I’ve found this list extremely useful and have chosen to store it here for my own use.

Pasted from <http://www.elemental.net/~lf/undoc/>

NET [ ACCOUNTS | COMPUTER | CONFIG | CONTINUE | FILE | GROUP | HELP | HELPMSG | LOCALGROUP | NAME | PAUSE | PRINT | SEND | SESSION | SHARE | START | STATISTICS | STOP | TIME | USE | USER | VIEW ]

Windows 2000 syntax

If you would rather be prompted to type your user name and password instead of specifying them in the NET LOGON command line, type NET LOGON without options. oldpassword Specifies your current password. newpassword Specifies your new password. It can have as many as 14 characters. computer Specifies the Windows NT or LAN Manager server on which you want to change your password. /DOMAIN Specifies that you want to change your
password on a Windows NT or LAN Manager domain.
name Specifies the Windows NT or LAN Manager domain on which
you want to change your password. user Specifies your Windows NT or LAN Manager user name.

The first syntax line above is for changing the password for your  password-list file. The second syntax line above is for changing your  password on a Windows NT or LAN Manager server or domain. computer Specifies the name of the computer whose print queue you want information about. printer Specifies the name of the printer you  want information about. port Specifies the name of the parallel (LPT) port on your computer that is connected to the printer you want information about. job# Specifies the number assigned to a queued print job. You can specify the below options. /PAUSE Pauses a print job. /RESUME Restarts a print job that has been paused. /DELETE Cancels a print job. /YES Carries out the NET PRINT command without first prompting you to provide information or confirm actions.

When you specify the name of a computer by using the NET PRINT command, you receive information about the print queues on each of the shared printers that are connected to the computer. name  Is the username, computername, or messaging name to send the message to. If the name is a computername that contains blank characters, enclose the alias in quotation marks (” “). * Sends the message to all the names in your group. /DOMAIN[:name] Sends the message to all the names in the workstation domain. If name is specified, the message is sent to all the names in the specified domain or workgroup. /USERS Sends the message to all users connected to the server. message Is text to be sent as a message. sharename=drive:path [/USERS:number | /UNLIMITED]
[/REMARK:"text"]
[/CACHE:Manual | Automatic | No ] sharename [/USERS:number | /UNLIMITED]
[/REMARK:"text"]
[/CACHE:Manual | Automatic | No ] {sharename | devicename | drive:path}  /DELETE NET START Starts services. NOTE: Services cannot be started from a command prompt within Windows.NET START [BASIC | NWREDIR | WORKSTATION | NETBIND | NETBEUI | NWLINK] [/LIST] [/YES] [/VERBOSE]

To start the workgroup redirector you selected during Setup, type NET START without options. In general, you don’t need  to use any of the options. NET STOP Stops the basic redirector. BASIC Stops the basic redirector. NWREDIR Stops the Microsoft Novell(R) compatible redirector. WORKSTATION Stops the default redirector. NETBEUI Stops the NetBIOS interface. NWLINK Stops the IPX/SPX compatible interface. /YES Carries out the NET STOP command without first prompting you to provide information or confirm actions.

To stop the workgroup redirector, type NET STOP without options. This breaks all your connections to shared resources and removes the NET commands from your computer’s memory. computer Specifies the name of the computer (time server) whose time you want to check or synchronize your computer’s clock with. /WORKGROUP Specifies that you want to use the clock on a  computer (time server) in another workgroup. wgname Specifies the name of the workgroup containing a computer whose clock you want to check or synchronize your computer’s clock with. If there are multiple time servers in that workgroup, NET TIME uses the first one it finds. /SET Synchronizes your computer’s clock with the clock on the computer or workgroup you specify. /YES Carries out the NET TIME command without first prompting you to provide information or confirm actions. drive Specifies the drive letter you assign to a shared directory. * Specifies the next available drive letter. If used with /DELETE, specifies to disconnect all of your connections. port Specifies the parallel (LPT) port name you assign to a shared printer. computer Specifies the name of the computer sharing the resource. directory Specifies the name of the shared directory. printer Specifies the name of the shared printer. password Specifies the password for the shared resource, if any. ? Specifies that you want to be prompted for the password of the shared resource. You don’t  need to use this option unless the password is optional. /SAVEPW:NO Specifies that the password you type should not be saved in your password-list file. You need to retype the password the next time you connect to this resource. /YES Carries out the NET USE command without first prompting you to provide information or confirm actions. /DELETE Breaks the specified connection to a shared
resource. /NO Carries out the NET USE command, responding  with NO automatically when you are prompted to confirm actions. /HOME Makes a connection to your HOME directory if one is specified in your LAN Manager or Windows NT user account.

To list all of your connections, type NET USE without options. computer Specifies the name of the computer whose shared resources you want to see listed. /WORKGROUP Specifies that you want to view the names of the computers in another workgroup that share resources. wgname Specifies the name of the workgroup whose computer names you want to view. /YES Carries out the NET VIEW command without first prompting you to provide information or confirm actions.

To display a list of computers in your workgroup that share
resources, type NET VIEW without options.

Examples

net use z: \\computer\folder

Map the Z: drive to the network path //computer/folder.

net send mrhope “There is hope!”

Send a text message to the computer with a host name of “mrhope” the message “There is hope!”. Note: This command only works for Windows versions that support this command.

Note: Many computers today have also disabled the messenger service, if this service is disabled you will be unable to send/receive net send messages. Additional information about how this service is disabled can be found on document CH0000519. If you need this service enabled, follow the instructions on this page and choose to enable the service instead of disabling it. 

net config workstation

Display additional information about the network such as the computers name, workgroup, logon domain, DNS, and other useful information.

net view \\hope

View the available computers and their shared resources you may use either of the below commands. The first example displays available computers. The last command would display the shared resources on the hope computer.

net localgroup

Display all groups currently setup on the computer you’re running the command on.

net share

Display all network shares on your computer.

net share hope=c:\hope\files 

Create a share called “hope” for the “c:\hope\files” directory.

Operations Manager 2007 Operations Guide

Microsoft Corporation

Published: February 2009

Author

Chris Fox, John Downing, Anat Kerry, Liza Poggemeyer, Scott Butler

Primary Reviewers

Dhananjay Mahajan; Joseph Chan

Feedback

Send suggestions and comments about this document to momdocs@microsoft.com. Please include the operations guide name and published date with your feedback.

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted in examples herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 2008 Microsoft Corporation. All rights reserved.

Microsoft, MS-DOS, Windows, Windows Server, Windows Vista, and Active Directory are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

All other trademarks are property of their respective owners.

Revision History

Release Date	Changes
July 13, 2007	Original release of this guide
February 22, 2008	Added “Maintenance and Best Practices for Operations Manager” section, which contains multiple new topics. Added the “Updates to the Operations Manager Deployment” section, which contains multiple new topics. Major updates to the Backup and Restore section, including updates to the Root Management Server and Reporting server recovery.
March 15, 2008	Updated the ‘How to Promote a Management Server role to a Root Management Server Role in Operations Manager 2007’ topic in the ‘Updates to the Operations Manager 2007 Deployment’ section. Updated the ‘How to Promote a Management Server to a Root Management Server Role in Operations Manager 2007’ topic in the ‘Updates to the Operations Manager 2007 Deployment’ section. Changed formatting in the ‘How to Move the OperationsManager Database in Operations Manager 2007’ topic.
April 11, 2008	Updated the ‘Configure Notifications’ section to address customer issues, as well as provide the procedure for an operator or advanced operator to create their own notification recipient and subscription.
September, 2008	Expanded the management pack content to include lifecycle administration, best practices, and procedures Added section on Managing Audit Collection Services Updated the Operations Console topic to provide additional information, including information on searching the views. Updated the Deploy Management Agents in Operations Manager 2007 to provide more detailed, linear deployment steps, as well as additional agent administration information
February 2009	Improved navigation in the table of contents.

Roadmap for the Operations Manager 2007 Guides

If you are new to Operations Manager 2007, you can use the following diagram to see the order in which you should read the Operations Manager 2007 Guides. This diagram will be updated as new guides become available.

Introduction to the Operations Manager Operations Guide

The Operations Manager 2007 Operations Guide is a comprehensive resource that can be used to understand and use your Operations Manager 2007 implementation to your best advantage. It follows the Operations Manager 2007 Deployment Guide in order of usage during an Operations Manager implementation project. It teaches the Operations Manager administrator what to do after successfully deploying a management group for the first time.

What Is in This Guide

You can use this guide in one of two ways:

The first section, Operations Manager 2007 Default Settings, provides a tour of the the components that are present prior to any management packs being imported or agents being deployed. It explains the default behavior of Operations Manager 2007 and the objects that are present by default.

The second section, Configuring Operations Manager 2007 for Use, provides a tour of the Operations console and guides you through the administrative tasks that prepare your Operations Manager 2007 implementation for use by people that will be in the Operators role. For example adding users to Operations Manager 2007 roles, configuring recipients, and using notification channels and subscriptions.

The third section, Start Monitoring, tells you how to start monitoring your environment. These sections provide information about deploying agents, managing agents and working with alerts. With these tasks completed, your Operations Manager 2007 implementation will be monitoring your applications and computers and providing you with actionable alerts, performance data and other information from your environment.

The final section, Maintenance and Best Practices for Operations Manager remaining sections describe ongoing tasks. These sections can be used as a reference by all Operations Manager administrators for understanding general management group administration scenarios and includes the procedures needed to support those scenarios. These sections include content on administering management servers, administering Management Groups, and performing basic backup and restore procedures and administering Gateway servers.

Operations Manager 2007 Default Settings

Operations Manager 2007 has numerous settings that are configured and enabled during an Operations Manager 2007 installation. Many of these settings are contained in a series of management packs that are imported during an Operations Manager 2007 installation. These management packs are designed to provide a foundation of object types and settings upon with other management packs depend.

Before you begin importing additional management packs or deploying agents into your environment, you should first become familiar with these initial settings. This section discusses how to view, assess the impact of, and, if desired, customize these initial settings.

Review automatically imported management packs

During an Operations Manager 2007 installation, 40 management packs are imported by default. Of the 40 management packs that are imported during installation, most are libraries. Libraries are a special type of management pack that are designed to provide a foundation of object types and settings upon with other management packs depend. The management packs that you want to import to monitor applications, services, and devices in your environment will have dependencies on one more of these libraries.

You can view the list of automatically imported management packs in the Administration pane of the Operations console immediately after installation of Operations Manager 2007 is complete.

To view a list of all the imported management packs, click Management Packs in the Administration pane of the Operations console. The list of imported management packs displays in the Details pane.

The following is a list of automatically imported management packs for Operations Manager 2007:

Assess initial settings

Like all management packs, the enabled settings contained in the automatically imported management packs begin monitoring immediately after it is deployed to an agent. You can use the Authoring and Monitoring panes in the Operations console to display and assess the initial settings of Operations Manager 2007.

Authoring Pane

You can use the Authoring pane in the Operations console to view monitoring settings from currently imported management packs. To switch to the Authoring pane, click the Authoring button. You can then click any node under the Management Pack Objects node to view the monitoring settings that apply to the corresponding node. For example, if you click Rules, the Details pane displays a list of all the rules that are from currently imported management packs.

Rules, like all other management pack objects, are listed by the type of object to which the rule applies. Each object type is listed in ascending alphabetical order. Each monitoring object in the Details pane includes information, such as the management pack, that contains the setting and if it is currently enabled or disabled. Most settings included in the automatically imported management packs are enabled, by default.

Note

Monitoring Pane

The Monitoring pane displays the results of monitoring. It contains only folders and views. The folder structure of the Monitoring pane is defined by individual management packs that are currently imported.

Many of the libraries that are automatically imported define a folder structure and views that. For example, the Windows Client Operating Systems Library imports automatically during Operations Manager 2007 installation. This library creates a Microsoft Windows Client folder in the Monitoring pane that contains views and other subfolders. These views are designed to display information that is gathered by the client operating system management packs such as the Windows XP management pack or the Windows Vista management pack and the Information Worker management pack. If you do not import a client operating system management pack or the Information Worker management packs, these views have no data to display.

Management Pack Removal

You can delete a management pack in the Administration pane from the Details pane when the Management Packs node is selected. For the deletion to be successful, no other imported management pack can depend on the management pack you want to delete. Several of the automatically imported libraries have dependencies on other libraries. If the management pack you want to delete has any dependent management packs, Operations Manager displays a list of the dependent management packs and does not allow you to continue with the deletion.

Change initial management pack settings

You can use overrides to change the behavior that is set by automatically imported management packs. All monitoring settings, including overrides must be saved to a management pack. Before you customize any settings of a management pack, you should first plan how and to which management pack you will save these customizations.

Management Pack Formats

Management pack files in Operations Manager 2007 have two formats that are accepted as valid. These formats are sealed and unsealed. A sealed management pack is a binary file whose settings cannot be changed. An unsealed management pack is an XML file that can be edited. Of the 38 management packs that are imported as part of an Operations Manager 2007 installation only one is unsealed. The unsealed management pack is the Default management pack.

After a management pack is imported, you can use overrides to supersede a sealed management pack’s default settings. An override, like all monitoring settings, must be saved to a management pack, but because you cannot change the settings of a sealed management pack file, overrides and other customizations must be saved to a different and unsealed management pack.

The Default Management Pack

The Default management pack is provided as a repository for customizations that effect sealed management packs. It is the only unsealed management pack imported as part of the Operations Manager 2007 installation. By default, when you create an override, or any other monitoring setting, it is saved to the Default management pack. You can choose to save the override to another unsealed management pack when you create the override. You can use an existing management pack or create a new one from the Override Properties page.

Management Packs for Customizations

If you plan to use overrides to tune many of your management packs, instead of saving all of the customizations to the Default management pack you can create a set of management packs whose purpose is to store customizations.

When you create these management packs you can devise a naming convention that is the same as the management pack that holds the original settings. For example, if you want to customize settings defined in the Windows Core Library, you can create a management pack in the Operations console and name it Windows Core Customizations. This unsealed management pack can then be used to save overrides and other customizations, such as additional monitors, that supersede the default settings of the Windows Core Library.

Configure Operations Manager

Operations Manager begins gathering monitoring data immediately after it is deployed. Before Operations Manager users, such as operators and authors, can act on this data the Operations Manager administrator needs to complete some configuration tasks. The tasks include implementing user roles, which determine what actions your Operations Manager users can perform and on which objects, as well as determining your users console needs and configuring notifications.

Understanding the Operations console

The Operations console is the primary tool used for managing your Operations Manager 2007 deployment. In the Operations console, you view and interact with alerts and monitoring data, manage and edit unsealed management packs, generate and view reports, administer management group settings, and build a workspace that is customized to your needs.

The Operations console is made up of the following parts:

Toolbar

Provides access to the menus, search, find, and scope features, and actions. Note that the tools you see might differ depending on the level of access you have.

Navigation pane

Displays the aspects of your Operations Manager implementation, including all currently discovered objects. You can use the navigation tree to drill into your environment. When you select an item in the tree, details of that item are displayed in the Results pane.

Navigation buttons

Enable you to move through the monitoring and administration views in the Operations console. The buttons that you have access to depends on the security role you are signed in as. A member of the Administrator group can access all the buttons; an Operator can access all the buttons except Administration. There are five areas: Monitoring Authoring Reporting Administration My Workspace

Actions pane

Displays links to any actions you can take on a selected object (such as viewing the properties of the object), additional resources you can use to get more information (links to online information), and links to the product help. The links displayed in the Actions pane are context-specific and reflect your current scope, view, and selected object.

Results pane

Displays the results from navigation using the navigation tree or from a search or find action. The Results pane also shows any textual feedback from actions.

Details pane

Displays more detailed information about the selected item in the Results pane.

Navigate the Operations console

To view the portion of the navigation tree that you want, select the appropriate navigation button, such as Administration or Monitoring. Which navigation buttons are available to you depends on which Operations Manager 2007 components have been installed (such as Reporting) and the role for which you are logged in (Administrators see all navigation buttons; operators see only Monitoring). Each navigation button opens a different view. The navigation tree in the Operations console is context-sensitive based on the view that you are using. For example, when you are working in the Administration view, the navigation tree shows different functions for administration (such as configuring user security), while when in the Monitoring view, the navigation tree displays monitoring functions (such as viewing alerts).

The following sections provide details about each of the views and what you can do in those views.

Monitoring view

In the Monitoring view, you can quickly find the monitoring data you need, such as alerts, performance data, and diagram views. The view displays different aspects of the monitoring data that is collected by Operations Manager 2007. Each item in the Monitoring navigation tree is either a view type or a folder that contains more views.

The views listed under the Monitoring view display aspects of your entire environment, such as current active alerts. The folders listed in the navigation tree are either features of Operations Manager, such as Agentless Exception Monitoring and synthetic transactions, or containers for views defined within a management pack. The feature folders are created when Operations Manager is installed. The folders are named after imported management packs and contain views from those management packs.

You cannot delete the folders or views that are created when Operations Manager is installed or when Management Packs are imported. However, you can personalize the display of these views by using the Personalize View option in the Monitoring pane. Also, you can hide any of the folders by clicking Show or hide views, located just above the navigation buttons, and making your selections by clearing the appropriate check boxes in the Show or hide views window.

The Find, Search, and Scope buttons on the Operations console can make it easier to access the monitoring data within the Monitoring view. For information about using Find, Search, and Scope, see View data in the Operations console.

Authoring view

In the Authoring view, you can display monitoring settings from currently imported management packs. You can click any node under the Management Pack Objects node to view the monitoring settings that apply to the corresponding node. For example, if you click Rules, the Details pane displays a list of all the rules that are from currently imported management packs. Rules, like all other management pack objects, are listed by the type of object to which the rule applies. Each object type is listed in ascending alphabetical order. Each monitoring object in the Details pane includes information, such as the management pack that contains the setting and if it is currently enabled or disabled. Most settings included in the automatically imported management packs are enabled, by default.

You can also use the Authoring view to create and configure additional monitors, distributed applications, and groups.

See the Management Pack Authoring Guide for detailed information about how to create a management pack for a product (which can be an application, a service, or a device).

Reporting view

In the Reporting view, you access the Reporting function in Operations Manager. You can use the Reporting function to create reports based on the data collected by Operations Manager. Reports present data that has been aggregated, is from specific time intervals and from specific sources, and can provide a longitudinal view of information from your monitoring environment. For example, you can create a report that shows the amount of time it takes between an alert being raised to its being written in the Operations Manager database. This report can help you identify any network delays and isolate trouble spots. Based on the data in this report, you can then take corrective action.

The Reporting view is only available if you have installed the Reporting components and have been granted access to them. For information about installing and deploying the Reporting feature, see the Operations Manager Deployment Guide. You can also find additional information about using the Reporting interface in the Report Authoring Guide and the Operations Manager Help.

Administration view

In the Administration view, you can deploy and configure all aspects of the monitoring environment. For example, if you want to set up notifications (messages that are sent when alerts occur), you do that through the Administration view. You also perform most administration aspects of Operations Manager through this view: You can configure and manage management groups and users, set up user security through user roles, and manage connectors (non-Microsoft devices that provide monitoring data to Operations Manager 2007).

My Workspace view

Use the My Workspace view to create and save custom workspaces and searches. This enables you to customize your working environment so that it shows only those items that you are interested in.

View data in the Operations console

Operations Manager 2007, with the appropriate management packs imported, will provide you with a comprehensive view of what is going on with your monitored applications, hardware, and processes. This can result in a very large volume of data being displayed in the Operations console. Learning how to quickly locate the data you need is essential to efficient interaction with the console. You can use the Scope, Find, and Search buttons on the Operations console toolbar to filter your view of monitoring data so that you can find the exact monitoring object or group of objects that you need. You can also filter your data based on the number of hours or days you would like to show.

The Scope, Search, Find, and Time tools apply a temporary filter to the data you are viewing in the console. While you can locate a specific object using Search or Find, you can also use Scope or Time to display a set of objects that meet a set of criteria. The following table shows the differences between the different filtering options:

Filter	When to use
Scope	Use to limit the data in a view to only those objects that meet your criteria. This scope remains in place until you clear it.
Search	Use to display a list of objects that meet your criteria. You can then act on those objects; however, when you navigate away from this list, the filter is removed, and any view will show all objects (not just those from your search criteria).
Find	Use to display a known single object.
Time	Use to limit the data displayed to only that data (such as alerts) that has been generated within a defined time frame.

If you need to view the same set of monitoring data, you can personalize a view so that the same filters are always applied to the data when you open that view in the console. You can also save a search for later use.

Changing the scope

Changing the scope of the monitoring view enables you to view only those objects that meet a certain criteria, such as management servers. For example, if you want to view only those computers in your environment that are running Windows XP, you can apply a scope that uses “Windows XP” as the criteria; no other computers are displayed.

Note that the scope used within the Operations console is different from that used for security roles. In a security sense, the term “scope” applies to the realm of responsibility (such as being responsible for all computers in the Northwest running Microsoft Exchange). A security role is made up of the scope plus a profile.

To change the scope

1.    In the Operations console, click the Monitoring button to display the objects in your monitoring environment. 2.    Click the Scope button on the Operations Manager toolbar. If this button is not available, check to make sure that you have an object, not a folder, selected in the Monitoring pane. 3.    The Change View Scope dialog box displays a list of existing groups and distributed applications. If the list is too long, you can find a specific group or distributed application by entering a word or phrase in the Look for box. Once you make a selection, click OK. Now only the objects that meet the scope criteria are shown in the Results pane.

Using Find and Search

Use the Find button when the list of objects in the Results pane is too long to quickly pick out a particular object. Use the Search button if you want to find all objects that meet a certain criteria.

To use the Find button to locate an object within a list

1.    In the Operations console, click the Monitoring button. 2.    Click to select a view that is available in the Monitoring pane. This displays a list of objects. 3.    Check to see if a Look for box is at the top of the Results pane. If there is no Look for box, click the Find button on the Operations Manager toolbar. In Look for, type a word, such as the name of an object, that you want to find in the list, and then click Find. The object that you are looking for is displayed. 4.    Click Clear to go back to the original list of objects.

To use the Search feature to create a list of objects

1.    In the Operations console, click the Monitoring button. 2.    Click the Search button in the Operations Manager toolbar. 3.    In the Search window, type the word or phrase that describes the set of objects you want to find. A list of objects that meet your criteria displays. The list is sorted by object type.

Changing the time criteria

Changing the time criteria of the monitoring view enables you to view only those objects that meet a certain criteria, such as “Last 12 hours.” When you change the time criteria, you limit what is displayed to only what has happened in that time period. For example, if you want to view the last week of data, you can change the time criteria to Last 1 week.

To change the time criteria

1.    In the Operations console, click the Monitoring button to display the objects in your monitoring environment. 2.    Click the Calendar button on the Operations Manager toolbar. If this button is not available, check to make sure that you have an object, not a folder, selected in the Monitoring pane. 3.    Select the proper time criteria you are interested in.

Now only the objects that meet the time criteria are shown in the Results pane.

Implementing User Roles

In Operations Manager 2007 user roles assign the rights needed to access monitoring data and perform actions. User roles are designed to apply to groups of users that need access to and perform actions on the same group of monitored objects. By default, only the Operations Manager Administrator account has the right to view and act on monitoring data. All other users must have a user role assigned in order to view or act on monitoring data.

User Roles are created using the Create User Role Wizard. In this wizard you configure which Active Directory security groups are assigned this user role, which Operations Manager group or groups of monitored objects this user can access, and which tasks and views this user role can access.

Choose a Profile

Before you can start the Create User Role Wizard you must select one profile that applies to the user role you are creating. A profile determines the actions that an Operations Manager user can perform. Profiles have a defined set of rights and you cannot add or remove any of these assigned rights. For a complete list of profiles and the rights assigned to each see About User Roles in the Operations Manager 2007 Online Help. When creating user roles for operators and other Operations Manager users, select the profile that most closely matches the responsibilities of the group of users in your Operations Manager 2007 deployment

Define a scope using Operations Manager groups

Scope determines which objects you can view and perform actions on in Operations Manager 2007. A scope is comprised of one or more Operations Manager groups and is defined when creating a user role as part of the Create User Role Wizard. The Group Scope page of the Create User Role Wizard provides a list of all existing Operations Manager groups. You can choose all or just some of these groups as the scope of the user role you are creating.

Groups, like other Operations Manager objects, are defined in management packs. In Operations Manager 2007, groups are logical collections of objects, such as Windows-based computers, hard disks, or instances of Microsoft SQL Server. Several groups are created by the management packs that are imported automatically during an Operations Manager installation. If these groups do not contain the monitored objects you need for a scope, you can create a group that does. To do this you must exit the Create User Role Wizard, switch to the Monitoring pane and use the Create Group Wizard to create a group that better suits your needs.

Assign tasks and views

The Create User Role Wizard contains a page that defines the tasks that the user role you are creating can perform and a page that specifies the views that the user role you are creating can open and use. The default setting is that all users assigned that user role can run all tasks and open all views as long as their profile and scope allows it. The alternative in these wizard pages is to list the specific tasks or views that the user role you are creating can access.

Determining Console Needs

Operations Manager users need a console to access monitored objects through a graphical interface. The consoles available to your users are the Operations console and the Web console. The Operations console allows Operations Manager users to perform all actions that their user role allows while the Web console displays only Monitoring and My Workspace panes.

If you create a user role based on the Author or Advanced Operator profile those users must have the Operations console to perform all of the tasks that these profiles allow.

As the administrator you must deploy the Operations console to each user’s computer using the System Center Operations Manager 2007 Setup wizard. The Operations console can run on one of two client operating systems: Windows XP and Windows Vista. Some of the requirements include a minimum of 1 gigabytes (GB) of RAM and a 1 gigahertz (GHz) processor. For a full list of hardware and software components for installing the Operations console see Operations Manager 2007 Supported Configurations.

The Web console is designed for users that have a user role that is based on the Operator or Read-Only Operator profiles. Only the Monitoring and the My Workspace panes are available in the Web console. It is designed for operators to view monitoring data, run tasks, and resolve alerts. However, from the web console you cannot use the Run As feature. All tasks are run on the agent using the agent action account credentials.

No special hardware or operating system is required for the Web console. Users access your Web console server via Internet Explorer 6.0 or later. If you have users whose job it is to create monitoring settings or override default settings that user must have an Operations console.

Configuring Notification

Notifications generate messages or run commands automatically when an alert is raised on a monitored system. By default, notifications for alerts are not configured. If you want your Operations Manager users to be notified immediately when an alert is generated you need to configure notifications and let the users know the steps they need to take to receive them.

To configure notifications, an Operations Manager administrator must perform the following steps:

Once the above steps are complete, an administrator, operator, or advanced operator can do the following:

To receive notifications, an Operations Manager user must subscribe to a notification subscription. An Operations Manager user must have the rights assigned to the Operator user role to subscribe to a notification.

Notification Message Content

Operations Manager administrators can configure message content for a notification. Operations Manager has two default message formats: short and verbose. The default short format has only a subject and is designed for small bandwidth channels and devices, such as instant messages and pagers. The default verbose format has a subject and a message body and is designed for notification channels that have more bandwidth available, such as e-mail. An administrator can accept the defaults for the short and verbose messages or edit the subject and content of a notification message.

Operations Manager uses Alert parameter variables to define the subject and body content of a notification message. Variables in Operations Manager 2007 are enclosed in dollar signs ($). An example of a variable is $Data/Context/DataItem/AlertName$. In this example the variable text is replaced with the name of the alert that triggered the notification. The Data variable reads data from a source that is external to Operations Manager.

Enable Notification Channels

To send notifications, Operations Manager 2007 can use a variety of mechanisms, such as e-mail, instant message, short message service, and pager. Choosing the delivery mechanism for the notification is called enabling a notification channel. The length and format of the message varies based on the media that receives the notification. The available notifications channels are e-mail, instant message, Short Message Service, and command. A command channel can run a script or executable file.

Operations Manager can accommodate different notification channels and endpoints with a variety of delivery protocols and formats. For example, some operators prefer to receive notifications on a pager, while others might prefer to receive notifications by e-mail. Operations Manager supports Session Initiation Protocol (SIP), which supports the transmission of messages through instant messages, and short message service (SMS), which supports the transmission of short text messages to and from mobile phones and other devices. In addition, you can configure a notification to run a command instead of or in addition to sending a notification message. A command can specify a path to an application or script that can perform basic functions. You can also use a command to integrate a custom delivery channel that is not supported by Operations Manager out of the box, such as a pager.

Create and Configure a Notification Action Account

The credentials of the Notification action account are used to create and send notifications. Ensure that the credentials for this account have sufficient rights to the servers that send notifications such as the SMTP server used for e-mail notifications or the instant messaging server.

Procedures

To create and configure the Notification action account

1.    Log on to the computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box displays. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 2.    In the Operations console, click the Administration button. 3.    In the Administration pane, right-click Security, and then click Create Run As Account. Use the Create Run As Account Wizard to create an account to use as the Notification action account, which is used to send the notifications. On the General page, click to select Windows from the Run As Account type drop-down list, and then in Display name, type Notification action account. On the Account page, type in the information for the User name password and domain of the user account that you are creating. Note For more information about the Create Run As Account Wizard, see How to Create a Run As Account in Operations Manager 2007 at http://go.microsoft.com/fwlink/?LinkId=95283. 4.    In the Administration pane, click Run As Profiles. 5.    In the details pane, right-click Notification Account, and then click Properties. 6.    In Run As Profile Properties, click the Run As Accounts tab. 7.    Click New, expand the Run As Account list, and then click Notification Action Account. 8.    In the Matching Computers list, double-click the Root Management Server (RMS). Repeat this step for any other secondary management server that you want to use as secondary notification servers. If the RMS fails, the secondary server will send notifications. After all notification servers are on the list, click OK twice.

Enable an E-mail Notification Channel

Operations Manager 2007 notifications support sending e-mail through Simple Mail Transfer Protocol (SMTP).

Before you begin, gather the following information:

Procedures

How to enable an e-mail notification channel

1.    Log on to the computer with a user account that is a member of the Operations Manager Administrator role for the Operations Manager 2007 management group. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box displays. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 2.    In the Operations console, click the Administration button. 3.    In the Administration pane, click Settings. In the Settings pane, right-click Notification, and then click Properties. 4.    Click the E-mail tab, and then select the Enable e-mail notification check box. Note You can choose to enable a different type of notification channel, such as instant messaging, Short Messaging Service, or command by clicking on the tab by that name in the Notification properties dialog box. 5.    In the SMTP servers area, click Add to display the Add SMTP server dialog box. 6.    Type the fully qualified domain name (FQDN) of a Simple Mail Transfer Protocol (SMTP) server, type the port number, select the authentication method used by the SMTP server, and then click OK. Note You can add one or more additional servers to act as backup servers. If the primary SMTP server is unavailable, notifications are sent through the secondary server. 7.    Type the Return Address that should appear on e-mail notifications, and then in the Retry primary after list, select the number of minutes to wait before trying to resend a notification to the primary SMTP server. 8.    In the Default e-mail notification format area, specify the E-mail subject and E-mail message with wildcard parameters such as $Alert Source$ and $Alert Description$, and then specify the encoding type. You can click Placeholder for a full list of available variables. If you receive notifications with missing or garbled text in the subject lines, select Generate subject line with no encoding (use if notification e-mails contain malformed subject lines. This option tells Operations Manager to send no encoding in the subject line; instead, the encoding from the SMTP server is used. 9.    Click OK to return to the Operations console.

Enable an instant message notification channel

When you enable an instant message channel you can also specify the text of the message you want to send. A default message is already created for you. The default message includes both text and data variables. All lines of text that are contained within a set of dollar signs ($) are alert parameters and are replaced with the actual data from the alert that generated the notification. All text not contained within a set of dollar signs displays as is.

The following is the default instant message sent for alerts:

Alert: $Data/Context/DataItem/AlertName$

Priority: $Data/Context/DataItem/Priority$

Severity: $Data/Context/DataItem/Severity$

Path: $Data/Context/DataItem/ManagedEntityPath$

Resolution state: $Data/Context/DataItem/ResolutionStateName$

Last modified by: $Data/Context/DataItem/LastModifiedBy$

Before you begin, gather the following information from your instant message server (Live Communications Server):

Procedures

How to enable an instant message notification channel

1.    Log on to the computer with a user account that is a member of the Operations Manager Administrator role for the Operations Manager 2007 management group. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box displays. In the Server name text box, type the name of an Operations Manager 2007 management server. 2.    In the Operations console, click the Administration button. 3.    In the Administration pane, click Settings. In the Settings pane, right-click Notification, and then click Properties. 4.    Click the Instant Messaging tab, and then select the Enable instant messaging notifications check box. 5.    In the IM server box, type the fully qualified domain name (FQDN) of an instant messaging server. 6.    Type the Return Address that should appear on instant message notifications. Preface the address with sip:. In the Protocol option list, select either TCP or TLS (Transport Layer Security) as the protocol used to send the instant messages. In the Authentication method list, select either NTLM or Kerberos as the authentication method for users. In the IM port box, the default instant messaging port of 5060 is entered. Type the port number used to send instant messages. Note The return address should be a dedicated address used only for Systems Center Operations Manager notifications. 7.    In the Default instant messaging notification format area, in the IM message box specify the text that is sent to notification subscribers. The IM message box contains a default message that includes text and variables. You can edit the default message or delete it and replace it with another message. Note The right arrow next to the IM message box displays a list of variables that you can add to the message. If you select a variable it is appended to the end of your current IM message with no spaces or explanatory text. 8.    .In the Encoding box, select the text format that your IM server and notification subscribers use for transmission. By default, Unicode (UTF-8) is used. Click the arrow to view the entire list of available formatting. 9.    Click OK to return to the Operations console.

Enable an SMS notification channel

When you enable an SMS channel you can also specify the text of the message you want to send. A default message is already created for you. The default message includes both text and data variables. All lines of text that are contained within a set of dollar signs ($) are alert parameters and are replaced with the actual data from the alert that generated the notification. All text not contained within a set of dollar signs displays as is.

Note

The modem used for SMS must support PDU mode. See Operations Manager 2007 Supported Configurations for information regarding supported hardware.

The following is the default Short Message Service (SMS) sent for alerts:

Alert: $Data/Context/DataItem/AlertName$

Priority: $Data/Context/DataItem/Priority$

Severity: $Data/Context/DataItem/Severity$

Path: $Data/Context/DataItem/ManagedEntityPath$

Resolution state: $Data/Context/DataItem/ResolutionStateName$

Last modified by: $Data/Context/DataItem/LastModifiedBy$

Procedures

To enable an SMS notification channel

1.    Log on to the computer with a user account that is a member of the Operations Manager Administrator role for the Operations Manager 2007 management group. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box displays. In the Server name text box, type the name of an Operations Manager 2007 management server. 2.    In the Operations console, click the Administration button. 3.    In the Administration pane, click Settings. In the Settings pane, right-click Notification, and then click Properties. 4.    Click the Short Message Service tab, and then select the Enable short message service notifications check box. 5.    In the SMS message box, specify the text that is sent to SMS notification subscribers. The SMS message box contains a default message that includes text and variables. You can edit the default message or delete it and replace it with another message. Note The right arrow next to the SMS message box displays a list of variables that you can add to the message. If you select a variable it is appended to the end of your current IM message with no spaces or explanatory text. 6.    In the Encoding box, select the text format for the SMS messages. 7.    Click OK to return to the Operations console.

Enable a command notification channel

Command notifications differ from the other available notification channels. A command notification allows you to run an executable program automatically in response to an alert. Because you can run multiple commands in response to an alert you must assign a unique name to each command notification that you create.

Procedures

To enable a command notification

1.    Log on to the computer with a user account that is a member of the Operations Manager Administrator role for the Operations Manager 2007 management group. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box displays. In the Server name text box, type the name of an Operations Manager 2007 management server. 2.    In the Operations console, click the Administration button. 3.    In the Administration pane, click Settings. In the Settings pane, right-click Notification, and then click Properties. 4.    Click the Command tab, and then click Add. The Notification Command Channel dialog box displays. 5.    Type a unique name for this command channel in the Notification command channel name box and a brief description in the Description box. 6.    In the Notification command configuration area, type the path to the executable file that you want to run in the Full path to file box. For example, “%systemroot%\cmd.exe” or “c:\winnt\system32\cscript.exe”. Type any parameters that you want to run with this command in the Command line parameters box. Type the path of the directory used for any output of this command in the Initial directory box. 7.    Click OK and then OK again to return to the Operations console.

Create Notification Recipients

A recipient is the user that receives the notification message. In Operations Manager 2007, there are three ways to define recipients: by list, membership, or subscription.

Compiling a list manually is the most straightforward way to define notification recipients. Use this approach if the list of recipients does not change. A less labor-intensive method to use is group membership. You can use group membership to determine who receives notification messages. Additionally, Active Directory accounts can store all contact information, including e-mail addresses, telephone numbers, and pager information. With Active Directory integration, Operations Manager 2007 is automatically informed of any change to the contact information of an account.

This procedure demonstrates how administrators configure recipients for e-mail notifications. A notification recipient defines when and from what devices notifications can be sent. You must first enable a notification channel before performing this procedure. After this procedure is complete you must create a notification subscription that defines the format of the notification message and any filters such as age or severity of the alert.

Procedures

To create a notification recipient (as an administrator)

1.    Log on to the computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box displays. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 2.    In the Operations console, click the Administration button. 3.    In the Administration pane, expand Notifications, right-click Recipients, and then click New Notification Recipient. 4.    On the General tab, type a display name for this recipient. If you want to schedule when notifications should be sent, click Only send notifications during specified times and create a date range. 5.    Click the Notification Devices tab. 6.    Start the Create Notification Device Wizard by clicking the Add button. 7.    Expand the Notification channel drop-down list, and then click E-mail. 8.    In the Your address for the selected channel box type an e-mail address. For example, type e-m...@contoso.com. This is the e-mail address that is listed in the From box of each e-mail message that is sent to notification recipients. 9.    On the Schedule page, you can leave the default schedule or you set a schedule that applies only to this notification, and then click Next. 10.    On the General page, type a name for this notification device, and then click Finish. 11.    Click Add to define another notification device. Otherwise click OK. 12.    The new recipient displays in the Recipients pane.

To create a notification recipient (as a non-administrator)

1.    Log on to the computer with an account that is a member of the Operators or Advanced Operators role for the Operations Manager 2007 management group. Note When you run the Operations console on a computer that is not a management server, the Connect to Server dialog box displays. In the Server Name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 2.    In the Operations console, click Tools in the top menu bar, and then click My recipient information. 3.    On the General tab, your current log in name is displayed. If you want to schedule when notifications should be sent, click Only send notifications during specified times and create a date range. 4.    Click the Notification Devices tab. 5.    Start the Create Notification Device Wizard by clicking the Add button. 6.    Expand the Notification channel drop-down list, and then click E-mail. 7.    In the Your address for the selected channel box type an e-mail address. For example, type e-m...@contoso.com. This is the e-mail address that is listed in the From box of each e-mail message that is sent to notification recipients. 8.    On the Schedule page, you can leave the default schedule or you set a schedule that applies only to this notification, and then click Next. 9.    On the General page, type a name for this notification device, and then click Finish. 10.    Click OK.

Create Notification Subscriptions

Subscriptions are designed to decrease the overhead of configuring and maintaining a notification. An Operations Manager 2007 administrator or user first creates a subscription for a notification. In the subscription, the administrator or user specifies all the formats and devices that send the notifications. Users can then subscribe to this notification. While subscribing to a subscription, operators can specify how they prefer to receive the notification from the available notification channels, such as by e-mail or instant message, and whether they would like a long or short message.

The following procedures detail the steps needed to configure a subscription so that users assigned the Operator role can subscribe to specified alerts. A recipient can be an individual user account or a distribution list. Before beginning this procedure you must enable a notification channel and then create a notification recipient. There are two procedures – one performed by an administrator and one by a non-administrator.

Procedures

To create a notification subscription (as an administrator)

1.    Log on to the computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box displays. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 2.    In the Operations console, click the Administration button. 3.    In the Administration pane, expand Notifications, right-click Subscriptions, and then click New Notification Subscription. The Create Notification Subscription Wizard starts. 4.    On the Introduction page, click Next. 5.    On the General page, in Subscription name, type a descriptive name for the subscription, type a short description, and then click Add. 6.    The Add Notification Recipients dialog box displays all notification recipients were previously created. Click each recipient that you want to include in this subscription, click OK, and then click Next. 7.    On the User Role Filter page, if you want to limit the users that can subscribe to this notification subscription select Available groups and classes filtered by role, select a user role, and then click Next. 8.    On the Groups page, by default, all groups are selected to receive notifications. If you want to limit the groups that receive notifications, click to deselect the top-level group, and then click to select the groups. Otherwise, click Next. 9.    If you want to filter notifications so that only notifications of selected object types are sent click Only classes explicitly added to the Approved classes grid are approved, and then click Add to create a list of object types. Click Next. 10.    On the Alert Criteria page, verify that the desired severity, priority, and resolution states are selected for notification. Verify that the desired category is selected, and then click Next. 11.    On the Alert Aging page, click Use alert aging as a notification criteria if you want to use alert aging, otherwise click Next. 12.    On the Formats page, if you want to customize the format of the e-mail sent for notification click Use this custom e-mail format, and then define the custom e-mail format. Otherwise, click Finish.

To create a notification subscription (as a non-administrator)

1.    Log on to the computer with an account that is a member of the Operations Manager Operator or Advanced Operator role for the Operations Manager 2007 management group. 2.    In the Operations console, click Tools, and then click My Notifications. 3.    On the Introduction page, click Next. 4.    On the Groups page, if you want to limit the groups that receive notifications, click to select the groups. Otherwise, click Next. 5.    If you want to filter notifications so that only notifications of selected object types are sent click Only classes explicitly added to the Approved classes grid are approved, and then click Add to create a list of object types. Click Next. 6.    On the Alert Criteria page, verify that the desired severity, priority, and resolution states are selected for notification. Verify that the desired category is selected, and then click Next. 7.    On the Alert Aging page, click Use alert aging as a notification criteria if you want to use alert aging, otherwise click Next. 8.    On the Formats page, if you want to customize the format of the e-mail sent for notification click Use this custom e-mail format, and then define the custom e-mail format. Otherwise, click Finish.

Start Monitoring

This section steps you through the process for deploying agents, working with management packs, and working with alerts. After these tasks are complete, your management group will automatically deploy the correct management packs to the correct computers and monitoring will begin.

Also, this section describes the configuration of the Customer Experience Improvement Program (CEIP), client monitoring options, and error reporting.

Deploying Agents in Operations Manager 2007

To begin monitoring your environment, you need to decide what applications and devices you want to monitor. Then you can identify the computers that support those applications. Operations Manager 2007 provides two methods for monitoring Windows-based computers: agent-managed or agentless managaged.

Agent-managed computers have an Operations Manager service installed. This service, which appears as HealthService in the Services list in Computer Management is the Operations Manager agent. Monitoring computers via agents allows access to all Operations Manager options and functionality, and therefore the vast majority of monitoring is performed this way. Agents are also a key component of agentless management.

Monitoring without an agent is an option for Windows-based computers where an agent cannot be installed. Agents can agentlessly manage a computer by proxying communications between a management group and the computer that is being managed in an agentless fashion.

Network devices and systems not running Windows can be supported without agents.

The first step in monitoring your environment is to deploy agents. Your network architecture will greatly influence which monitoring options to use and in planning how to deploy your agents. Be aware whether you are managing systems on the other side of a firewall or if you managing systems on an untrusted network.

Note

If you add or delete a new virtual server on a cluster after an Operations Manager 2007 agent is installed, the agent does not recognize the changes and new virtual servers are not reported. Restart the OpsMgr Health Service on the node where the virtual server is active.

After agents have been installed on managed computers and Operations Manager is configured to manage them, Operations Manager will start monitoring them as soon as the relevant management packs have been imported. We recommend a phased deployment of agents so that management packs can be customized to your needs. The alternative – deploying agents widely before customizing management packs – could create a large number of useless alerts, called noise alerts, during your rollout.

Using the Discovery Wizard for Deploying Agents

Operations Manager 2007 includes a tool for deploying agents called the Discovery Wizard. The Discovery Wizard is the easiest way to find systems to be managed and to install agents.

The Discover Wizard does not show systems that the management group is already monitoring. If you are doing a phased rollout of your management group, you can run the wizard to add new systems to the group. Also, after your initial deployment, you can use the Discovery Wizard to add newly installed computers to be managed.

When agents are pushed out to computers, Operations Manager 2007 sends the local administrator credentials required to install the agent. This could raise security concerns. Consult the Operations Manager 2007 Security Guide for security issues before you use the Discovery Wizard.

If the Discovery Wizard is not right for your needs, you have the option of manually installing agents on systems to be managed. Agents can also be embedded in the host image of the monitored computer.

Using the Discovery Wizard to Deploy Agentless Management

Windows-based systems where an agent cannot be installed can be managed without an agent. This is called agentless management.

Note

Not all management packs support agentless management, so make sure it will serve your needs before using agentless management. In particular, the Active Directory management pack and the Exchange Server 2003 management pack do not support agentless management.

Agentless management of computers is different from Agentless Exception Monitoring. Though similar in name, Agentless Exception Monitoring is used to aggregate, view, and report on error reports sent by the Windows Error Reporting service.

The Discovery Wizard can find and set up systems for agentless management. The process is almost the same as for deploying. You do, however, have to select a proxy for each agentless managed system.

A proxy is a system with an agent used to monitor an agentless system. A management group can serve as a proxy, but this takes up system resources. We recommend using an agent managed system as a proxy. This system must be set up for management before running the Discovery Wizard to establish agentless management.

Note

If a proxy is removed from management, its agentless systems are no longer managed.

Note

When monitoring virtual servers on a cluster, you must deploy agents to the cluster nodes, configure them to manage as a proxy and then monitor the virtual servers in agent less fashion.

Both the agentless managed system and its proxy need to have access to the managing server through any firewalls. For more information about interacting with firewalls, see the Operations Manager 2007 Security Guide and the Operations Manager 2007 Help.

Using the Discovery Wizard for Network Devices

The Discovery Wizard can find network devices for management.

Network devices and systems not running Windows require a proxy, just like agentless managed computers. A management group can act as a proxy, but that configuration requires more system resources. We recommend using a system with an agent as a proxy.

Both the network device and the proxy need to have access to the management group through any firewalls. For more information about interacting with firewalls, see the Operations Manager 2007 Security Guide and the Operations Manager 2007 Help.

Deploy Agents

The first step in monitoring your environment is to deploy agents. Your network architecture will greatly influence which monitoring options you use and how you plan the deployment your agents. Be aware of whether you are managing systems on the other side of a firewall from your management group or managing systems that don’t participate in a Kerberos trust with the management group.

Note

If you add or delete a new virtual server on a cluster after an Operations Manager 2007 agent is installed, the agent does not recognize the changes and new virtual servers are not reported. Restart the OpsMgr Health Service on the node where the virtual server is active.

You can use any of the following methods to deploy agents:

The following sections provide detailed steps for each of these methods.

Using the Discovery Wizard to Deploy Agents

You can use the Operations console to search your environment for manageable objects and then deploy an agent to any object that you want to monitor. The process of searching your environment is called “discovery.” One of the advantages of using discovery is that it lists all manageable objects, including any that you might not be aware of.

The Discovery Wizard does not show systems that the management group is already monitoring. If you are doing a phased rollout of your management group, you can run the wizard to add new systems to the group. Also, after your initial deployment, you can use the Discovery Wizard to add newly installed computers to be managed.

When agents are pushed out to computers, Operations Manager 2007 sends credentials that have local administrator rights for that computer; this is required to install the agent. Sending credentials could raise security concerns. Consult the Operations Manager 2007 Security Guide for information to help you address any security issues before you use the Discovery Wizard.

If the Discovery Wizard is not right for your needs (for example, if you have a set list of computers to which you want to deploy agents), you have the option of manually installing agents on systems to be managed. Agents can also be embedded in the host image of the monitored computer.

Use the following procedure to discover Windows-based computers and to deploy the Operations Manager 2007 agent to them from the Operations console.

Procedures

To deploy the Operations Manager 2007 agent to Windows-based computers from the Operations console

1.    Log into the Operations console with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    Click the Administration button. 3.    At the bottom of the navigation pane, click Discovery Wizard. 4.    On the Introduction page, click Next. The Introduction page does not appear if the Computer and Device Management Wizard has been run before and Do not show this page again was selected. 5.    On the Auto or Advanced? page, do the following: a.    Select either Automatic computer discovery or Advanced discovery. If you select Automatic computer discovery, click Next, and then go to step 7. If you select Advanced discovery, continue with the following steps. Note Automatic computer discovery scans for Windows-based computers in the domain that the root management server is in. Advanced discovery allows you to specify criteria for the computers that the wizard will return, such as computer names starting with NY. b.    In the Computer & Device Types list, select Servers & Clients, Server Only, or Clients Only. c.    In the Management Server list, click the management server or gateway server to discover the computers. When multiple management servers are in a management group, the agents are automatically configured to use secondary management servers if their root management server is unavailable. d.    If you selected Servers & Clients, you can select the Verify discovered computers can be contacted check box. This is likely to increase the success rate of agent deployment, but discovery can take longer. Note If the Active Directory catalog does not contain the NetBIOS names for computers in a domain, select Verify discovered computers can be contacted. Otherwise, the Browse, or Type In option will fail to find computers. This affects computers in the same domain as the root management server, in another domain with a full trust relationship, and in untrusted domains using a gateway server. e.    Click Next. Note The wizard can return approximately 4000 computers if Verify discovered computers can be contacted is selected, and can return 10,000 computers if it is not selected. Automatic computer discovery verifies that discovered computers can be contacted. A computer that is already managed by the management group is not returned. 6.    On the Discovery Method page, you can locate the computers that you want to manage by either scanning or browsing Active Directory Domain Services or typing the computer names. If you want to scan, do the following: a.    If it is not already selected, select Scan Active Directory and then click Configure. b.    In the Find Computers dialog box, type the criteria that you want to use for discovering computers and then click OK. c.    In the Domain list, click the domain of the computers that you want to discover. If you want to browse Active Directory or type the computer names, do the following: Select Browse for, or type-in computer names, click Browse, specify the names of the computers that you want to manage, and then click OK. In the Browse for, or type-in computer names box, type the computer names, separated by semi-colon, comma, or a new line [ENTER]. You can use NetBIOS computer names or fully qualified domain names (FQDN). 7.    Click Next, and on the Administrator Account page, do one of the following: Select Use selected Management Server Action Account if it is not already selected. Select Other user account, type the User name and Password, and then select the Domain from the list. If the User name is not a domain account, select This is a local computer account, not a domain account. Important The account must have administrative privileges on the targeted computers. If This is a local computer account, not a domain account is selected, the Management Server Action Account will be used to perform discovery. For more information about Operations Manager 2007 accounts, see the Operations Manager 2007 Security Guide. 8.    Click Discover to display the Discovery Progress page. The time it takes discovery to finish depends on many factors, such as the criteria specified and the configuration of the IT environment. Note Computers that are already managed by the management group will not be returned by the wizard. 9.    On the Select Objects to Manage page, do the following: a.    Select the computers that you want to be agent-managed computers. b.    In the Management Mode list, click Agent and then click Next. Note Computer Discovery shows virtual nodes of clusters. Do not select any virtual nodes to be managed. 10.    On the Summary page, do the following: a.    Leave the Agent installation directory set to the default of %ProgramFiles%\System Center Operations Manager 2007 or type an installation path. Important If a different Agent installation directory is specified, the root of the path must exist on the targeted computer or the agent installation fails. Subdirectories, such as OM2007\Agent, are created if they do not exist. b.    Leave Agent Action Account set to the default, Local System, or select Other and type the User name, Password, and Domain. The Agent Action Account is the default account that the agent will use to perform actions. For more information about Operations Manager 2007 accounts, see the Operations Manager 2007 Security Guide. c.    Click Finish. 11.    In the Agent Management Task Status dialog box, the Status for each selected computer changes from Queued to Success; the computers are ready to be managed. Note If the task fails for a computer, click the targeted computer. The reason for the failure is displayed in the Task Output text box. 12.    Click Close.

Use the Agent Setup Wizard

Use the following procedure to deploy the Operations Manager 2007 agent with the MOMAgent.msi setup wizard.

Before you use the setup wizard, ensure the following:

Procedures

To deploy the Operations Manager 2007 agent with the Agent Setup Wizard

1.    Use local administrator privileges to log on to the computer where you want to install the agent. 2.    On the Operations Manager 2007 installation media, double-click the SetupOM.exe file. 3.    On the Start page, select Install Operations Manager 2007 Agent. 4.    On the Welcome page, click Next. 5.    On the Destination Folder page, leave the installation folder set to the default, or click Change and type a path, and then click Next. 6.    On the Management Group Configuration page, do one of the following: Leave the Specify Management Group information check box selected, and then click Next. Clear the Specify Management Group information check box if management group information has been published to Active Directory Domain Services, and then click Next. Note Step 7 is bypassed by the Agent Setup Wizard if the Specify Management Group information check box is cleared. 7.    On the Management Group Configuration page, do the following: a.    Type the Management Group Name and Management Server name. Note To use a gateway server, enter the gateway server name in the Management Server text box. For more information about gateway servers, see the Operations Manager 2007 Security Guide. b.    Type the Management Server Port, or leave the default 5273. c.    Click Next. 8.    When the Agent Action Account page appears, leave it set to the default of Local System, or select Domain or Local Computer Account, type the User Account, Password, and Domain or local computer, and then click Next. Note For information about Operations Manager 2007 accounts, see the Operations Manager 2007 Security Guide. 9.    On the Ready to Install page, review the settings and then click Install to display the Installing Systems Center Operations Manager Agent page. 10.    When the Completing the Systems Center Operations Manager Agent Setup Wizard page appears, click Finish.

Use the Command Line to Deploy Agents

You can use the MOMAgent.msi executable to deploy agents from the command line. Deploying agents from the command line is also referred to as a manual install.

Before you begin deployment, ensure the following:

MOMAgent.msi can be found in the Operations Manager 2007 installation media and the Management Server installation directory.

The command-line example uses Active Directory Domain Services to assign computers to management groups.

Procedures

To deploy the Operations Manager 2007 agent from the command line

1.    Log onto the computer where you want to install the agent by using an account with local administrator privileges. 2.    Open a command window. 3.    Run the following command: %WinDir%\System32\msiexec.exe /i \\path\Directory\MOMAgent.msi /qn USE_SETTINGS_FROM_AD=0 MANAGEMENT_GROUP=MG1 MANAGEMENT_SERVER_DNS=MS1.Domain1.net SECURE_PORT=Port Number ACTIONS_USE_COMPUTER_ACCOUNT=0 ACTIONSUSER=AgentAction ACTIONSDOMAIN=Domain1 ACTIONSPASSWORD=Password#2007 where:   USE_SETTINGS_FROM_AD=0 Indicates that management group settings properties will be set on the command line MANAGEMENT_GROUP=MG1 Sets the management group the computer will be managed by to MG1. MANAGEMENT_SERVER_DNS=MS1.Domain1.net Sets the management server FQDN to MS1.Domain1.net (). To use a gateway server, enter the gateway server FQDN as MANAGEMENT_SERVER_DNS. Important If the computer’s DNS and Active Directory names differ, the MANAGEMENT_SERVER_AD_NAME property would also need to be set to the fully qualified Active Directory Domain Services name. SECURE_PORT Sets the health service port number. ACTIONS_USE_COMPUTER_ACCOUNT=0 Sets the Agent Action account to a specified user account, instead of to Local System. ACTIONSUSER=AgentAction Sets the Agent Action account to AgentAction. ACTIONSDOMAIN= Domain1 Sets the Agent Action account domain to Domain1. ACTIONSPASSWORD= Password#2007 Sets the Agent Action account password to Password#2007.

Use Active Directory to Assign Computers

You can use Active Directory Domain Services to assign agent-managed computers to management groups. To assign computers to management groups by using Active Directory Domain Services:

Note

Regardless of whether Active Directory Domain Services is used to assign computers to a management group, agent-managed computers and their root management server and secondary management server must be in the same domain or in two-way trusted domains, or a gateway server must be used. For more information about gateway servers, see the Operations Manager 2007 Security Guide.

Configuring agents to get their management group information from Active Directory Domain Services is also helpful if your organization uses images to deploy computers. For example, add the Operations Manager 2007 agent to the SQL Server 2005 image and configure the agent to get its management group information from Active Directory. When you initialize a new server running SQL Server 2005 from an image, the server is automatically configured to be managed by the appropriate Operations Manager 2007 management group and download the applicable management packs.

When Active Directory Domain Services assigns computers to Operations Manager 2007 management groups, the following phrases are used:

1.    A domain administrator uses MOMADAdmin.exe to create an Active Directory Domain Services container for an Operations Manager 2007 management group in the domains of the computers it will manage. The Active Directory Domain Services security group that is specified when you are running MOMADAdmin.exe is granted read and delete child permissions to the container. By creating a container this way, Operations Manager administrators are given the necessary permission to add management servers to the container and assign computers to them, without needing to be domain administrators.

2.    An Operations Manager administrator assigns computers to the root management server and secondary management server. For more information, see How to Use Active Directory to Assign Computers to Operations Manager 2007 Management Servers in the next section.

3.    The Operations Manager 2007 agent is deployed to the computers that you want and configured to get its management group information from Active Directory by using MOMAgent.msi. See Use the Command Line to Deploy Agents for information.

Note

Active Directory Integration is disabled for agents that were installed from the Operations console. By default, Active Directory Integration is enabled for agents installed manually by using MOMAgent.msi. To disable Active Directory Integration for manual installations, use the command-line parameter USE_SETTINGS_FROM_AD=0 as it is explained in Use the Command Line to Deploy Agents.

How to Use Active Directory to Assign Computers to Operations Manager 2007 Management Servers

The Operations Manager 2007 Agent Assignment and Failover Wizard creates an agent assignment rule that uses Active Directory Domain Services to assign computers to a management group and assign the computers’ primary management server and secondary management servers. Use the following procedures to start and use the wizard.

Note

The Agent Assignment and Failover Wizard does not deploy the agent. You must deploy the agent to the computers by using MOMAgent.msi.

Changing the agent assignment rule can result in computers no longer being assigned to, and therefore monitored by, the management group. The state of these computers will change to critical, because the computers no longer send heartbeats to the management group. These computers can be deleted from the management group and, if the computer is not assigned to other management groups, the Operations Manager 2007 agent can be uninstalled.

To start the Operations Manager 2007 Agent Assignment and Failover Wizard

1.    Log on to the Operations console with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    Click the Administration button. Note When you run the Operations console on a computer that is not a management server, the ConnectToServer dialog box appears. In the Servername text box, type the name of the Operations Manager management server that you want the Operations console to connect to. In the EnterCredential dialog box, type a Username, Password, and Domain for the management group. 3.    In the Administration pane, expand Administration, expand DeviceManagement, and then click ManagementServers. 4.    In the Management Servers pane, right-click the management server or gateway server to be PrimaryManagementServer for the computers that are returned by the rules you will create in the following procedure, and then click Properties. 5.    In the ManagementServerProperties dialog box, click the AgentManagement tab, and then click Add to start the Agent Assignment and Failover Wizard.

To use the Operations Manager 2007 Agent Assignment and Failover Wizard to assign computers to a management group

1.    In the Agent Assignment and Failover Wizard, on the Introduction page, click Next. Note The Introduction page does not appear if the wizard has been run and Do not show this page again was selected. 2.    On the Domain page, do the following: Note To assign computers from multiple domains to a management group, run the Agent Assignment and Failover Wizard for each domain. Select the domain of the computers from the Domain name drop-down list. The management server must be able to resolve the domain name. Important The management server and the computers that you want to manage must be in two-way trusted domains. Set Select Run As Profile to the Run As profile associated with the Run As account that was provided when MOMADAdmin.exe was run for the domain. The default account that is used to perform agent assignment is the computer account for the root management server, also referred to as the Active Directory Based Agent Assignment Account. If this was not the account that was used to run MOMADAdmin.exe, select Use a different account to perform agent assignment in the specified domain, and then select or create the account from the Select Run As Profile drop-down list. Note For more information about Run As Profiles and Run As Accounts, see the Operations Manager 2007 Security Guide. 3.    On the Inclusion Criteria page, either type the LDAP query for assigning computers to this management server in the text box and then click Next, or click Configure. If you click Configure, do the following: a.    In the Find Computers dialog box, type the criteria that you want to use for assigning computers to this management server. b.    Click OK, and then click Next. Note The following LDAP query will return computers with a name starting with MsgOps, (&(sAMAccountType=805306369)(objectCategory=computer)(cn=MsgOps*)) For more information about LDAP queries, see http://go.microsoft.com/fwlink/?LinkId=73366. 4.    On the Exclusion Rule page, type the FQDN of computers that you explicitly want to prevent from being managed by this management server, and then click Next. Important You must separate the computer FQDNs that you type with a semicolon, colon, or a new line (CTRL+ENTER). 5.    On the Agent Failover page, either select Automatically manage failover and click Create or select Manually configure failover. If you select Manually configure failover, do the following: a.    Clear the check boxes of the management servers to which you do not want the agents to fail over. b.    Click Create. Note With the Manually configure failover option, you must run the wizard again if you subsequently add a management server to the management group and want the agents to fail over to the new management server. 6.    In the Management Server Properties dialog box, click OK. Note It can take up to one hour for the agent assignment setting to propagate in Active Directory Domain Services.

Process Manual Agent Installations in Operations Manager 2007

Manual installation of an agent refers to the process of running MOMAgent.msi locally on a computer that is to host an Operations Manager 2007 agent. When it is installed, the agent will attempt to join the specified management group by contacting a specified management server. You can use security settings at both the management group and the management server level to configure how requests from manually installed agents will be processed.

The following three options are available to process manually installed agents.

Option	Action
Reject new manual agent installations	Designates that all requests from a manually installed agent will be denied by Operations Manager 2007. This is the most secure setting and is selected by default.
Review new manual agent installations in pending management view	Designates that all requests from a manually installed agent will be directed to the Pending Management node before being allowed to join the management group. An administrator must first review the request and manually approve the agents’ request.
Auto-approve new manually installed agents	This option is available only if Review new manual agent installations in pending management view has been selected. This setting causes Operations Manager 2007 to automatically allow any manually installed agent to join the management group. This is the least secure option.

Important

A management group or management server must be configured to accept agents that are installed with MOMAgent.msi or they will be automatically rejected and therefore not displayed in the Operations console. If a management group is configured to accept manually installed agents, the agents will display in the console approximately one hour after they are installed.

The following procedures show you how to configure security settings for manual agent installations.

How to configure security for manual agent installations for the management group

Use the following procedure to configure a management group to accept or deny agents that are installed manually.

To configure manual agent installations settings for a management group

1.    Log on to the Operations console with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    Click the Administration button. Note When you run the Operations console on a computer that is not a management server the Connect To Server dialog box will appear. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, and then click Settings. 4.    In the Settings pane, expand Type: Server, right-click Security, and then click Properties. 5.    In the Global Management Server Settings – Security dialog box, on the General tab, do one of the following: To maintain a higher level of security, select Reject new manual agent installations, and then click OK. To configure for manual agent installation, click Review new manual agent installations in pending management view, and then click OK. For more information about manual agent installations, see the How to approve a pending agent installation section later in this topic. Optionally, select Auto-approve new manually installed agents.

How to override manual agent settings on a management server

Use the following procedure to override the management group Manual Agent Installs setting and configure the setting for a specific management server.

To override the manual agent installs setting for a management server

1.    Log on to the Operations console with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    Click the Administration button. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box appears. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, expand Device Management, and then click Management Servers. 4.    In the results pane, right-click the management server that you want to view the properties of, and then click Properties. 5.    In the Management Server Properties dialog box, click the Security tab. 6.    On the Security tab, do the following: To maintain a higher level of security, select Reject new manual agent installations, and then click OK. To configure for manual agent installation, click Review new manual agent installations in pending management view, and then click OK. Optionally, select Auto-approve new manually installed agents. 7.    Click OK.

How to approve a pending agent installation

Use the following procedure to approve an Operations Manager 2007 agent installed for a management group with MOMAgent.msi. This procedure is not needed if the management group has been configured to automatically approve manually installed agents.

To approve a pending agent installation

1.    In the Operations console, click Administration. 2.    Click Administration, expand Administration, expand Device Management, and then click Pending Management. 3.    In the Pending Management pane, select computers in Type: Manual Agent Install. 4.    Right-click the computers, and then click Approve. 5.    In the Manual Agent Install dialog box, click Approve. The computers now appear in the Agent Managed node and are ready to be managed. Note Rejected agents remain in Pending Management until the agent is uninstalled for the management group.

Work with Agents

After you have installed agents on the managed computers in your environment and configured Operations Manager to manage them, Operations Manager begins collecting monitoring data as soon as you import management packs (as discussed in How to Import a Management Pack in Operations Manager 2007 [OpsMgr07]). Aside from managing the data collected, there are a number of administrative tasks regarding agents. The following sections discuss those tasks.

Understanding Agent States

You can view the state (or health) of an agent in the Agent Health State View. The agent state is relayed by the Health Service Watcher, which monitors the status of agents. You can get more information about the state of an agent by going to the Health Service Watcher view.

An agent can have one of the following states:

State	Description
Healthy – green check	The agent is running normally.
Critical – red check	There is a problem on the agent.
Unknown – gray agent. The check mark and agent name are grayed out.	The health service watcher on the RMS that is watching the health service on the monitored computer is not receiving heartbeats from the agent anymore.  It had been receiving them previously (and it was reported as healthy), but now it is not. This also means that the management servers are no longer receiving any information from the agent at all. The computer running the agent might be down, or there might be connectivity issues. You can find more information on the Health Service Watcher view.

Heartbeat and Heartbeat Failure Settings in Operations Manager 2007

An agent sends a packet of data to its management server on a periodic basis; by default once every 60 seconds. This packet of data is called the heartbeat. By default, a management server can tolerate three missed heartbeats. If the management server registers four missed heartbeats, the management server will attempt to diagnose the problem by pinging the agent computer. If the ping is successful, an alert will be generated against the health service on the agent computer. If the ping is unsuccessful, an alert will be generated indicating that the computer is no longer available.

If the management server and the agent are separated by a slow connection, it might be normal for three minutes to pass without the management server receiving a heartbeat. To prevent unnecessary alerts, you can increase the number of missed heartbeats that a management server will tolerate.

It is also possible that you might be monitoring critical applications in your environment and service-level agreements might not allow waiting three minutes before alerts are generated. In this situation, you can decrease the heartbeat interval thus increasing how often an agent sends a heartbeat.

There are two settings you can adjust that relate to the heartbeat: heartbeat interval and number of missed heartbeats. Heartbeat interval refers to how often an agent sends a heartbeat. Number of missed heartbeats refers to how many heartbeats a management server will tolerate before running a diagnostic ping. Heartbeat interval and number of missed heartbeats can be configured at a global level affecting every agent and management server in the management group. In addition, the number of missed heartbeats can be overridden at the management server level and heartbeat interval can be overridden at the agent level.

In addition to using these options for failure settings, you also have the option of disabling heartbeat monitoring for all agents or for specified agents:

Global Heartbeat Settings

The following heartbeat settings are set at a global level and affect all management servers and agents in the management group.

How to Globally Change the Heartbeat Interval

The following procedure shows how to change the heartbeat interval at the global level. Changes made in this procedure will affect all the agents in the management group.

To configure agent heartbeat interval settings

1.    Log on to the computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    In the Operations console, click the Administration button. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box appears. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, and then click Settings. 4.    In the Settings pane, expand Type: Agent, right-click Heartbeat, and then click Properties. 5.     In the Global Agent Settings – Heartbeat dialog box, on the General tab, enter a value in the Heartbeat interval box to specify how often an agent generates a heartbeat, and then click OK. Note The maximum value is 86,400 seconds (1 day). The minimum value is 5 seconds.

How to Globally Change the Number of Missed Heartbeats a Management Server Will Tolerate

The following procedure shows how to change the number of missed heartbeats at the global level. Changes made in this procedure affect all the management servers in the management group.

To change the number of missed heartbeats a management server will tolerate

1.    Log on to the Operations console with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    Click the Administration button. Note When you run the Operations console on a computer that is not a management server the Connect To Server dialog box will appear. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, and then click Settings. 4.    In the Settings pane, expand Type: Server, right-click Heartbeat, and then click Properties. 5.    In the Global Management Server Settings – Heartbeat dialog box, on the General tab, in the Number of missing heartbeats allowed, enter or select the number of missing heartbeats management server will allow before it starts to ping the agent. Note The maximum value allowed for the number of missing heartbeats is 100. The minimum value allowed is 1.

Management Server- Heartbeat Settings and Agent-Specific Heartbeat Settings

The following heartbeat settings can be configured on a per-management server basis.

How to Override the Heartbeat Interval

Use the following procedure to override the agent heartbeat interval settings for a specific agent.

To override the heartbeat interval setting

1.    Log on to the Operations console with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    Click the Administration button. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box appears. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, expand Device Management, and then click Agent Managed. 4.    In the results pane, right-click the object that you want to view the properties of, and then click Properties. 5.    In the Agent Properties dialog box, select Override global server settings. 6.    Change the Heartbeat interval. The maximum value allowed for the heartbeat interval is 86,400 seconds (1 day). The minimum value allowed is 5 seconds. 7.    Click OK.

How to Override the Number of Missed Heartbeats a Management Server Will Tolerate

Use the following procedure to override the management group heartbeat failure setting and configure the number of missed heartbeats a specific management server will allow for an agent before it changes the state of the respective computer.

To override the number of missed heartbeats

1.    Log on to the Operations console with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    Click the Administration button. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box appears. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, expand Device Management, and then click Management Servers. 4.    In the Management Server Properties dialog box, click the Heartbeat tab. 5.    On the Heartbeat tab, do the following: a.    Select Override global server settings. b.    Change the Number of missing heartbeats to the number that you want. 6.    Click OK.

Disabling Heartbeat Monitoring

You can disable heartbeat monitoring for all agents or for specified agents.

To disable monitoring for all agents

1.    Click Authoring to open the Authoring area. 2.    Expand Management Pack Objects, and then click Monitors. 3.    Find and right-click the Health Service Heartbeat Failure monitor for Health Service Watcher (Agent). Note You can also use Find Now to find the monitor. 4.    On the shortcut menu, point to Overrides, point to Disable the Monitor, and then click For all objects of the type: Health Service Watcher (Agent). 5.    Expand Management Pack Objects, and then click Rules. 6.    Find and right-click Heartbeat Failure – Success under Health Service Watcher Group (Agent). 7.    On the shortcut menu, point to Overrides, point to Disable the Rule, and then click For all objects of the type: Health Service Watcher (Agent). 8.    Repeat the steps 6 through 7 to disable the rules Heartbeat Failure – Warning and Heartbeat Failure – Error.

To disable monitoring for a subset of managed systems, create a group by using the Create Group Wizard. For instance, to disable monitoring for the systems Server01.contoso.com, Server78.contoso.com, and Server99.contoso.com, create a group called Heartbeat Monitor Disabled Agents containing members of the type Health Service Watcher Group (Agent) and add the systems to that group.

For information about creating groups, see How to Create Groups in Operations Manager 2007.

To disable monitoring for a group of agents

1.    Click Authoring to open the Authoring area. 2.    Expand Management Pack Objects, and then click Monitors. 3.    Find and right-click the Health Service Heartbeat Failure monitor for Health Service Watcher (Agent). 4.    Click Authoring to open the Authoring area. 5.    Expand Management Pack Objects and click Monitors. 6.    Find and right-click the Health Service Heartbeat Failure monitor for Health Service Watcher (Agent). Note Use Find Now, if necessary, to find the monitor. 7.    On the shortcut menu, point to Overrides, point to Disable the Monitor and then click For all objects of the type: Health Service Watcher (Agent). 8.    In the Select Object dialog box, click the group to be used, in this example, Hearbeat Monitor Disabled Agents, and then click OK. 9.    Expand Management Pack Objects, and then click Rules. 10.    Find and right-click Heartbeat Failure – Success under Health Services Watcher Group (Agent). 11.    Right-click, point to Overrides, point to Disable the Rule, and then click For a group. 12.     In the Select Object dialog box, click the group to be used, in this example, Heartbeat Monitor Disabled Agents, and then click OK. 13.    Click Yes to confirm. 14.    Repeat the steps 7 through 13 to disable the rules Heartbeat Failure-Warning and Heartbeat Failure – Error.

Configure an Agent to Report to More Than One Management server

Use the following procedure to make an Operations Manager 2007 agent a member of multiple management groups, also referred to as multihoming. For example, an agent can be configured to report Active Directory data to the Networking management group and Exchange data to the Messaging management group. An agent can be a member of up to four management groups.

You do not need to use the same deployment method for all of the management groups.

Note

You can also use Active Directory Domain Services to assign agents to management groups. For more information, see Use Active Directory to Assign Computers.

Procedures

To make an Operations Manager 2007 agent a member of multiple management groups

Do one of the following: a.    Run the Discovery Wizard from the Operations Manager 2007 Operations console that is connected to the new management group, select the computers that you want, and deploy the agent to them. For more information, see Using the Discovery Wizard to Deploy Agents. b.    Run MOMAgent.msi on the computers that you want, and modify the installation by adding a new management group. For more information, see Use the Agent Setup Wizard.

Use Agent-less Monitoring

Windows-based systems where an agent cannot be installed can be managed without an agent. This is called agentless management.

Note

Not all management packs support agentless management, so make sure it will serve your needs before using agentless management. In particular, the Active Directory management pack and the Exchange Server 2003 management pack do not support agentless management.

Agentless management of computers is different from Agentless Exception Monitoring. Though similar in name, Agentless Exception Monitoring is used to aggregate, view, and report on error reports that are sent by the Windows Error Reporting service.

The Discovery Wizard can find and set up systems for agentless management. The process is almost the same as for deploying. You do, however, have to select a proxy for each agentless-managed system. A proxy is a system with an agent that is used to monitor an agentless system. A management group can serve as a proxy, but this takes up system resources. A best practice is using an agent managed system as a proxy. This system must be set up for management before running the Discovery Wizard to establish agentless management.

Note

If a proxy is removed from management, its agentless systems are no longer managed.

Both the agentless-managed system and its proxy need to have access to the managing server through any firewalls. For more information about interacting with firewalls, see the Operations Manager 2007 Security Guide.

Note

When you are monitoring virtual servers on a cluster, you must deploy agents to the cluster nodes, configure them to be managed as a proxy and then monitor the virtual servers as you would monitor an agentless-managed computer.

Procedures

To configure an agent-managed computer as a proxy for agentless-managed computers

1.    In the Agent Properties dialog box, click the Security tab. 2.    On the Security tab, select Allow this agent to act as a proxy and discover managed objects on other computers, and then click OK.

To discover Windows-based computers and configure Operations Manager 2007 to manage them as agentless-managed computers

1.    Log on to the Operations console with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. Note When you run the Operations console on a computer that is not a Management Server the Connect To Server dialog box appears. In the Server name text box, type the name of the Operations Manager 2007 Management Server that you want the Operations console to connect to. 2.    Click Administration. 3.    At the bottom of the navigation pane, click Discovery Wizard. 4.    On the Introduction page, click Next. The Introduction page will be skipped if the Computer and Device Management Wizard has been run before and Do not show this page again was selected. 5.    On the Auto or Advanced? page, do one of the following: a.    Select either Automatic computer discovery or Advanced discovery. If you select Automatic computer discovery, click Next, and then go to step 6. If you select Advanced discovery, continue with the following steps. Note Automatic computer discovery scans for Windows-based computers in the domain the Root Management. You can use advanced discovery to specify criteria for the computers the wizard will return, such as computer names starting with NY. b.    In the Computer & Device Types list, select Servers & Clients, Servers Only, or Clients Only. c.    In the Management Server list, click the Management Server or gateway server to discover the computers. Note For more information about gateway servers, see the Operations Manager 2007 Security Guide. d.    If you selected Servers & Clients, you can select the Verify discovered computers can be contacted check box. This is likely to increase the success rate of agent deployment, but discovery can take longer. e.    Click Next. Note The wizard can return approximately 4,000 computers if Verify discovered computers can be contacted is selected and 10,000 computers if it is not selected. Automatic computer discovery verifies that discovered computers can be contacted. A computer that is already managed by the management group is not returned. 6.    On the Discovery Method page, you can locate the computers that you want to manage by either scanning or browsing Active Directory or by typing the computer names. If you want to scan, do the following: a.    Select Scan Active Directory, if it is not already selected, and then click Configure. b.    In the Find Computers dialog box, type the criteria that you want to use for discovering computers, and then click OK. c.    In the Domain list, click the domain of the computers that you want to discover. If you want to browse Active Directory or type the computer names, do the following: Select Browse for, or type-in computer names, click Browse, specify the names of the computers that you want to manage, and then click OK. In the Browse for, or type-in computer names box, type the computer names, separated by semi-colon, comma, or a new line [ENTER]. 7.    Click Next, and then on the Administrator Account page, do one of the following: Select Use selected Management Server Action Account, if it is not already selected, and then click Discover. Select Other user account, type the User name and Password, and then select the Domain from the list. If the User name is not a domain account, select This is a local computer account, not a domain account. Important The account must have administrative privileges on the targeted computers. If This is a local computer account, not a domain account is selected, the Management Server Action Account will be used to perform discovery. For more information about Operations Manager 2007 accounts, see the Operations Manager 2007 Security Guide. 8.    Click Discover to display the Discovery Progress page. The time it takes discovery to finish depends on many factors, such as the criteria that are specified and the configuration of the IT environment. 9.    On the Select Objects to Manage page, do the following: a.    Select the that computers you want to manage as agentless-managed computers. b.    In the Management Mode list, click Agentless. c.    Click Change, select the Proxy Agent that you want to use, click OK, and then click Next. Important An agentless-managed computer places greater resource requirements on the management server than an agent-managed computer. Therefore, an agent-managed computer that is configured as a proxy is recommended for managing agentless-managed computers. 10.    On the Summary page, click Finish. The computers will appear in the Agentless Managed node of the Administration pane in the Operations console and are ready to be managed.

Investigating and Resolving Alerts

Operations Manager 2007 displays alerts in the Operations console and the Web console as specified by monitors and rules. Any alert is an indication of an issue that has occurred somewhere in your environment. Individual alerts can pertain to individual monitored devices, such as a malfunctioning hard drive on a computer to an issue with a distributed application, such as Exchange or Active Directory.

When you are addressing issues with alerts, you must consider:

The following topics provide detailed information about resolving alerts:

Investigate Alerts

You can review and investigate alerts in the Monitoring pane of Operations console or the Web console. The Web console displays the same alert information as the Operations console, but provides fewer tools to deal with the alert, as it does not support the Tasks feature.

To view an alert

1.    In the Operations console, click Monitoring. 2.    In the Monitoring pane, expand Monitoring, and then click Active Alerts. 3.    In the Active Alerts pane, click the alert to highlight it.

Operations Manager displays the Alert Details in the details pane at the bottom of the screen. Details include which monitor is involved and information about the alert and what can cause it.

The Actions pane on the right of the screen contains links to to tools and scripts that can be used to diagnose and resolve the alert. Click Actions on the toolbar to display the Actions pane if the pane is not visible. The Actions pane includes links to the settings of the monitor, the Health Explorer, controls for Maintenance Mode, Tasks for the monitor, and additional resources and help.

Using the Health Explorer

Use Health Explorer to find out what monitor is reacting and review knowledge about the monitor and possible causes. Click the alert to highlight it. The Health Explorer link under Alert Actions becomes active.

By default, when the Health Explorer window opens, all monitors in a failed state are expanded. If a monitor contains other monitors, as in the case of a roll-up monitor, Health Explorer shows all monitors in a hierarchical layout, displaying monitoring data for all dependent services and applications. To view more information about any dependent monitor, you can right-click that monitor, and then click Monitor Properties to open another Health Explorer window.

For more information about Health Explorer, see Operations Manager 2007 Help.

Using Tasks

In the Actions pane on the right of the screen, the Operations console provides tasks to troubleshoot individual alerts.

Note

If the Actions pane is not displayed, click Actions to display it.

Click an alert to highlight it to see tasks for that alert. Click a task to run the task.

Different alerts, which are raised by different monitors, offer different tasks for investigating and resolving the alert. For some examples of using tasks, see the Resolving a Heartbeat Alert section.

Closing Alerts

Monitors can be configured to automatically close alerts that have been resolved. You also have the option of manually closing an alert.

To view an alert

1.    In the Operations console, click Monitoring. 2.    In the Monitoring pane, expand Monitoring, and then click Active Alerts. 3.    In the Active Alerts pane, right-click the alert, and then click Close Alert. Note Select multiple alerts by pressing and holding down the CTRL key when clicking alerts.

Using Monitor Properties

After you investigate the cause of an alert, you may be able to improve the process of dealing with similar alerts.

You can record knowledge about the alert in the Company Knowledge tab. You can view and edit company knowledge by highlighting an alert and then clicking View or edit the settings of the monitor and clicking the Company Knowledge tab.

You can also create tasks to diagnose and recover from alerts. Diagnostic and recovery tasks can run automatically when an alert is created. You can manage diagnostic and recovery tasks by highlighting an alert and then clicking View or edit the settings of the monitor and clicking the Diagnostic and Recovery tab.

Overriding a Monitor

You can use overrides to refine settings of a monitoring object in Operations Manager 2007. As you fine tune your monitors, many useless alerts will be avoided.

To override a monitor

1.    In the Operations console, click the Authoring button. Note When you run the Operations console on a computer that is not a management server the Connect To Server dialog box will display. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 2.    In the Authoring pane, expand Management Pack Objects and then click Monitors. 3.    In the details pane, expand an object type completely, and then click a monitor. 4.    On the Operations Manager toolbar, click Overrides, and then point to Override the Monitor. You can choose to override this monitor for objects of a specific type or for all objects within a group. After you choose which group of object type to override, the Override Properties dialog box opens, enabling you to view the default settings contained in this monitor. You can then choose whether to override each individual setting contained in the monitor. Note If the Overrides button is not available, make sure you have selected a monitor and not a container object in the Monitors pane. 5.    Click to place a check mark in the Override column next to each setting that you want to override. When you complete your changes, click OK.

Investigate Alert Storms

A large and sudden increase in the number of alerts is called an alert storm. An alert storm can be a symptom of massive changes of some kind within your management group, such as catastrophic failure of networks. An alert storm can also be a symptom of configuration issues within Operations Manager 2007.

Installing new or updated management packs can give rise to an alert storm. Monitors in a management pack begin working as soon as the management pack has been imported. Use best practices in importing management packs to minimize alert storms.

Finding Alert Storms

For general, real-time monitoring of alerts, use the Active Alerts view. Make sure Scope is not active and hiding alerts.

Check for large numbers of alerts when your network undergoes changes. Monitor closely when you install a new management pack.

Operations Manager 2007 offers reports that can be useful in identifying alert storms. From an Operations console with access to a Reporting Server, look at the Microsoft Generic Report Library. The reports Most Common Alerts and Most Common Events help identify high volume alerts.

Modifying Monitors and Rules

If you are getting a large number of alerts that do not point to issues in your managed systems, you need to modify the monitors or rules that create those alerts.

View active alert details in the Monitoring pane. Alert Details specifies the monitor or rule for an alert.

Modify the monitor using overrides. The procedure for overriding rules is the same as monitors. See how your overrides affect the amount of alerts and continue to fine-tune the monitors as necessary.

About Suppressed Alerts

Rules offer the option of suppressing duplicate alerts. A suppressed alert is not displayed in Operations console.

Operations Manager 2007 suppresses only duplicate alerts as defined by the Alert suppression criteria. Fields stated in the suppression criteria must be identical for the alert to be considered a duplicate and suppressed. An alert must be created by the same rule and be unresolved to be considered a duplicate.

Resolve a Heartbeat Alert

The Health Service sends a heartbeat to a management server to verify that the system is still responding. When a specified number of heartbeats fail to arrive, Operations Manager 2007 displays an alert.

This section shows how to investigate a Health Service Heartbeat Failure alert as an example. Different alerts have different causes and different resolutions.

If you want to walk through these procedures, you can cause this alert by disabling the OpsMgr Health Service on a test system.

To cause a Health Service Heartbeat Failure for testing

1.    On a system with an agent installed, open Control Panel. 2.    Double-click Administrative Tools. 3.    Double-click Services. 4.    Right-click OpsMgr Health Service, and then click Stop. Note Use this same procedure, selecting Start in step 4, when you are done testing.

How to Investigate Agent Heartbeat Issues

The Monitoring pane displays active alerts. Looking at an alert provides information and tools to investigate.

To investigate an active alert

1.    Open Operations console by click Start, click Programs, click Systems Center Operations Manager 2007, and then click Operations Console. 2.    Click Monitoring. 3.    If necessary, in the Monitoring pane, click Monitoring to expand it. 4.    Click Active Alerts to view the Health Service Heartbeat Alert. Note Depending on the heartbeat interval and the number of missing heartbeats, a few minutes may be required to see the alert. 5.    Click the alert to highlight it and read the information in the Alert Details area. The Alert Details area provides information about the alert, including a description, knowledge about cause and resolution .

How to Troubleshoot Agent Heartbeat Issues

Use the tasks in the Action pane to diagnose the cause of the alert. Different alerts have different tasks. For a Health Service Heartbeat Failure alert, the tasks deal with pinging the system and verifying or restarting the service.

To use the Action Tasks in troubleshooting

1.    If necessary, click Actions to make the Actions pane visible. 2.    In the Actions pane, under Health Service Watcher Tasks, click Ping Computer. The task opens a dialog box to display its progress. Note If the ping fails, use standard networking troubleshooting to figure out the issue with connectivity. Verify that the system is turned on. 3.    Click Close to close the dialog box. 4.    Under Health Service Watcher Tasks, click Computer Management. A Computer Management dialog box for the target system opens. 5.    Click Services and Applications to expand it. 6.    Click Services to display Services. 7.    Right-click the OpsMgr Health Service, and then click Start. Note After the connection with the agent is restored, the alert will be automatically resolved and the computer status will go back to healthy.

These steps will fix the test failure created in this topic, as well as addressing a number of possible causes of a Health Service Heartbeat Failure. If an actual failure is not resolved by these steps, use standard troubleshooting techniques to figure out the cause of the issue. For instance, the alert displayed in Active Alerts shows how old the alert is. Check for events that happened at this time to see what might have caused an issue.

Configuring the Customer Experience Improvment Program (CEIP) in Operations Manager 2007

The Microsoft Customer Experience Improvement Program (CEIP) collects information about how you use Microsoft programs and about some of the issues you might encounter. Microsoft uses this information to improve the products and features you use most often and to help solve issues. Participation in the program is strictly voluntary.

When you choose to participate in the CEIP, you configure clients with Group Policy to redirect CEIP reports to an Operations Manager 2007 management server, instead of reporting directly to Microsoft. The management servers are configured to forward these reports to Microsoft.

Important

The CEIP reports do not contain contact information about you or your organization, such as names or address.

The CEIP reports forwarded from your organization to Microsoft are combined with CEIP reports from other organizations and individual customers to help Microsoft solve issues and improve the Microsoft products and features customers use most often. For more information about the CEIP, see http://go.microsoft.com/fwlink/?linkid=75040.

Use the following procedure to configure CEIP settings. The management server must have access to the Internet to participate in the program.

Important

CEIP is a component of the Client Monitoring feature of Operations Manager 2007. Client Monitoring must be enabled on at least one management server and managed computers to participate in the CEIP. For information about enabling the Client Monitoring feature of Operations Manager 2007, see Configuring Client Monitoring in this guide. After a management server has been configured for client monitoring, all agents that are participating in CEIP should be configured via Group Policy to send their CEIP data to that management server.

To configure the CEIP settings for Operations Manager 2007

1.    Log on to a management server with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    In the Operations console, click the Administration button. Note When you run the Operations console on a computer that is not a management server the ConnectToServer dialog box will display. In the Servername text box, type the name of the Operations Manager 2007 management server you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, and then click Settings. 4.    In the Settings pane, expand Type: General, right-click Privacy, and then click Properties. 5.    In the Global Management Server Group Settings – Privacy dialog box, on the CEIP tab, click Join the Customer Experience Improvement Program to join the CEIP program or click I don’t want to join the program at this time to decline participation. Note You can click Tell me more about the program to view information about the CEIP program, including the privacy policy.

Configuring Operational Data Reports in Operations Manager 2007

The Microsoft Customer Experience Improvement Program (CEIP) collects information about how you use Microsoft programs and about some of the issues you might encounter. Microsoft uses this information to improve the products and features you use most often and to help solve issues. Participation in the program is strictly voluntary.

During setup of Operations Manager 2007 Reporting, on the Operational Data Reports page, you had the option to join CEIP. If you elected to join CEIP, Operations Manager 2007 Reporting collects a summary of how Operations Manager 2007 is being used and sends reports to Microsoft on a weekly basis. Microsoft uses these reports to improve the quality of its Management Packs and Operations Manager 2007. You can view the contents of these Operational Data Reports by creating a Microsoft ODR Report.

Note

Before configuring operational data reports, make sure that Operations Manager 2007 Reporting is installed, and that the Management Server has access to the Internet so that reports can be sent to Microsoft.

To configure the operational data reports settings

1.    Log on to the computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 Management Group. 2.    In the Operations console, click the Administration button. Note When you run the Operations console on a computer that is not a Management Server, the Connect To Server dialog box displays. In the Server name text box, type the name of the Operations Manager 2007 Management Server that you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, and then click Settings. 4.    In the Settings pane, expand Type: General, right-click Privacy, and then click Properties. 5.    In the Global Management Server Settings – Privacy dialog box, on the Operational Data Reports tab, click Yes, send operational data reports to Microsoft (recommended) to send reports or click No, don’t send operational data reports to Microsoft to decline participation. 6.    Click OK.

During setup of Operations Manager 2007 Reporting, on the Operational Data Reports page, you had the option to join CEIP. If you elected to join CEIP, Operations Manager 2007 Reporting collects information about your installation of Operations Manager 2007 and sends reports to Microsoft on a weekly basis. You can view the contents of these Operational Data Reports by creating a Microsoft ODR Report.

To create a Microsoft ODR Report

1.    Log on to the computer with an account that is a member of the Operations Manager Report Operators role for the Operations Manager 2007 Management Group. 2.    In the Operations console, click the Reporting button. Note When you run the Operations console on a computer that is not a Management Server, the Connect To Server dialog box displays. In the Servername text box, type the name of the Operations Manager 2007 Management Server that you want the Operations console to connect to. 3.    In the Reporting pane, expand Reporting, and then click MicrosoftODRReport Library. 4.    In the Microsoft ODR Report Library Reports pane, right-click one of the reports (for example, Management Packs), and then click Open. 5.    In the Report view, in the Parameter area, click the down arrow in the From box, point to This week, and then click Sunday. 6.    Click the down arrow in the To box, point to Thisweek, and then click Saturday. 7.    Click Run to display the ODR Report. 8.    Click Close to close the report.

Configure Client Monitoring in Operations Manager 2007

Use the following procedures to configure a management server for the server component of the Client Monitoring feature of Operations Manager 2007.

Important

If you plan to configure the management server to forward error reports to Microsoft and receive links to available solutions for those errors or participate in the Customer Experience Improvement Program (CEIP), you must first configure the management server’s proxy settings if it uses a proxy server to access the Internet. For more information, see the Configuring Internet Proxy Settings for a management server section.

The Operations Manager 2007 Client Monitoring Configuration Wizard is used to configure the server component of Client Monitoring on an Operations Manager 2007 management server. To configure the server component of Client Monitoring on multiple management servers, run the wizard once for each management server. An example of when you might configure multiple management servers for Client Monitoring is if the connection between specific clients and management servers is less expensive.

Important

The management server and error reporting clients must be in the same or fully trusted domains.

To open the Client Monitoring Configuration Wizard

1.    Log on to the computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    In the Operations console, click the Administration button. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box displays. In the Server name text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, expand Device Management, and then click Management Servers. 4.    In the management servers pane, right-click the management server on which you want to enable Client Monitoring, and then click Configure Client Monitoring. This will start the Client Monitoring Configuration Wizard. Use the same procedure to Disable Client Monitoring on the management server. You must also disable Client Monitoring on the clients. For more information, see Configuring Clients for Client Monitoring below. Note The Configure Client Monitoring option will be unavailable if the selected computer is a gateway server.

To configure Client Monitoring using the Client Monitoring Configuration Wizard

1.    On the Introduction page of the Client Monitoring Configuration Wizard, click Next. The Introduction page will be skipped if the wizard has been run before and Do not show this page again was selected. 2.    On the Customer Experience Improvement Program page, do one of the following: Leave the default option of No if you do not want your organization to participate in the program, and then click Next. Or a.    Select Yes, if you want your organization to participate in the program. b.    Leave Use Secure Socket Layer (SSL) protocol selected if you have installed a certificate on your management server, leave Use Windows Authentication selected if you want the client computers to authenticate with the management server; otherwise, clear the options. c.    Type the appropriate Port, or leave the default of 51907, and then click Next. Important For information about installing a certificate on a management server, see the Operations Manager 2007 Security Guide at http://go.microsoft.com/fwlink/?LinkId=64017 3.    On the Configure Error Collection page, do the following: a.    Type the local or attached File Share Path, such as C:\ErrorData,for the management server that will be used to collect error reports. The files share will be created at the local path on the management server and shared with the necessary permissions. Important The file share path must be on an NTFS partition and have at least 2 GB of free disk space. It is recommended that the path is no longer than 120 characters. The file share path can be a UNC path or mapped drive letter. b.    Select Collect application errors from Windows Vista or later computers if you will be managing Windows Vista or later operating systems with Operations Manager 2007. Type the Port number, or leave the default 51906. Leave Use Secure Socket Layer protocol selected if you have installed a certificate on your management server, leave Use Windows Authentication selected if you want the client computers to authenticate with the management server; otherwise, clear the options. c.    Type the Organization Name, using no more than 22 characters, and then click Next. The Organization Name can display on computers experiencing errors and running Windows Server 2003 and earlier operating systems. 4.    On the Configure Error Forwarding page, do one of the following: Leave the Automatically forward all collected errors to Microsoft check box cleared, and then click Next. Or a.    Select Automatically forward all collected errors to Microsoft if the management server is connected to the Internet and you want to forward error reports to Microsoft and receive links to available solutions for those errors. b.    Select Detailed to help ensure Microsoft can provide a solution to the issue, or leave the default setting of Basic. c.    Click Next. 5.    On the Create File Share page, do one of the following: Select an Existing User Account from the list, and then click Next. Select Other user account, type the User name and Password, select the Domain from the list, and then click Next. Important The account must have the permissions necessary to create a file share on the path provided in step 3a. 6.    On the Create file Share: Task Status page, after the file share has been successfully created, click Next. Note To modify the Client Monitoring settings on the management server, such as the file share, you must disable and then re-enable Client Monitoring on the management server. You must also then modify the Client Monitoring Group Policy settings on the clients. 7.    On the Deploy Configuration Settings page, type or Browse to the location where you would like to save the <ServerName>.ADM file that contains the Client Monitoring Group Policy settings you have just made with the wizard, and then click Finish. Important You must use the <ServerName>.ADM file to configure clients to redirect their Client Monitoring data to the management server. For more information, see Configuring Clients for Client Monitoring below.

Configuring Internet Proxy Settings for a Management Server

Use the following procedure to configure the Internet proxy settings for an Operations Manager 2007 management server. You must configure these settings if features of Operations Manager 2007 are enabled that require the management server to communicate over the Internet. For example, you must configure these settings if the Client Monitoring feature of Operations Manager 2007 is configured to transmit or receive data from Microsoft.

To Configure the Internet Proxy Settings for an Operations Manager 2007 management server

1.    Log on to the computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    In the Operations console, click the Administration button. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box displays. In the Servername text box, type the name of the Operations Manager 2007 management server that you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, expand DeviceManagement, and then click the ManagementServers. 4.    In the results pane, right-click the management server for which you want to view the properties of, and then click Properties. 5.    In the Management Server Properties dialog box, click the ProxySettings tab. 6.    On the Proxy Settings tab, select Use a proxy server for communication with Microsoft and then do the following: Select http:// or https:// from the drop-down list, and type the name of the internet proxy server in the Address text box. Type the Port number, and then click OK.

Configuring Clients for Client Monitoring

This topic provides the procedure to configure clients for the Client Monitoring feature of Operations Manager 2007.

Important

You must first configure a management server for the server component of Client Monitoring by running the Client Monitoring Configuration Wizard as described above.

To Configure clients for Client Monitoring

1.    Run the Group Policy Object Editor (gpedit.msc) for the domain or local computer. Note For information about Group Policy, see http://go.microsoft.com/fwlink/?LinkId=70168. 2.    Enable the Turn off Windows Error Reporting policy. This policy can be found in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings. 3.    Add the Agentless Exception Monitoring (AEM) Group Policy administrative template (<ServerName>.ADM) to the domain or local computer policy. The ADM file is created when the Client Monitoring Configuration Wizard is run. 4.    Enable the AEM policies that reflect the configuration of Client Monitoring on the Operations Manager 2007 management server. The AEM policies can be found in Computer Configuration/Administrative Templates/Microsoft Applications/Microsoft Operations Manager. Note Use the same procedure to Disable the Group Policy settings, thereby disabling Client Monitoring on the clients.

Configuring Error Reporting in Operations Manager 2007

When error reporting is enabled for Operations Manager 2007 components, if an error occurs in an Operations Manager 2007 component, information about the error is anonymously reported to Microsoft. For more information about the Privacy Statement for the Microsoft Error Reporting Service, see http://go.microsoft.com/fwlink/?LinkId=64250. This information is used with error reports from other Microsoft customers to help identify and resolve common issues with Operations Manager 2007.

Note

This setting enables error reporting only for Operations Manager 2007 components. For information about enabling the Client Monitoring feature of Operations Manager 2007, which includes error reporting for the specified computers, see the Configuring Client Monitoring section in this guide.

To configure error reporting settings for Operations Manager 2007 components

1.    Log on to the computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    In the Operations console, click the Administration button. Note When you run the Operations console on a computer that is not a management server the ConnectToServer dialog box will display. In the Servername text box, type the name of the Operations Manager 2007 management server you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, and then click Settings. 4.    In the Settings pane, expand Type: General, right-click Privacy, and then click Properties. 5.    In the Global Management Server Settings – Privacy dialog box, click the Error Reporting tab, and then do one of the following: Select Automatically send error reports about this product to Microsoft without prompting the user. Select Prompt the user for approval before sending error reports to Microsoft. Note Click Tell me more about error reporting if you want to view the Privacy Statement for the Microsoft Error Reporting Service. 6.    When you have made the selection you want, click OK.

Error Transmission settings allow you to specify which error reports are sent to Microsoft and the additional diagnostic data that is included with the error reports.

To find the Error Transmission tab of the Global management server Settings – Privacy dialog box

1.    Log on to the computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 management group. 2.    In the Operations console, click the Administration button. Note When you run the Operations console on a computer that is not a management server, the Connect To Server dialog box will display. In the Server name text box, type the name of the Operations Manager 2007 management server you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, and then click Settings. 4.    In the Settings pane, expand Type: General, right-click Privacy, and then click Properties. 5.    In the Global Management Server Group Settings – Privacy dialog box, click the Error Transmission tab. Note Click Read the privacy statement to view the privacy statement.

To filter errors that are sent to Microsoft

1.    On the Error Transmission tab of the Global Management Server Group Settings – Privacy dialog box, click Filter. 2.    In the Error Forwarding Filters dialog box, select one or more of the options for sources of errors that you do not want forwarded to Microsoft, such as that come from specific computers. 3.    In the Criteria description text box, click specific, and provide the values for the criteria of errors that you do not want forwarded to Microsoft, such as computer.contoso.com. 4.    Click OK twice.

To configure diagnostic data sent to Microsoft with error reports

1.    On the Error Transmission tab of the Global Management Server Settings – Privacy dialog box, do one or more of the following: a.    Select Upload diagnostic data collection request, select the additional diagnostic data that you want to send with error reports from computers reporting errors to the management servers, and then forward from the management server to Microsoft with the error reports. b.    Set Maximum number of CAB files to send to Microsoft per error group to help Microsoft diagnose the error. 10 is the recommended number. c.    Select Display links to solutions from Microsoft on error reporting computers. A link to available solutions will display to end users after the error is first encountered and the link to the solution is downloaded to the management server. d.    Select Display links to surveys from Microsoft on error reporting computers. e.    Specify the Default solution link when no Microsoft solution is available. This could be an internal Web page for technical support, for example. 2.    Click OK.

Maintenance and Best Practices for Operations Manager

After you design, deploy and configure your Operations Manager environment, and as you start monitoring computers and devices in your organization, large amounts of data accumulates.

To protect your Operations Manager environment, and to limit service interruption, you must develop and implement a comprehensive and effective maintenance plan. An effective on-going maintenance of your Operations Manager environment can improve performance, and minimize the chances of failure.

Ensure that your maintenance plan includes:

If at any time there is an indication of a problem, it is best to respond immediately.

In This Section

Managing Gateway Servers in Operations Manager 2007

Managing Reporting in Operations Manager 2007

Managing Web Console Servers in Operations Manager 2007

Managing Connected Management Groups in Operations Manager 2007

Changing Passwords for Operations Manager Accounts

Identifying the Root Management Server in Operations Manager 2007

Scheduling Maintenance and Monitoring

Backing up and Restoring Operations Manager 2007 Components

Making Updates to a Operations Manager 2007 Deployment

Managing Gateway Servers in Operations Manager 2007

Operations Manager 2007 requires mutual authentication be performed between agents and Management Servers prior to the exchange of information between them. In order to secure the authentication process between the two, it is encrypted. When the agent and the Management Server reside in the same Active Directory domain or in Active Directory domains that have established trust relationships, they make use of Kerberos V5 authentication mechanisms provided by Active Directory. When the agents and Management Servers to not lie within the same trust boundary, other mechanisms must be used to satisfy the secure mutual authentication requirement.

In Operations Manager 2007, this is accomplished through the use of X.509 certificates issued for each computer. If there are many agent monitored computers, this results in a high administrative overhead for managing all those certificates. In addition, if there is a firewall between the agents and Management Servers as well, multiple authorized endpoints must be defined and maintained in the firewall rules to allow communication between them.

In order to reduce this administrative overhead, Operations Manager 2007 has a new server role called the Gateway Server. Gateway Servers are located within the trust boundary of the agents and can participate in the mandatory mutual authentication. Because they lie within the same trust boundary as the agents, the Kerberos V5 protocol for Active Directory is used. Each agent then communicates only with the Gateway Servers that it is aware of. The Gateway Servers communicate with the Management Servers.

In order to support the mandatory secure mutual authentication between the Gateway Servers and the Management Servers, certificates must be issued and installed, but only for the Gateway and Management Servers. This reduces the number of certificates required and in the case of an intervening firewall; it also reduces the number of authorized end points to be defined in the firewall rules.

As your IT environment or monitoring requirements change you may need to add or remove Gateway Servers from and Operations Manager 2007 Management Group and perform tasks on the Gateway Servers.

Determining the Health of Gateway Servers

To determine the health of a Gateway Server you must examine it from two perspectives. The first, most direct method, is to examine the health status in the Operations console and Health Explorer. This will tell you that status of the monitored components, whether or not there are any open alerts and performance data. The second, indirect method, is to be sure that data from the agents that are being monitored through the Gateway Server is being reported in a timely fashion.

Direct Method

Gateway Servers are a type of Management Server and therefore they are included in the Management Servers container under Device Management in the Administration view of the Operations console. In the details pane of this view, you can immediately see the Health State of any of Management Servers in the Management Group. By selecting any Gateway Server (or any server for that matter) and opening the context menu, you can view the properties of the server or any of the views that are available. Typically, you can directly access the Event View, Alert View, Performance View, Diagram View and State View for the selected object.

For a more comprehensive understanding of the health of a Gateway Server, open the Monitoring view and navigate to the Operations Manager, Management Server folder and select the Management Server State view object in the navigation pane. This displays the state of all Management Servers in the Management Group with Gateway Servers displayed next to the bottom by default. In the Gateway Management Server State pane, select the health status icon for the server you are interested in under the Gateway column to bring up the health state of the Gateway servers component monitors in the details pane. Typically, you will get details on the Health Service Availability, Audit Collection Availability, Configuration, Performance and Security.

Indirect Method

Gateway Servers relay monitoring data from agents to Collection Management Servers in the Management Group across trust boundaries. They also relay configuration information from the Collection Management Server to the agents that they serve. Therefore if agents that have a Gateway Server as their primary management server are reporting their data and are heartbeating, you can be sure that their Gateway Server is performing satisfactorily.

Viewing Agents by Gateway

How to view an Agents Primary Management Server

1.    Open the Operations console, and then click the Administration button. 2.    In the Administration pane, expand Administration, expand Device Management, and then click Agent Managed. 3.    Displayed in the results pane are all the agent-managed devices grouped by their Primary Management Server. 4.    Look for the Gateway Server of interest and grouped under it are all the agents that are currently using the Gateway.

Using Multiple Gateway Servers

Multiple Gateway Servers can be deployed across a trust boundary to provide redundant pathways for agents that lie across that trust boundary. Just as agents can failover between a primary and one or more secondary Management Servers, so too can they fail over between Gateway Servers. In addition, multiple Gateway servers can be used to distribute the workload of managing agentless-managed computers and managed network devices.

In addition to providing redundancy through Agent – Gateway failover, Gateway Servers can be configured to failover between Collection Management Servers in a Management Group if multiple Collection Management Servers are available.

Configuring Agent Failover Between Multiple Gateway Servers

If you have deployed multiple Gateway Servers into a domain that does not have a trust relationship established with the domain that the rest of the Management Group is in, you can configure agents to utilize those Gateway Servers as necessary. To do this, you must use the Operations Manager 2007 Command Shell.

Use the Set-ManagementServer -AgentManagedComputer command in Command Shell as shown in the following example to configure an agent to failover to multiple Gateway Servers. The commands can be run from any Command Shell in the Management Group.

To configure agent failover to multiple Gateway Servers

1.    Log on to the computer with an account that is a member of the Administrators group. 2.    On the Windows desktop, click Start, point to Programs, point to SystemCenterOperationsManager, and then click CommandShell. 3.    In Command Shell, follow the example described in the next section.

Description

The following example can be used to configure agent failover to multiple Gateway Servers.

Important

When changing the Primary Management Server of an agent, allow the agent to connect to its new Primary Management Server before making changes to its failover server. Allowing the agent to get current topology information from the new Primary Management Server prevents the agent from losing communication with all Management Servers.

Code

$primaryMS = Get-ManagementServer | where {your filter here}

$failoverMS = Get-ManagementServer | where {your filter here}

$agent = Get-Agent | where {your filter here}

Set-ManagementServer -AgentManagedComputer: $agent -ManagementServer: $primaryMS

$agent = Get-Agent | where {your filter here}

Set-ManagementServer -AgentManagedComputer: $agent -ManagementServer: $primaryMS -FailoverServer: $failoverMS

Comments

In the code example, you will need to create a filter statement for the first three commands. The following is an example of a filter command written to find the computer contoso.com that will be assigned to the $failoverMS variable:

$failoverMS = Get-ManagementServer | where {$_.Name –eq ’contoso.com’ }

The use of two Set-ManagementServer commands is to allow the agent to connect to its new Primary Management Server for configuration information before changing the failover server.

For help with the Set-ManagementServer command, type the following in the Command Shell window:

Get-help Set-ManagementServer -full

Configure a Gateway Server to Failover Between Multiple Management Servers

Use the Set-ManagementServer-GatewayManagementServer command in Command Shell as shown in the following example to configure a Gateway Server to failover to multiple Management Servers. The commands can be run from any Command Shell in the Management Group.

To configure Gateway Server failover to multiple Management Servers

1.    Log on to the Gateway Server with an account that is a member of the Administrators role for the Management Group. 2.    On the Windows desktop, click Start, point to Programs, point to SystemCenterOperationsManager, and then click CommandShell. 3.    In Command Shell, follow the example described in the next section.

Description

The following example can be used to configure Gateway Server failover to multiple Management Servers.

Code

$primaryMS = Get-ManagementServer | where {your filter here}

$failoverMS = Get-ManagementServer | where {your filter here}

$gatewayMS = Get-ManagementServer | where {your filter here}

Set-ManagementServer -GatewayManagementServer: $gatewayMS -ManagementServer: $primaryMS

$gatewayMS = Get-ManagementServer | where {your filter here}

Set-ManagementServer -GatewayManagementServer: $gatewayMS -ManagementServer: $primaryMS -FailoverServer: $failoverMS

Comments

In the code example, you will need to create a filter statement for the first three commands. The following is an example of a filter command written to find the computer contoso.com that will be assigned to the $failoverMS variable:

$failoverMS = Get-ManagementServer | where {$_.Name –eq ’contoso.com’ }

For help with the Set-ManagementServer command, type the following in the Command Shell window.

Get-help Set-ManagementServer -full

Managing Certificate Renewal for Gateway Servers and Management Servers

Eventually, the certificates that were obtained and installed on the Gateway Server and Collection Management Servers will expire and will need to be replaced with a new one. The other situation in which you will need to replace an existing certificate is if, for security reasons, the certificate has been revoked.

To do this, you will need to follow the same procedures that were used to obtain and import the certificates in the first place.See Deploying Gateway Servers in the Multiple Server, Single Management Group Scenario section of the Operations Manager 2007 Deployment Guide (http://go.microsoft.com/fwlink/?LinkId=95133). It is not necessary to rerun the Gateway Approval Tool.

Removing a Gateway Server from a Management Group

Throughout the lifecycle of your Operations Manager 2007 implementation, you may need to reprovision server hardware or otherwise modify the structure and configuration of your deployment. In the case of Gateway Servers, these types of changes could stem from the decommissioning of an untrusted domain so that monitoring is no longer required or the old server hardware is to be replaced with new hardware. To remove a Gateway Server from service, you must complete the following steps.

Overview of decommissioning a Gateway Server

1.    Configure all objects that are being managed by the Gateway Server to use a different Primary Management Server. For an agent-managed computer, this means either using another Gateway Server or a Management Server. 2.    Uninstall the Gateway Server software from the server. 3.    Delete the Gateway Server from the Management Group.

Configure Managed Objects to Use An Alternate Primary Management Server

Gateway Servers can manage three different types of objects, agent-managed computers, agentless-managed computers and network devices acting as a proxy agent.

Configuring agent-managed computers to use a different primary Management Server using the Operations Console

1.    Log on to a Management Server with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 Management Group. 2.    In the Operations console, click the Administration button. Note When you run the Operations console on a computer that is not a Management Server, the Connect To Server dialog box will display. Type the name of the Operations Manager 2007 Management Server you want the Operations console to connect to in the Server name text box. 3.    In the Administration pane, expand Administration, expand Device Management, and then click Agent Managed. 4.    In the Agent Managed pane, select the computers for which you want to change the Primary Management Server, right-click them, and then select Change Primary Management Server. Note The Change Primary Management Server option will be unavailable if Active Directory Domain Services was used to assign any of the selected computers to the Management Group. 5.    In the Change Management Server dialog box, select the desired Management Server from the list, and then click OK. The change takes effect on the agent after its next update interval.

Alternately, this configuration can be changed on the agent-managed computer itself using either of the following two procedures.

To change the Primary Management Server for agent-managed computers using the MOMAgent.msi setup wizard

1.    Log on to the agent-managed computer with an account that is a member of the administrators security group for the computer. 2.    In Add or Remove Programs, click Change for System Center Operations Manager 2007 Agent. Note The Agent Setup Wizard can also be run by double-clicking MOMAgent.msi, which is available on the Operations Manager 2007 installation media. 3.    In the Agent Setup Wizard, click Next. 4.    On the Program Maintenance page, select Modify, and then click Next. 5.    On the Management Group Configuration page, leave Specify Management Group information selected, and then click Next. 6.    In the next Management Group Configuration page, do the following: a.    Type the name of the Management Server. b.    Type the Management Server Port, or leave the default 5723. c.    Click Next. 7.    On the Ready to Install page, review the settings, and then click Install to display the Installing Systems Center Operations Manager Agent page. 8.    When the Completing the Systems Center Operations Manager Agent Setup Wizard page displays, click Finish.

To change the Primary Management Server for agent-managed computers using MOMAgent.msi from the command line

1.    Log on to the agent-managed computer with an account that is a member of the administrators security group for the computer. 2.    Open the command window. 3.    At the prompt, type the following command-line example: Important Microsoft Windows Installer public properties must be uppercase, such as PROPERTY=value. For more information about Windows Installer, see http://go.microsoft.com/fwlink/?LinkId=70004.   %WinDir%\System32\msiexec.exe /i \\path\Directory\MOMAgent.msi /qn USE_SETTINGS_FROM_AD=0 MANAGEMENT_GROUP=MG1 MANAGEMENT_SERVER_DNS=MS2.Domain1.net   4.    The preceding command-line example will reconfigure the agent to use MS2.Domain1.net as its Primary Management Server for Management Group MG1. Important If the Domain Name System (DNS) and Active Directory names for the Management Server differ, the MANAGEMENT_SERVER_AD_NAME property would also need to be set to the fully qualified Active Directory Domain Services name.

Redirecting Agentless Managed Computers and Network Devices

To change the proxy agent for agentless managed computers and network devices

1.    Log on to a Management Server computer with an account that is a member of the Operations Manager Administrators role for the Operations Manager 2007 Management Group. 2.    In the Operations console, click the Administration button. Note When you run the Operations console on a computer that is not a Management Server the Connect To Server dialog box displays. In the Server name text box, type the name of the Operations Manager 2007 Management Server that you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, expand Device Management, and then click Agentless Managed. If you are working with a network device, select Device Management and then Network Devices. 4.    In the Agentless Managed pane, select the agentless managed computers for which you want to change the proxy agent, right-click them, and then select Change Proxy Agent. Or if you are working with a network device, then in the Network Devices pane, select the network devices for which you want to change the proxy agent, right-click them, and then select Change Proxy Agent. 5.    In the Change Proxy Agent dialog box, select the computer you want to be the new proxy agent, and then click OK.

The final steps in removing a Gateway Server from a Management Group are straight forward. And consist of:

In the Operations Console, in the Administration view, under Device Management, Management Servers, select the Gateway Server, right-click it, and then click Delete.

Managing Reporting in Operations Manager 2007

The Reporting feature of Operations Manager 2007 has been enhanced for this release and focuses on customer scenarios, performance, and usability. As an administrator, you will be involved in customizing reports and setting up access to reports. Reporting makes use of an SQL database which needs to be maintained and backed up.

Managing Reporting

The Management Packs come with a variety of reports including information on alerts, availability, health, and performance. After you set up a Reporting Server and import Management Packs, you can browse available reports in the Reporting pane of the Operations console.

Note

It may take a few minutes for a report to show up after a Management Pack has been imported.

You can run standard reports from the console by entering a time frame and specifying what is to be included in the report.

To run a report from the Reporting pane

1.    Log on to the computer with an account that is a member of the Operations Manager Report Operators role for the Operations Manager 2007 Management Group. 2.    In the Operations console, click the Reporting button. Note When you run the Operations console on a computer that is not a Management Server, the Connect To Server dialog box displays. In the Servername text box, type the name of the Operations Manager 2007 Management Server that you want the Operations console to connect to. 3.    In the Reporting pane, expand Reporting and then click MicrosoftGenericReports. 4.    In the Microsoft Generic Report Library Reports pane, right-click one of the reports (for example, Availability) and then click Open. 5.    In the Report view, in the Parameter area, click the down arrow in the From box, point to This week, and then click Sunday. 6.    Click the down arrow in the To box, point to Thisweek and then click Saturday. 7.    Click Use business hours. Note You can further specify the timeframe for the report in the additional options in the Parameter area. 8.    Click Add. 9.    In the AddObject dialog box, in the ObjectName text box, type the computer name for a computer that you want to report availability, and then click Search. 10.    In the Availableitems list, click the computer you want to run a report for, click Add, and then click OK. 11.    Click Run to display the Availability Report. 12.    For a more detailed report, such as a report showing a graph for every day, click the horizontal bar graph under Availability Tracker. 13.    In the toolbar, click View, point to GoTo, and then click Back to Parent Report to return to the original report. 14.    Click Close to close the report.

You can export reports to various formats, including XML, comma separated text, TIFF, PDF, Web archive, or Excel.

To export a report

1.    After a report has been run, in the toolbar, click the File menu, point to Export, and then click the format you want to export the file to. 2.    In the SaveAs dialog box, select the folder where you want to save the report, and then click Save.

You can customize reports, save them, and schedule them to be run on a regular basis.

To save a report to favorite reports

1.    Customize a report. 2.    While viewing the new report, click the File menu, and then click Savetofavorites. 3.    In the Save to favorites dialog box, type a name for the report, and then click OK. 4.    Close the report.

Use this procedure to create a report schedule.

To create a report schedule

1.    In the Operations console, click Reporting. Note When you run the Operations console on a computer that is not a Management Server, the ConnectToServer dialog box will display. In the Servername text box, type the name of the Operations Manager 2007 Management Server you want the Operations console to connect to. 2.    In the Reporting pane, click Favorite Reports. 3.    In the Favorite Reports pane, right-click a saved report, and then click Schedule. 4.    In the Subscribe to a Report Wizard, on the Delivery Settings page, do the following: a.    Type a description in the Description text box. b.    Click the down arrow in the Delivery method list, and then click ReportServerFileShare. c.    Type a file name for the report in the File name text box. d.    Type a file path for the report in the Path text box. Note Report scheduling supports Universal Naming Convention (UNC) file names and must not end in a backslash. e.    Click the down arrow in the Render Format list, and then click the file format you want for the report. f.    Type a user name in the Username text box, and then type a password in the Password text box. Note The credentials entered must have Write user rights on the file share that was entered above. g.    Click the down arrow in the Writemode list, select the Write mode you want for subsequent files, and then click Next. 5.    In the Subscribe to a Report Wizard, on the Subscription Schedule page, do the following: a.    Select one of the Generate the report options. b.    Type a start date and start time for the reports to be generated in TheSubscriptioniseffectivebeginning list. You can also enter the date when this subscription will end in The subscription expires on list, and then click Next. 6.    In the Subscribe to a Report Wizard, on the Parameters page, specify a span of time for the report in the From and To lists. 7.    Make any other changes you need for this report, and then click Finish.

Use this procedure to set up e-mail delivery for scheduled reports.

To configure e-mail settings in the SQL Server 2005 Report Server

1.    On the Windows desktop, click Start, point to Programs, point to MicrosoftSQLServer 2005, point to ConfigurationTools, and then click ReportingServicesConfiguration. 2.    In ReportingServicesConfigurationManager, in the ReportServerInstallationInstanceSelection dialog box, click Connect. 3.    In the navigation pane, click E-mailSettings. 4.    In the E-mail Settings pane, enter the following: An e-mail address for use as the sender address in the SenderAddress text box. The address of the SMTP server that will be used to send the e-mail messages in the SMTPServer text box. 5.    Click Apply, and then click Exit.

Use this procedure to e-mail scheduled reports.

To e-mail scheduled reports

1.    Log on to the computer with an account that is a member of the Operations Manager Report Operators role for the Operations Manager 2007 Management Group. 2.    In the Operations console, click the Reporting button. Note When you run the Operations console on a computer that is not a Management Server, the Connect To Server dialog box will display. In the Server name text box, type the name of the Operations Manager 2007 Management Server you want the Operations console to connect to. 3.    In the Reporting pane, click FavoriteReports. 4.    In the Favorite Reports pane, right-click the Availability report you saved as a favorite, and then click Schedule. 5.    In the Subscribe to a Report Wizard, on the DeliverySettings page, do the following: Type a description in the Description text box. Click the down arrow in the Delivery method list, and then click Report Server E-Mail. Type an e-mail address of the destination inbox to receive reports in the To text box. You can also type e-mail addresses in the Cc, Bcc, and the Reply To text boxes. Click the down arrow in the Render Format list, and then click the file format you want for the report. Click the down arrow in the Priority list, and then select the appropriate priority. Type a subject for the e-mail in the Subject text box. Click Next. 6.    On the SubscriptionSchedule page, do the following: Select one of the Generate the report options. Type a start date and start time for the reports to be generated in TheSubscriptioniseffectivebeginning list. You can also enter the date when this subscription will end in Thesubscriptionwillend list, and then click Next. 7.    On the Parameters page, specify a span of time for the report in the From and To lists, make any other changes you need for this report, and then click Finish.

As administrator, you will probably want to find reports that capture useful history about your systems, customize those reports to your needs, save them to Favorite Reports, and schedule them to run and be made available as needed. You can save them to a Windows® SharePoint® Services server or e-mail them to designated individuals.

Managing Access to Reports

Operations Manager 2007 uses role-based security. With regard to administering Operations Manager 2007, you will need to manage users as needed. The following roles are relevant to reporting.

Includes a set of privileges designed for users who need access to Reports. Grants members the ability to view reports according to their configured scope.

Caution

Users assigned to this role have access to all report data in the Reporting Data Warehouse and are not limited by scope.

Enables the integration of SQL Server Reporting Services security with Operations Manager user roles. This gives Operations Manager Administrators the ability to control access to reports. This role can have only one member account and cannot be scoped.

Grooming

The Reporting Data Warehouse stores data for specified length of time, depending on the data (Alert, State, Event, Aem, Performance) and the aggregation type (raw data, hourly aggregations, daily aggregations). The database is set up to delete older data. Deleting the older data is called grooming.

The default settings for retention of different kinds of data is as follows:

Data Set	Aggregation Type	Days to be kept
Alert	Raw data	400
State	Raw data	180
State	Hourly aggregations	400
State	Daily aggregations	400
Event	Raw data	100
Aem	Raw data	30
Aem	Daily aggregations	400
Perf	Raw data	10
Perf	Hourly aggregations	400
Perf	Daily aggregations	400

Settings for grooming the Data Warehouse can be changed through SQL Server Management Studio.

To change grooming settings in the Reporting data warehouse

1.    On the Windows desktop, click Start, point to Programs, point to Microsoft SQL Server 2005, and then click SQL Server Management Studio. 2.    In the Connect to Server dialog box, in the ServerType list, select DatabaseEngine, in the ServerName list select the server and instance for your Reporting data warehouse (for example, computer\INSTANCE1), in Authentication list, select WindowsAuthentication, and then click Connect. 3.    In the Object Explorer pane, expand Databases, expand OperationsManagerDW, and then expand Tables. 4.    Right-click dbo.Dataset, and then click OpenTable. 5.    Locate the dataset for which you want to change the grooming setting in the DatasetDefaultName column and make note of its GUID in the DatasetId column. 6.    In the Object Explorer pane, right-click dbo.StandardDatasetAggregation and then click Open Table. 7.    In the DatasetId column, locate the dataset GUID you noted in step 5. Multiple entries of the same GUID might display. 8.    Locate the aggregation type from the list in the AggregationTypeId column by using the following values: 0 = raw, non aggregated data 10 = subhourly 20 = hourly 30 = daily After you have located the dataset and its aggregation type, scroll to the MaxDataAgeDays column, and then edit the value there to set the grooming interval.

Managing Web Console Servers in Operations Manager 2007

The Web console server provides a browser based alternative to the Monitoring pane of the Operations Manager 2007 Operations console. The Web console server is commonly used when you want to access Operations Manager 2007 Management Group monitoring data:

As your IT environment or monitoring requirements change you may need to add or remove Web console servers from an Operations Manager 2007 Management Group or perform tasks on a Web console server. For information about designing your Operations Manager 2007 Management Group, see http://go.microsoft.com/fwlink/?LinkId=95134.

Add a Web Console Server to a Management Group

Add a Web console server to an Operations Manager 2007 Management Group to provide Web-based access to monitoring data. For information about deploying a Web console server, see http://go.microsoft.com/fwlink/?LinkId=95135.

Configure Web Console to Fail Over

You can manually configure the Web console to fail over to another Root Management Server.

To configure Web Console to fail over

1.    Using Notepad, open the file Web.Config. The default location for this file is C:\Program Files\System Center Operations Manager 2007\Web Console. Note You can use any editor that saves in plain text. 2.    Change the following line to include the new Remote Management Server: <add key=”MOMServer” value=”<provide new RMS server name>” /> 3.    Save your changes.

Change the Authentication Used by a Web Console Server

A Web console server is configured at installation to use either Windows or forms-based authentication. To change the authentication used by a Web console server, you must uninstall the Web console server and reinstall it. Use Add or Remove to modify the installation of System Center Operations Manager 2007 and remove the Web console feature. For information about designing your Operations Manager 2007 Management Group, see http://go.microsoft.com/fwlink/?LinkId=95134. For information about deploying a Web console server, see http://go.microsoft.com/fwlink/?LinkId=95135.

Enable Secure Sockets Layer on a Web Console Server

Configure a Web console server that uses forms-based authentication to use secure sockets layer (SSL), for a more secure Web console experience. For information about configuring the Web console server to use SSL, see the http://go.microsoft.com/fwlink/?LinkId=95136.

Update the Certificate on Web Console Servers

Certificates expire or there could be a security breach involving the certificate used for SSL connects to the Web console server. In both of these examples you will need to apply a new certificate to help maintain uninterrupted secure availability of the Web console server. For information about applying certificates to the Web console server, see the http://go.microsoft.com/fwlink/?LinkId=95136.

Remove a Web Console Server from a Management Group

You may want to remove a Web console server from an Operations Manager 2007 Management Group, for reasons such as hardware consolidation. Use Add or Remove to modify the installation of System Center Operations Manager 2007 and remove the Web console feature.

Managing Connected Management Groups in Operations Manager 2007

Connected Management Groups allow for the consolidation of alerts and the running of tasks from multiple Management Groups. Tasks can be initiated from a local Management Group to run on managed objects of a connected Management Group. This scenario is used to scale up the number of managed computers or objects you can monitor beyond the capabilities of a single Management Group.

The management group in which the data is consolidated is called the local management group, and those that contribute their data to the local management group are called the connected management groups. They relate to each other in a hierarchical fashion, with connected groups reporting up to local groups. The connected groups are in a peer-to-peer relationship with each other. Each connected group has no visibility or interaction with the other connected groups; the visibility is strictly from local Management Group to connected Management Group.

Communications between the connected and local Management Groups occurs between the Root Management Servers over TCP port 5724.

To Connect Operations Manager Management Groups

Use the following procedure to connect two Management Groups

To connect Operations Manager Management Groups

1.    Log on to the computer with a user account that is a member of the Operations Manager Administrator role for the Operations Manager 2007 Management Group. 2.    In the Operations console, click the Administration button. Note When you run the Operations console on a computer that is not a Management Server, the Connect To Server dialog box displays. In the Server name text box, type the name of the Operations Manager 2007 Management Server that you want the Operations console to connect to. 3.    In the Administration pane, expand Administration, right-click ConnectedManagementGroups, and then click AddManagementGroup. 4.    In the Add Management Group dialog box, in the Management Group name text box, type the name of connected Management Group. 5.    In the Root Management Server text box, type the name of the Root Management Server in the connected Management Group. Note You must define the Root Management Server by its fully qualified domain name (FQDN). 6.    Select one of the following radio buttons Note In either case, the account you use must be a member of the Operations Manager 2007 Administrators role for the connected Management Group. Select Use SDK service account if the SDK Service account is the same account in both Management Groups. Select Other user account if different credentials were used for the SDK service account in each Management group, and then enter the credentials for the SDK service account used in the connected Management Group. 7.    Click Add.

To configure user roles for connected Management Groups

If you are attempting to view one or more connected Management Groups, the credentials you provide must be must be a member of a user role in each of the connected Management Groups. The scope defined for this user role will define the scope of alerts that can be viewed.

Note

The Show Connected Alerts button will not be displayed to a user if they are a member of user role which is scoped for All Groups.

For example, consider an environment where two Management Groups are needed to monitor a large number of SQL Servers. Both Management Groups have been connected. Tom has the responsibility of monitoring SQL Servers. The Operations Manager administrator wants Tom to be able to view alerts from both Management Groups in a single view. The Operations Manager administrators in both connected Management Groups assign Tom’s account to a SQL Server Operator user role. When Tom clicks Show Connected Alerts, only SQL Server-related alerts from both Management Groups are displayed.

On the local Management Group, Tom will need to be a member of a user role whose group scope includes the connected Management Groups. Connected Management Groups are listed as object groups in the Group Scope tab in the User Role Properties dialog box. Only connected Management Groups that are selected can be viewed. For more information about user roles, see the Operations Manager 2007 Security Guide at http://go.microsoft.com/fwlink/?LinkId=64017.

To view alerts from connected Management Groups

Every time you start the Operations console, only alerts from the local Management Group will be displayed. To view alerts from the connected Management Group, you will need to provide credentials for a user from the connected Management Group.

To view alerts from the connected Management Group

1.    Start the Operations console, click the Monitoring button. 2.    In the Monitoring pane, expand Monitoring, and then click ActiveAlerts. 3.    In the Active Alerts pane, in the toolbar, click Show Connected Alerts. 4.    In the Enter Credentials dialog box, type the username, password, and domain name of a user in the connected Management Group Note The credentials entered must be from a user in the connected Management Groups that is a member of a role in Operations Manager. The scope of alerts that can be viewed are determined by the scope of the user’s credentials. 5.    Click OK.

Connecting Management Groups across untrusted domains

There are two topologies available for connecting Management Groups that span untrusted domains. If only one connected Management Group is going to be connected to one local Management Group, then the two Management Groups themselves can exist entirely within their respective domains as shown in the following figure.

If there are more than three Management Groups that are going to be connected, one local Management Group and two or more connected Management Groups, then both the local and connected Management Groups must span the two domains as shown in the following illustration.

In this either example, the same rules for user roles still apply as described in the To configure user roles for connected Management Groups topic in this document.

Managing Audit Collection Services in Operations Manager 2007

This topic will tell you how to configure, use, and maintain an Audit Collection Services (ACS) implementation in your environment. It does not cover ACS planning and deployment tasks. For planning and deployment guidance, see Operations Manager 2007 Deployment Guide. This topic presumes a deployed and functioning ACS infrastructure.

Configuring and using ACS consists of the following steps:

1.    Planning and implementing your audit policy

2.    Setting the filter on the ACS Collector

3.    Configuring and using ACS reporting

4.    Maintenance

Developing an Audit Plan

ACS collects and stores all the security event log entries from computers on which it is enabled. It does so with no regard as to what those events are or what they mean. It is up to you to determine what events you need captured and stored to fulfill your organization’s auditing requirements. The process of determining what those requirements are and how they translate into something that is actionable is called developing an audit plan. From the audit plan, you implement an audit policy via Group Policy objects at the domain or local level. It is the configuration of Group Policy objects that tells the security subsystem to write events to the security event log when a particular event or change occurs on a computer or in your environment. This process creates the trail of audited events that ACS collects.

Determine What Needs to be Audited

Companies are implementing ACS in response to various legal and regulatory requirements and for their own security, so you will not be able to determine by yourself what needs to be audited. You will need to involve individuals from several different areas of your company to develop an effective audit plan.

In general, it is not effective or efficient to audit all activity and changes and to capture all events. This approach results in gathering a great deal of noise events, which can obscure the data that is really needed when reconstructing a series of events, thereby impeding the overall process.

Audit Best Practices

Each company’s business requirements and IT environment are unique. As such, each company’s audit policy is also unique. What you choose to audit is up to you. Here are some general recommendations on what to audit:

For additional suggestions on auditing security events, see Auditing Security Events Best practices

Implementing your Audit Policy

Audit plans are implemented in your environment through the modification and application of the Domain Controller Audit Group Policy, Domain Audit Group Policy and local Audit Group Policy as needed. If your auditing plan calls for tracking interactions with Active Directory or with objects such as files, you will also need to configure the System Access Control List (SACL) on those objects. For in-depth information about Auditing and Windows security, see Windows Server 2003 Product Help Auditing Policy and Special Coverage: Windows Server 2008: Auditing and Compliance in Windows Server 2008.

Audit policy settings are found in the Local Security Settings in the Administrative tools folder. Audit policies for domain controllers are defined once and applied to all domain controllers. This is done via the Domain Controller Security Policy tool in the Administrative Tools folder. Audit policy for the rest of the domain member computers can be defined at the domain level in the Domain Security Policy tool, which is located in the Administrative Tools folder on all domain controllers. There are nine common audit policy categories for Windows Server 2003 and Vista, as shown in the following list, and a few more for Windows Server 2008:

On a member server, each of these audit policy categories can be set to Success, Failure, or No auditing. On a domain controller, in both the domain controller security policies and domain security policies, the options are to Define these policy settings, Success, Failure, or No auditing. In this case, the value of No auditing indicates that the Define these policy settings option has been selected, but that neither success nor failure options have been selected. Note that the Success and Failure options are not mutually exclusive, both can be selected. For the audit directory service access and audit object access audit policy categories, you must also configure the SACLs for the objects you want audited.

To access the Audit PolicyCcategories on a Standalone Server

1.    Click Start, and select Administrative Tools, Local Security Policy. 2.    Expand the Local Policies node to expose the Audit Policy node. The nine audit policy categories will be listed in the results pane. 3.    Double-click the audit policy that you are interested in to open its property page. Here you can select to audit success and failure attempts at interaction, as well as get an explanation of the audit policy category on the Explain This Setting tab. 4.    Click OK to save your settings.