Part III: Installing the Site Database

We have decided to install the Site Database on the Site Server.
This will reduce the number of devices that can be managed by the system, but in my estimate, this should be sufficient.

The installation of the SQL server is fairly simpel.
I install the program to c:\program files and changes the database files and log files to dedicated drives.
For SCCM it is only needed to install:
- Database Engine Service
- SQL Server Reporting Services
- Management Tools
A very important thing to remember: Install with the correct collation -  SQL_Latin1_General_CP1_CI_AS

I will use a domain account to run the services..
- then we shall remember SetSPN
- - setspn –A MSSQLSvc/SQL Sever netBIOS name:1433 domain\account
- - setspn -A MSSQLSvc/SQL Sever FQDN:1433 domain\account
-- you can verify by: setspn -L domain\account

SQL Server memory will have to be configured.
-- min 8GB for the SQL server
-- max (leave at least 4 GB for OS and applications)

Remember to configure the Firewall to allow traffic on TCP 1433 and TCP 4022 (this is for SQL replication)

Additional task:
Since the box has 16 cores, after installation of SCCM I will configure 16 database files for th CM database.

But now I will be ready to install WSUS.

Part II: Preparing the OS on the Stand-alone Primary Site Server

Well... this Server 2012... wonder if I'll ever get used to it !?

First, the usually server installation and configuration (IP, Timezone, locales, domain ao).
We use a proxy (I'll bet this will bring a lot of joy....) so I have to configure this as well.
As we don't have Proxycfg anymore, we will have to use NetSH
(Netsh -u proxy-server:port)

To add the required roles and features, I uses PowerShell.
Open a PowerShell prompt (as Administrator) and type:
Add-WindowsFeature Web-Windows-Auth,Web-ISAPI-Ext,Web-Metabase,Web-WMI,BITS,RDC,NET-Framework-Features,Web-Asp-Net,Web-Asp-Net45,NET-HTTP-Activation,NET-Non-HTTP-Activ,Web-Static-Content,Web-Default-Doc,Web-Dir-Browsing,Web-Http-Errors,Web-Http-Redirect,Web-App-Dev,Web-Net-Ext,Web-Net-Ext45,Web-ISAPI-Filter,Web-Health,Web-Http-Logging,Web-Log-Libraries,Web-Request-Monitor,Web-HTTP-Tracing,Web-Security,Web-Filtering,Web-Performance,Web-Stat-Compression,Web-Mgmt-Console,Web-Scripting-Tools,Web-Mgmt-Compat -Restart

(if you get amn error, this could be because there are no internet connection when installing .NET3.5.
Then install .NET3.5 through the Server Manager, but point to your installation media)

After installing these roles/features, you must register ASP.NET with IIS.  The simplest way is to open an elevated command prompt: C:\Windows\Microsoft.NET\Framework64\v4.0.30319>aspnet_regiis.exe –r

Next, you will install "Windows Assessment and Deployment Kit (ADK) for Windows 8"

http://www.microsoft.com/en-us/download/confirmation.aspx?id=30652

Select the following Features:

• Deployment Tools

• Windows PE

• USMT

Then we are ready for installing the SQL server.
(some would install wsus now, using the WID (Windows Internal Database), but I prefer to use the SQL server for WSUS as well)

Part I: Our SCCM 2012 environment

We have decided that we will build our SCCM 2012 on newest environment / versions, so
the (stand-alone) primary site server will be configured with:

Operating System:   Windows Server 2012, Std edt
SQL server: Microsoft SQL Server 2012 Std edt, SP1
and SCCM 2012, SP1 (and with the newly released CU1)

The two distribution points in the datacenter will also be installed on Server 2012.

Moving to SCCM2012

 

Finally

We are now starting to migrate to SCCM 2012.

First step is the design. This is not so complicated.
We are expecting approx. 20,000 agents, and we are supporting approx. 100 locations ww (some large, some very very small).

With these figures, I can avoid the CAS, and I will be able to support the organization from a single Primary Site Server (holding a lot of SCCM roles).

As we are running SCCM 2007r3 at the moment, the site servers at all locations will be “converted” to 2012 distribution point.

That will give this simple architecture:

I will continue blogging with my experince implementing SCCM 2012 and the migration from SCCM 2007.

Monitoring servers in DMZ using SCOM

I know there is a lot of information on this subject out there, and I spended a lot of time reading blogs and KBs, but still I was left with unanswered questions.
So – taking some bits here and there, putting them together, done some trying, and trying - this is the steps I will have to take next time I have a server in DMZ, that should be monitored by SCOM.

---

At my company, we have a lot of servers in DMZ, we wanted to monitor in our SCOM (still on SCOM 2007 R2, cu5).

We have a functioning CA-server and I have a SCOM Gateway server.

---

First – we need a Trusted Root Certificate.

This certificate has to be imported on all involved servers (RMS, GTW, DMZ servers).

• Browse to http://CA/certsrv
• Download a CA certificate, certificate chain, or CRL
• Download CA certificate chain
• Save certnew.p7b in a folder for your certs (ie. c:\certs)

This certificate needs to be copied to the servers, and imported.

• Open MMC with Certificates (Local Computer) snap-in
• Import the certificate under “Trusted Root Certification Authorities”

---

Second – we need a certificate for every server.

• Browse to http://CA/certsrv
• Request a certificate
• “Or, submit an advanced certificate request”
• Create and submit a request to this CA
• Name: FQDN of server
• Type of Certificate Needed: Other…
• OID: 1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2
• Create new key set
• CSP: Microsoft Enhanced Cryptographic Provider v1.0
• Select: “Mark keys as exportable”
• Store certificate in the local computers certificate store.
• Friendly Name: FQDN of server
• Submit

Now, the certificate request have to be issued.

• On CA server, open Certification Authority console
• In “Pending Requests”, right-click the certificate > All-Tasks > “Issue”

Save the certificate

• Browse to http://CA/certsrv
• View the status of a pending certificate request
• Select your sertificate
• Install this certificate
• Open MMC with Certificate (Local Computer) snap-in
• Personal > Certificates
• right-click your certificate > All Tasks > Export
• Yes, export the private key
• Personal Information Exchange > Enable strong protection
• Type a password (remember.. remember.. you will need it later)
• Save it in your cert-folder as FQDN.pfx

Do this for all servers, and copy the file to the servers.

---

On the server in DMZ

Hosts – file
Can your DMZ server resolve the Gateway or RMS ?
Else – put these into the hosts file (C:\Windows\System32\Drivers\etc)

Manually install scom agent
Copy the installation files to your server (also copy MOMCertImport.exe, we will need it) and launch MOMAgent.msi
You will need to supply the name of your Management Group and the FQDN of your GTW.

MOMCertImport
Ok, you copied MOMCertImport, and the certificate file is here too, then:
MOMCertImport <path>\<certificate file>
- and here you will need your password for the certificate.

Now you need to bounch the “System Center Management”-service
and go to Pending Management in your OpsMgr console and approve.

Install CU
Go back to your DMZ server and install current cu.

Manageable
Your agent is now manually installed, which means that it won’t get updated automatically.
Fortunately, using an query on your OpsMgrDB, you can alter a bit, and in this way make the agent manageable.

Windows could not start the System Center Management on Local Computer

Today, checking on my scom health, I found several grey servers.
I thought that this was just another "Stop System Center Management service - delete Health Service State - start System Center Management service"...
BUT.... no.... when I started the service, I got a pop-up:

...and the service didn't start.
hmmm....
Further investigation - and a little help from this article:
http://blogs.technet.com/b/smsandmom/archive/2008/04/30/opsmgr-2007-healthservice-service-fails-to-start-with-25362-warning.aspx
send me in this direction:
check the WindowsAccountLockDownSD key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HealthService\Parameters\Management Groups\.
And.. sure... the key was not present on these grey machines.
So, I found a healthy machine, exported the WindowsAccountLockDownSD key, copied the reg-file to the "defect" machines and merged it.

And... VOILA.... the service started nicely again.

BUT.... the service started nicely, but the server was still grey.
Looking into the eventlog I found an error 7005 with the following text:
The Health Service was unable to publish its public key to management group [MyMG] and will be unable to receive secure messages until this key is published. Attempts to publish the key will continue.
As long as the agent can't publish its public key it will not communicate with the SCOM management server.
It turned out that two more keys was missing in the registry.
In the following location there should be two keys with a long coded name (string of about 30 characters):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HealthService\Parameters\Management Groups\mymgmtgroup\SSDB\References\
If it is not there you can pick it up from another machine in the same management group and merge it.
Then restart the System Center Management service and ... Voila... the servers go green.

VMPD - it's finally arrived

Finally - The System Center 2012 Visio MP Designer—VMPD— has arrived.
VMPD is an add-in for Visio 2010 Premium that allows you to visually design Management Packs for  System Center Operations Manager.

You can download it from here: http://www.microsoft.com/en-us/download/details.aspx?id=30170

I will install it right away, and can't wait to get started.