Monitoring servers in DMZ using SCOM

I know there is a lot of information on this subject out there, and I spended a lot of time reading blogs and KBs, but still I was left with unanswered questions.
So – taking some bits here and there, putting them together, done some trying, and trying - this is the steps I will have to take next time I have a server in DMZ, that should be monitored by SCOM.

---

At my company, we have a lot of servers in DMZ, we wanted to monitor in our SCOM (still on SCOM 2007 R2, cu5).

We have a functioning CA-server and I have a SCOM Gateway server.

---

First – we need a Trusted Root Certificate.

This certificate has to be imported on all involved servers (RMS, GTW, DMZ servers).

• Browse to http://CA/certsrv
• Download a CA certificate, certificate chain, or CRL
• Download CA certificate chain
• Save certnew.p7b in a folder for your certs (ie. c:\certs)

This certificate needs to be copied to the servers, and imported.

• Open MMC with Certificates (Local Computer) snap-in
• Import the certificate under “Trusted Root Certification Authorities”

---

Second – we need a certificate for every server.

• Browse to http://CA/certsrv
• Request a certificate
• “Or, submit an advanced certificate request”
• Create and submit a request to this CA
• Name: FQDN of server
• Type of Certificate Needed: Other…
• OID: 1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2
• Create new key set
• CSP: Microsoft Enhanced Cryptographic Provider v1.0
• Select: “Mark keys as exportable”
• Store certificate in the local computers certificate store.
• Friendly Name: FQDN of server
• Submit

Now, the certificate request have to be issued.

• On CA server, open Certification Authority console
• In “Pending Requests”, right-click the certificate > All-Tasks > “Issue”

Save the certificate

• Browse to http://CA/certsrv
• View the status of a pending certificate request
• Select your sertificate
• Install this certificate
• Open MMC with Certificate (Local Computer) snap-in
• Personal > Certificates
• right-click your certificate > All Tasks > Export
• Yes, export the private key
• Personal Information Exchange > Enable strong protection
• Type a password (remember.. remember.. you will need it later)
• Save it in your cert-folder as FQDN.pfx

Do this for all servers, and copy the file to the servers.

---

On the server in DMZ

Hosts – file
Can your DMZ server resolve the Gateway or RMS ?
Else – put these into the hosts file (C:\Windows\System32\Drivers\etc)

Manually install scom agent
Copy the installation files to your server (also copy MOMCertImport.exe, we will need it) and launch MOMAgent.msi
You will need to supply the name of your Management Group and the FQDN of your GTW.

MOMCertImport
Ok, you copied MOMCertImport, and the certificate file is here too, then:
MOMCertImport <path>\<certificate file>
- and here you will need your password for the certificate.

Now you need to bounch the “System Center Management”-service
and go to Pending Management in your OpsMgr console and approve.

Install CU
Go back to your DMZ server and install current cu.

Manageable
Your agent is now manually installed, which means that it won’t get updated automatically.
Fortunately, using an query on your OpsMgrDB, you can alter a bit, and in this way make the agent manageable.

Run as different user

"Run as different user" option is different than "Run as administrator", because you don’t have to elevate. You can run as an admin user, but be running as that user with non-elevated credentials. Also, it supports net only credentials, which Run as Administrator doesn’t.


The Run as different user context menu option in Windows 7 is implemented as an extended menu, which is only displayed if you press and hold the SHIFT key when right-clicking on an executable file or its shortcut.

Installing Remote Administration Tools for Windows 7

Remote Administration Tools are installed as a Windows Update package.
You go to Microsoft an pick up the right version:

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=7d2f6ad7-656b-4313-a005-4e344e43997d

For a 64-bit Win7, you choose....... AMD64fre_GRMRSATX_MSU.msu (great naming..:!!)

When you have installed the package, you have to enable the tools, using Windows Features..
Go to Control Panel > Programs
In Program and Features select Turn Windows Features On or Off

In Windows Features, expand Remote Server Administration Tools and select the tools you want

Creating bootable Win7 and Win2008 ISO

When you have modified boot.wim or install.wim (ie. injected drivers or patches using DISM)
you may want to create new bootable iso files.

I will show you, how to use oscdimg from Windows Automated Installation Kit (WAIK).

Copy the DVD content and your modified files to a folder (here C:\DVD)

Start the "Deployment Tools Command Prompt", and navigate to c:\
The fire this command:
oscdimg -bDVD\boot\etfsboot.com -u2 -h -m -lDVD_LABEL C:\DVD filename.ISO

remark:
-lDVD_LABEL > this is a lowercase L (not 1) and the label you want to give the DVD

filename.ISO > filename is the name of the ISO file

DISM works - injecting drivers into wim files

I have a WDS server with some images.
And sometimes one have to update images with new drivers,
and here is how I do it, using DISM:

Wim info:

Dism /Get-WimInfo /WimFile:f:\remoteinstall\boot\x86\images\boot.wim

Dism /Get-WimInfo /WimFile:f:\remoteinstall\boot\x86\images\boot.wim /index:2

Mount Win:
Dism  /Mount-Wim /Wimfile:f:\remoteinstall\boot\x86\images\boot.wim /index:2 /MountDir:f:\mount

Add Drivers:
just one:
Dism /image:f:\mount /add-driver /driver:f:\ibm_drivers\mr
a whole library:
Dism /image:f:\mount /add-driver /driver:f:\ibm_drivers /recurse

Unmount wim and commit:

Dism /Unmount-Wim /MountDir:f:\mount /commit

Remote scripting on Windows Server 2008

If you leave the windows firewall turned on on your Windows Server 2008 boxes, you are not allowed to run script against a remote server.
The windows firewall will block these attemps.

Running in a domain, the fastest way to allow remote script execution, is to create a group policy...
Create a new GPO and drill to:
Computer Configuration -> Policies -> Administrative Templates -> Network -> Network Connections -> Windows Firewall -> Domain Profile
Set "Windows Firewall: Allow inbound remote administration exception" to "Enabled"
- and configure with a specific ip address (if only one machine is allowed for remote scripting)or a subnet (the subnet from where the remote script will be fired).

Upgrading Windows 2000 Active Directory to 2008 Directory Service

Sounds like a piece of cake...
* Extend the scheme
* Bring up 2 new windows 2008 servers
* Run DCPROMO
* Configure DNS
* Move FSMO roles to new 2008 DCs
* Move DHCP
* Demote the old windows 2000 servers (then disjoin from the domain)
* Clean up in AD Sites and Services (the old servers don't remove themselves)

Well....
From the 2008 media Run adprep /forestprep
It seems to run smoothly.. almost to the end...
Then an error - a file did not exist. !!!
After a long time investigation, I turned of Antivirus... and now the scheme update ran to the end... succesfully.

Adprep /domainprep /gpprep
Adprep /rodcprep

The configuring DNS before moving the FSMO roles (using NTDSUTIL.... much easier than the GUI).

Actually - after the first hurdle, it all ran smoothly, following my steps described above...
well until I reached the DHCP..
Of course NETSH are very different from Windows 2000 to windows 2008.
So.. on the w2k box I did a NETSH DHCP Backup,
moved the file to the w2k8 box, did some editing (removed unwanted stuff, and the w2k dhcp server name)
then I ran NETSH DHCP Restore - and YES.... it worked...