack for Active Directory. This is an add-on for System Center 2012 Orchestrator that enables you to connect Orchestrator to your Active Directory Domain Controllers running Windows Server 2008 R2 to automate its management. This Integration Pack was first introduced on April 2, 2012 with version 7.0.

Using the picker you can now create run book steps to create and delete user and computer objects, find and update user and computer object attributes, create, delete and update groups, reset a users password, unlock a user account, disable and enable user accounts, Move user accounts, computer accounts and groups to a different OU, add or remove user accounts and computer accounts to/from groups and nest and unnest groups.

Download the Integration Pack for Active Directory

Alternatively, if you’re not running Windows Server 2008 R2 or the most recent version of System Center Orchestrator / Opalis, you can use the open source Opalis Active Directory Extension from CodePlex.

An updated Active Directory Monitoring Pack is available

Sander Berkouwer — Tue, 03 Apr 2012 17:50:51 GMT

Five months ago, I wrote a blogpost on the latest update on the System Center Active Directory Monitoring Pack (version 6.0.7670.0).

Today, hot on the heels of the System Center 2012 release, I’m going to tell you about an update on that release. (version 6.0.7822.0)

About System Center Operations Manager

With Microsoft System Center Operations Manager (SCOM) you can leave the monitoring and alerting to software in a confident, fast and robust way. Before Operations Manager became a part of the System Center family, it was known as Microsoft Operations Manager (MOM).

System Center Operations Manager (SCOM) comes with the basic set of monitoring tools to monitor Windows Servers. These basic monitoring capabilities can be extended using Monitoring Packs for specific Server Roles and Server Products. Of course, monitoring is of little use in big environments with repeating errors, so System Center Operations Manager is designed to work together with the other members of the System Center family of products, like System Center Configuration Manager (formerly known as SMS Server) and System Center Orchestrator (formerly known as Opalis).

About the Active Directory Monitoring Pack

What’s new in this release?

The accompanying guide (OM2007_NP_AD2008.doc) lists the following changes for version 6.0.7822.0:

Corrected some Publisher names (for example, changed from PublisherName=KDC to PublisherName=Microsoft-Windows-Kerberos-Key-Distribution-Center).
Updated rules to generate Alerts and not only go to the Event Viewer.
Removed unnecessary check for Event Source Name for all NTDS rules (for example, removed EventSourceName=”NTDS General”).
Corrected event parameter validation.
Updated queries to search for correct event IDs.
Fixed spelling errors.
Added missing descriptions to rules.
Fixed problems with Health Monitoring scripts.
Removed user name checks from Userenv rules.

System Center 2012

Since Management Packs and Monitoring Packs (both referred to as MPs) are compatible between System Center Operations Manager 2007 and System Center 2012, you’re good to go at that front, too.

Call to action

The previous update to the Active Directory Monitoring Pack was a significant update that addressed a lot of issues. In this version Microsoft dots the i's and crosses the t's, removing any annoying problems you might have with version 6.0.7670.0, dated September 2011 and any workarounds in place.

Download the System Center Monitoring Pack for Active Directory (AD)

Marnix Wolf, a fellow Dutch MVP gives the advice not to import the functionality of the Microsoft.Windows.Server.AD.ClientMonitoring MP since it adds a lot of complexity. Many times, the AD MP without monitoring from the client perspective already adds enough insight about the health state of an Active Directory environment.

System Center Monitoring Pack for Active Directory was updated today

Sander Berkouwer — Thu, 06 Oct 2011 21:18:00 GMT

While, as an Active Directory admin, you could monitor your Active Directory Domain Controllers by hand on a weekly basis and iron out the kinks and hope your colleagues or customers don’t get affected by problems that plague the servers running these critical networking services, you could also just use System Center Operations Manager.

About System Center Operations Manager

About the Active Directory Monitoring Pack

Active Directory Domain Services is a Server Role in Windows Server and Microsoft has deemed it fit to have its own Monitoring Pack. Even more, Microsoft has dedicated valuable time to actively maintain the Monitoring Pack for Active Directory. The version of the Active Directory Monitoring Pack, released today, is 6.0.7670.0 and is the fifth version of the Monitoring Pack since it’s original version (6.0.5000.0).

What’s new in this release?

This release focuses fixing problems reported by customers. The accompanying guide mentions:

Event-ID 333 is logged incorrectly on systems with Active Directory databases larger than 4GB.
20% of the alerts are not triggered on Windows Server 2008 and Windows Server 2008 R2 Domain Controllers due to wrong event ID mapping, due to changes in the event sources for several events.
Performance data is not collected due to wrong event ID mapping on Windows Server 2008 Domain Controllers.
Performance counter selected by default is wrong, preventing Replication Latency Performance data from appearing.
Time skew alert is not triggered due to script defect.
Operation master monitor is broken due to script defect.
Frequent operation master alert description misspelled.

This release also includes fixes to architectural issues to facilitate future System Center Operations Manager releases.

Call to Action

Unless you’re monitoring Windows 2000 Server-based Domain Controllers, you should update the Active Directory Monitoring Pack to version 6.0.7670.0 in your System Center Operations Manager environment. If you haven’t done so recently first update the Windows Server Operating System Management Pack. You should at least run version 6.0.6667.0 of this Monitoring Pack. (the hyperlink above links to version 6.0.6957.0)

Although no further management packs are required for the Active Directory Management Pack to perform, the following management packs might be of interest because they complement the Active Directory monitoring services:

Al these Management Packs are provided free of charge.

The things that are better left unspoken : System Center

Active Directory Services and their System Center Management Packs

Active Directory Domain Services

Active Directory Lightweight Directory Services

Active Directory Certificate Services

Active Directory Federation Services

Active Directory Rights Management Services

Related blogposts

Further reading

Related downloads

Active Directory Domain Services Management Pack for System Center updated last week

About System Center Operations Manager

About the Active Directory Monitoring Pack

Update

What’s new in this release?

Download

Further reading

System Center 2012 ServicePack 1 has arrived for TechNet and MSDN subscribers

What’s New

Further reading

Integrating Active Directory with System Center Orchestrator

An example…

Introducing the new Integration Pack for Active Directory

Further reading

An updated Active Directory Monitoring Pack is available

About System Center Operations Manager

About the Active Directory Monitoring Pack

What’s new in this release?

System Center 2012

Call to action

Related stories

Further reading

System Center Monitoring Pack for Active Directory was updated today

About System Center Operations Manager

About the Active Directory Monitoring Pack

What’s new in this release?

Call to Action

Further reading