Adding a SCOM Agent Task to Update the Management Group

Scenario

In a migration from SCOM 2007 R2 to SCOM 2012, I came into to the situation of needing to update the management groups to which the agents report to. I didn’t want to manually type the info more than 50 times for this customer, so, I spent some time digging and found all the pieces I needed to add the management groups from the Console, using an agent task.
The only challenge was that you can't use VBS itself to stop and start the services. Since the script runs in the context of the Health Agent, which is killed along with the services, it would stop, but would never come back. That's why the script has to create a local batch (which should be removed, I know...), and then starts it.

Solution

In the SCOM Console, go to the Authoring section, expand Management Pack Objects, right-click on Tasks and select Create a New Task:

In the next dialog, select run a Script and select or create a management pack to store the Task. If you’re using SCOM 2007, make sure you don’t select the Default Management Pack:

Name the task, fill in a good description and pick Health Service as target for the Task:

Click next and fill the information below as follows:

See the script below.
Click Finish.

Now you should see the Task available in the Tasks pane whenever you’re in the context of a Health Agent, as in the example below:

The script can be improved, to add some more error handling, for example, to give more feedback. I'll try to do that and update it here.

So, here goes the script:

On error resume next
Dim objMSConfig
Set objMSConfig = CreateObject("AgentConfigManager.MgmtSvcCfg")
wscript.echo "Adding NEWMG MG to the agent. Reporting to myserver.mydomain.local on port 5723"
Call objMSConfig.AddManagementGroup ("NEWMG", "myserver.mydomain.local",5723)
if err.number = 0 then
                dim strServiceName, objWMIService, colListofServices, objService
                strServiceName = "HealthService"
                wscript.echo "Successfully added Management Group."
                dim sFilePath
                Dim objFSO 'As FileSystemObject
                Dim objTextFile 'As Object
                Dim oShell
                Set oShell = CreateObject( "WScript.Shell" )
                temppath=oShell.ExpandEnvironmentStrings("%TMP%")
                'wscript.echo "Temp Path" & temppath
                wscript.echo "Restarting Agent."
                sText="net stop """ & strServiceName & """" & vbcrlf &  "net start """ & strServiceName & """"
                sFilePath=temppath & "\sshs.bat"
                'wscript.echo "Writing to " & sFilePath
                Set objFSO = CreateObject("Scripting.FileSystemObject")
                Set objTextFile = objFSO.CreateTextFile(sFilePath, True)
                ' Write a line.
                objTextFile.Write (sText)
                objTextFile.Close
                oShell.run sFilePath
else
                wscript.echo "Error adding Management group - " & err.Description
end if

Changing the script to remove the MG:

Call objMSConfig.RemoveManagementGroup ("MyManagementGroupToRemove”)

Please refer to this link for a complete documentation:
http://msdn.microsoft.com/en-us/library/hh328987

Hope it helps and happy SCOMming!

SCOM Agents using certificates

Many times you'll need SCOM agents to communicate to the RMS using certificates. This process, although considerably simple after doing it a few times, is very frequently not well documented. When I needed to do it, I had to check on a lot of different sources and bits and pieces. My intention here is to document the whole process.

A few assumptions: you have a functional SCOM server, a certificate authority on the same domain (in this example, an enterprise one) and a server on a another domain or workgroup.

Step-by-step, oh baby!
So, here it goes and don't be scared. After you repeat the steps a few times, you'll be very comfortable with it.

1.       Creating SCOM certificate templates

a.       Go to the certificate authority machine and run mmc.exe

b.      Click on the Add/Remove Snap-in option

c.       Add the certificate temples Snap-in

d.      Right Click on the IPSec (Offiline Request) certificate and click Duplicate Template:

 

e.       Select the appropriate version of Windows Server (pick 2003 if you still have any 2003 on your network)

f.         Name the Certificate SCOM Template (or anything you want) and configure as follows:

Click CSPs…

Click on Application Policies and configure as below:

g.        Open the Certification Authority Configuration, right click on Certificate Templates and select new->Certificate Template to issue:

h.       Select the SCOM Template you’ve just created and click OK

i.          Close the Certification Authority Console

2.        Creating the certificates
For this part of the configuration, we’ll need to export the certificate for the Root CA itself, generate a certificate for the SCOM RMS and generate certificates for each server that will communicate with the RMS.

a.       Open the URL for you ceritification authority server. In my case, http://dc1/certsrv .

 

b.      Click on Download a CA certificate, certificate chain, or CRL and Click on Download CA certificate Chain and save the file to a folder. The file will be called certnew.p7b by default. You can rename it. I’m using rootca.p7b.

c.        Go back to the home page (http://dc1/certsrv) and Click on Request a certificate->advanced certificate request->Creante and submit a request to this CA

If you have issues opening this website (complains about the ActiveX not being loaded or HTTPS needs to be enabled), add the website to the trusted websites and configure the security level as custom for the trusted sites with the option below:

d.       Select yes to the next prompt:

e.       Select the SCOM Template you created on step 1 from the Dropdown list:

f.         Set the name of the server:

g.        And set the friendly name:

h.       Make sure the Mark keys as exportable is selected:

i.         Click yes on the next prompt:

j.        Click on Install certificate
Don’t worry about where to install the certificate yet. It will be installed on you user account and under the personal folder. We’ll later export the certificate to be usable by the computer

k.       Repeat steps c through j of the certificate generation process for the agent, in my case, dmz1 is the name of the server

l.          After you generated all necessary certificates, let’s export them from your local store:

m.     Open a mmc.exe and add the certificates snap-in for “My user account” and click Ok.

n.       Expand the Certificates tree till you see the contents of the personal certificates:

You should see the certificates you’ve just created there.

o.      Right click the scom server certificate and select the Export option:

p.      Click Next

q.      Click on Yes to export the private key

r.        Click Next

s.       Type a password for the import process

t.        Select the filename for the file and click Next, then Finish.

u.      Repeat steps o to t for each servers.

3.       Installing certificates on the computers

a.       Go to the scom RMS and open a MMC.exe application

b.      Add the Certificates Snap-in for the Computer account

c.       Click Next and Select Local Computer and Click Finish

d.      Click Ok

e.      Expand the left tree and click on the option below:

f.        Click Next

g.       Browse to the location of the scom certificate generated and exported before:

h.      Click Next and provide the password  you previously set.

i.         Make sure the certificate will be saved in the Personal store

j.        Click Next and finish

k.       Right Click the Trusted Root Certificates as below and select import:

l.         Click next and browse to the Root CA certificate file generated in the first part of the tutorial:

m.    Click Next

n.      Make sure the certificate is saved in the Trusted Root Certification Authorities store:

o.      Click Finish

p.      Repeat steps above on the agents computers

4.       Installing the agents

a.       Before you start installing the agent, check connectivity to the server. If you DNS cant’ resolve the name of the scom server, create an entry in the hosts file on the server to be manager.

b.      Make sure port tcp/5723 is open between the server and the SCOM server.

c.       Check connectivity by using “telnet <scomServerNameInTheCertificate> 5723”
In my case: “telnet scom.fehse.local 5723”. If you can get a connection (black screen with blinking cursor, you’re good.

d.      On the server to be managed, access the scom installation files. If you can logon remotely to your server, they will be on:

\\<ScomServer>\c$\ Program Files\System Center Operations Manager 2007\AgentManagement

If you can’t access it remotely, copy the files to a location accessible from the server to be managed.

e.      Start scom installation by running the MSXML6.msi, OomADs (if the server is a DC) and then MomAgent.msi

f.        Click Next

g.       Select 

h.      Click Next and then Install

i.         Click Finish when installation is finished

5.       Importing certificates with momcertimport.exe

In this step, you’ll need a tool called momcertimport.exe. It can be found on SCOM installation DVD or image, under the SupportTools folder. There’s a 32 and a 64 bit version.

a.       On the Scom server, run the momcerimpot.exe tool:

b.      Select the appropriate certificate from the store and click OK

c.       Restart the “System Center Management” service.

d.      Repeat the steps on all servers to be managed.

6.       Approving and checking agent status

a.       On the SCOM console, under administration, check the Pending Agents:

b.      Approve the agent

c.       

A few points:

The steps performed on the RMS itself don’t need to be repeated for each agent. They will be done once only.

Eventually, the certificates will expire and the process will need to be repeated, so I advise you to change the duration of the certificates by following the instructions on this URL: http://support.microsoft.com/kb/254632

The process for a Standalone Root CA is basically the same. The difference is that you won’t use Certificate templates. The (complicated version) of the process is documented here: http://technet.microsoft.com/en-us/library/dd362655.aspx and a simpler version here: http://blogs.technet.com/b/operationsmgr/archive/2009/09/10/step-by-step-for-using-certificates-to-communicate-between-agents-and-the-opsmgr-2007-server.aspx

Hope you enjoy it!