vNext.be » PowerShell

SCOM / OpsMgr: Lync 2010 Management Pack – Deploying Synthetic transactions (STs)

Christopher Keyaert — Sun, 06 Mar 2011 09:50:33 +0000

Introduction

Lync Server 2010 Monitoring Management Pack is a comprehensive End-to-End monitoring management pack for System Center Operations Manager 2007 R2. Extensive component event and performance monitoring is available, and new in this release is full support for Synthetic Transactions against a distributed Lync Server 2010 deployment.

The most part of the next lines are directly coming from the Microsoft Documentation available on pinpoint portal: http://pinpoint.microsoft.com/en-US/applications/Lync-Server-2010-Monitoring-Management-Pack-12884908254

But as I found that the “Synthetic Transaction” part a little bit complicated for non Lync 2010 Administrator, I added my comments, advises and screenshots below. I hope this will help in your Lync 2010 management pack deployment.

Setting up Synthetic transaction watcher node

Synthetic transactions are Lync Server 2010 cmdlets that are automatically triggered by the management pack on a preset interval. These are executed on a synthetic transaction watcher node which is an administrator designated server responsible for discovery and execution of STs for each pool.

It is not recommended to use an existing Lync Server 2010 server as a synthetic transaction watcher node. This is due to the high CPU/memory utilization requirements for running STs. It’s recommended to use a new server machine (or a virtual machine) for the synthetic transaction watcher node. (Recommended configuration is available in Microsoft documentation).

Add ST Watcher Node as a trusted Microsoft Lync Server 2010 Application pool

The following actions must be executed from any of your existing Lync servers.

Create external application pool with synthetic transaction watcher node machine as a member. While creating use machine FQDN as pool FQDN. To create the pool you can run the following cmdlet from the Lync Server Management Shell on any of your existing Lync server:

New-CsTrustedApplicationPool -Identity -Site -Registrar -Verbose

Where

: Is the FQDN of the external application pool to be created. Use watcher node machine FQDN (the fresh installed server) as Pool FQDN

: The ID of the site where the application pool belongs to

: The FQDN of the registrar pool that the external application pool depends on

Example:

New-CsTrustedApplicationPool -Identity bramomlyc001.dir.ucb-group.com -Site 1 -Registrar hqpool.dir.ucb-group.com -Verbose

Verify that external application pool has been added by running Get-CsPool
Create an external application service entry in topology by using following cmdlet from the Lync Server Management Shell:

New-CsTrustedApplication -ApplicationId -TrustedApplicationPoolFqdn -Port -Verbose

Where

: Is an ID for the application. For example, you can use “STWatcherNode”

: Is the FQDN of the external application pool that you created in step 1

: Any unused port number.

Example:

New-CsTrustedApplication -ApplicationId “StWatcherNode” -TrustedApplicationPoolFqdn bramomlyc001.dir.ucb-group.com -Port 9999 –Verbose

Configure ST Watcher Node machine

The following actions must be executed from the new installed server.

Install Lync Server 2010 core MSI, after that launch the Deployment Wizard and install the “Local Configuration Store”

Skip the Step and go directly to the Step 3: Request, Install and Assign Certificates.

From the Lync Server Management Shell, run Enable-CsComputer –verbose. This will assign group memberships and resource permissions to support Lync Server services running on the host computer.

In your Active Directory, create two domain users that will be used by the Synthetic transaction monitoring scripts. Don’t forget to fill the email field in the user configuration screen. (Just the Email field, a real mailbox is not necessary)
In your Lync configuration panel, enable the two users that you just created as Enterprise Voice. Verify that these two users have well received the Conferencing Policy and the External Access Policy but executing the following command :

Get-CSUser username
Assign Test Users to registrar and user service clusters by using Health Monitoring Configuration cmdlet

New-CsHealthMonitoringConfiguration -TargetFQDN -FirstTestUserSipUri -SecondTestUserSipUri -Verbose

Where

: Is the Pool FQDN you wish to run STs against (where users are hosted).

: Sip Uri of first test user to be used for synthetic transaction.

: Sip Uri of second test user to be used for synthetic transaction.

Example:

New-CsHealthMonitoringConfiguration hqpool.dir.ucb-group.com -FirstTestUserSipUri “sip:gbl.gmso.lyc1@ucb.com” -SecondTestUserSipUri “sip: gbl.gmso.lyc2@ucb.com ” –Verbose

Make sure synthetic transactions are working by running the following cmdlet from in the Lync Server Management Shell.

Test-CsRegistration -verbose

Set registry key for watcher node discovery and optionally for enabling logging by executing the following cmdlets from Lync Server Management Shell:

New-Item -Path “HKLM:\Software\Microsoft\Real-Time Communications\Health”

New-ItemProperty -Path “HKLM:\Software\Microsoft\Real-Time Communications\Health” -Name “IsSTWatcherNode” -Value true | Out-Null

New-ItemProperty -Path “HKLM:\Software\Microsoft\Real-Time Communications\Health” -Name “LogOpsMgr” -PropertyType DWord -value 2

Configuring Active directory

Add the synthetic transaction watcher node machine as a member of RTCUniversalReadOnlyAdmins group.
From Lync Server Management Shell on watcher node run Enable-CsComputer –Verbose

Restart Machine (this is required after machine is added to RtcUniversalReadOnlyAdmins)

Configure Operations Manager Agent settings on ST Watcher Node

Increase the thread pool count for synthetic transaction watcher node by modifying the value for the below registry key.
- HKLM:\System\CurrentControlSet\Services\HealthService\Parameters
  
  [DWORD] Thread Pool CLR Max Thread Count Min 200 decimal

Note: Spaces between the words should be reserved as shown above.

If the registry key does not exist you can create it by running the following PS cmdlet

New-ItemProperty -Path “HKLM:\System\CurrentControlSet\Services\HealthService\Parameters” -Name “Thread Pool CLR Max Thread Count Min” -propertytype DWord -value 200

Restart health service:
Net stop healthservice & Net start healthservice

Other Settings for Synthetic Transactions

Web (HTTP) Synthetic Transactions required the folder %SystemRoot%\temp to have write access by the Network Service identity. Please make sure that the ACL on %SystemRoot%\temp include write access for Network Service.

Testing the Synthetic Transaction with PowerShell

Execute the following command to ensure that the Synthetic Transaction are working well

Now, I invite you to continue the configuration of your Lync 2010 management pack with the official Microsoft documentation. http://pinpoint.microsoft.com/en-US/applications/Lync-Server-2010-Monitoring-Management-Pack-12884908254

Christopher KEYAERT

SCOM : Gateway Primary and Failover MS

Christopher Keyaert — Wed, 08 Dec 2010 22:01:26 +0000

If you want to change the Primary MS of your gateway server or if you want to add a failover MS to it, on the technet library on Deploying Gateway Server in the Multiple Server, Single Management Group Scenario, the following commands will be presented :

1
2
3
4

$primaryMS = Get-ManagementServer | where {$_.Name -eq 'corp-ms02.corp.contoso.local'}
$failoverMS = Get-ManagementServer | where {$_.Name -eq 'corp-r2.corp.contoso.local'}
$gatewayMS = Get-GatewayManagementServer | where {$_.Name -eq 'dmz01'}
Set-ManagementServer -GatewayManagementServer: $gatewayMS -primarymanagementserver: $primaryMS -FailoverServer: $failoverMS

When you run this command you have to be aware that when the current management server gets this update it will stop accepting connections from your gateway server (if it is not primary or failover management server in the new configuration). That could result in a orphaned gateway server, the gateway server is not allowed to communicate with any management server.

To avoid that, I wrote a little PowerShell Script that does all the task for you and avoid to have a orphaned gateway server. For writing this script, I took my idea from this excellent post : Ops Mgr R2 and multiple gateway servers

########################################
# Gateway Server : Primary / Failover
# Autor : Christopher Keyaert
# Email : christopher@vnext.be
# Website : http://www.vnext.be
# Date : 8 DEC 2010
# Version : 0.1
#
# Inspired by : http://contoso.se/blog/?p=831
########################################
# PARAM
########################################

#FQN NAME
$RMS = "xxx.CONTOSO.COM"
$Gateway = "xxx.CONTOSO.COM"
$PrimaryMS = "xxx.CONTOSO.COM"
$failoverMS = "xxx.CONTOSO.COM"

#Waiting time
$WaitingTime = 3 # Minutes

########################################
# SNAP-IN + RMS Conenction
########################################
if(-not (Get-pssnapin | Where-Object {$_.Name -eq "Microsoft.EnterpriseManagement.OperationsManager.Client"}))
{
Add-PSSnapin Microsoft.EnterpriseManagement.OperationsManager.Client
}
new-managementGroupConnection -ConnectionString:$RMS
Set-Location "OperationsManagerMonitoring::" -ErrorVariable errSnapin ;
Set-Location $RMS -ErrorVariable errSnapin ;

########################################
# SCRIPT
########################################

Write-Host "#######################"
Write-Host "# Gateway Failover #"
Write-Host "#######################"
Write-Host ""
Write-Host "Gateway : "$Gateway
Write-Host "Primary : "$PrimaryMS
Write-Host "Failover : "$FailoverMS
Write-Host ""

#Get server details
$primaryMS = Get-ManagementServer | where {$_.Name -eq $PrimaryMS}
$failoverMS = Get-ManagementServer | where {$_.Name -eq $failoverMS}
$gatewayMS = Get-GatewayManagementServer | where {$_.Name -eq $Gateway}

#Get current primary
$CurrentPrimary = $gatewayMS | Get-PrimaryManagementServer

#Set Primary as failover for configuration transfert
Set-ManagementServer -GatewayManagementServer: $gatewayMS -primarymanagementserver: $primaryMS -FailoverServer: $CurrentPrimary

#Wait for config change
For($i = $WaitingTime; $i -gt 0; $i--)
{
Write-Host "Waiting $i minutes for configuration changes"
Start-Sleep 60
}

#Set the real configuration
Set-ManagementServer -GatewayManagementServer: $gatewayMS -primarymanagementserver: $primaryMS -FailoverServer: $failoverMS

#You can also run the following command shell commands to see he primary and failover server for a gateway server

$CheckPrimary = Get-GatewayManagementServer | where {$_.Name -like $Gateway} | Get-PrimaryManagementServer
If($CheckPrimary.Name -eq $PrimaryMS.Name)
{Write-Host "Primary server OK : "$PrimaryMS.name}
else{Write-Host "Primary server Failed : "$CheckPrimary.Name}

$CheckFailover = Get-GatewayManagementServer | where {$_.Name -like $Gateway} | Get-FailoverManagementServer
If($CheckFailover.Name -eq $failoverMS.name)
{Write-Host "FailOver server OK : "$failoverMS.Name}
else{Write-Host "FailOver server Failed : "$CheckFailover.Name}

Write-Host ""
Write-Host "END."

SCOM : Create a Rule and Monitor from a PowerShell Script

Christopher Keyaert — Tue, 08 Jun 2010 11:34:38 +0000

In this video, Brian Wren demonstrates how to create a management pack containing a monitor and rule sharing a Windows PowerShell script. The demonstration includes modifying an existing script to be included in a management pack and then creating custom modules and monitor types to run the script and make its collected data available to workflows. Finally, a rule and monitor are created to collect data from the script for reporting and to set the health state of a managed object. The concept of the solution and each step are discussed prior to a detailed walkthrough of their creation and configuration.

http://technet.microsoft.com/en-us/ff723797.aspx

PowerShell : Upload file to WebDav Server

Christopher Keyaert — Thu, 20 May 2010 20:56:54 +0000

The purpose of that Powershell Script is to upload a file on a webdav server. This could be useful for automatic report publishing on a portal.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

########################################
#Webdav Access with PowerShell
########################################

#Put the complete path of the file that you want to upload
$file = "D:\test.txt"

#Put the url without the last "/"
$url = "http://mywebSite/webdav"

#Provide User and Pwd for Webdav Access
$user = "user"
$pass = "pwd"

########################################
#Script
#######################################

#Adding the name of the file at the end of the URL
$url += "/" + $file.split('\')[(($file.split("\")).count - 1)]

#Connecting to WebDav
Write-Host "File upload started"

# Set binary file type
Set-Variable -name adFileTypeBinary -value 1 -option Constant

$objADOStream = New-Object -ComObject ADODB.Stream
$objADOStream.Open()
$objADOStream.Type = $adFileTypeBinary
$objADOStream.LoadFromFile("$file")
$arrbuffer = $objADOStream.Read()

$objXMLHTTP = New-Object -ComObject MSXML2.ServerXMLHTTP
$objXMLHTTP.Open("PUT", $url, $False, $user, $pass)
$objXMLHTTP.send($arrbuffer)

Write-Host "File upload finished"

And that’s it

Christopher Keyaert

SCOM : Automatic Agent Deployment on Windows OS With PowerShell

Christopher Keyaert — Thu, 20 May 2010 20:34:33 +0000

Hello,

Some weeks ago, I had to deploy SCOM Agent on more than 350 windows servers at the same time. For that, I wrote a little PowerShell Script where you just have to give a server list in input (a simple txt file, one server name per line) and the name of your RMS/MS . And that’s it, the script’ll perform the agent installation for you and a CSV file will be generated as output with the agent installation status for each servers.

Concerning the right management, you have to ensure that the Default Action Account used on your (root) management server has administrative right on the servers that you want to add in SCOM. For that, and the duration of the deployment only, use a Domain Admin Account as the Run As Account of your MS/RMS.

The script :

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142

###########################
# Autor : Christopher Keyaert
# Version : 1.0
# Date : 28 DEC 2009
##########################
#Getting the credential of the user
#$creds = Get-Credential

###########################
#Param
##########################
$RMS = #don't forget to use the FQN RMS001.contoso.local
$MS = #don't forget to use the FQN MS001.contoso.local

$myFile = "D:\Dep\myfile.txt" #List of Servers
$ResultPath = "D:\Dep" #Folder for path output
Start-Transcript -path "$ResultPath\Transcript$(get-date -uformat '%Y-%m-%d_%Hh%Ms%S').log"

$MaintenanceModeEnable = $false

$MaintenanceModeDuration = 10 * 1440 # 1440 minutes per day
$comment = 'Global Deployment'
$reason = 'PlannedOther'

######################
#Functions
#####################
function SetToMaintenanceMode($rootMS,$computerPrincipalName,$minutes,$comment,$reason)
{
$computerPrincipalName = $computerPrincipalName + ".dir.ucb-group.com"
$computerClass = get-monitoringclass -name:Microsoft.Windows.Computer
$healthServiceClass = get-monitoringclass -name:Microsoft.SystemCenter.HealthService
$healthServiceWatcherClass = get-monitoringclass -name:Microsoft.SystemCenter.HealthServiceWatcher
$computerCriteria = "PrincipalName='" + $computerPrincipalName + "'"
$computer = get-monitoringobject -monitoringclass:$computerClass -criteria:$computerCriteria
$healthServices = $computer.GetRelatedMonitoringObjects($healthServiceClass)
$healthService = $healthServices[0]
$healthServiceCriteria = "HealthServiceName='" + $computerPrincipalName + "'"
$healthServiceWatcher = get-monitoringobject -monitoringclass:$healthServiceWatcherClass -criteria:$healthServiceCriteria
$startTime = [System.DateTime]::Now
$endTime = $startTime.AddMinutes($minutes)

Write-host " "
"Putting " + $computerPrincipalName + " into maintenance mode"
New-MaintenanceWindow -startTime:$startTime -endTime:$endTime -monitoringObject:$computer -comment:$comment -Reason:$reason

"Putting the associated health service into maintenance mode"
New-MaintenanceWindow -startTime:$startTime -endTime:$endTime -monitoringObject:$healthService -comment:$comment -Reason:$reason

"Putting the associated health service watcher into maintenance mode"
New-MaintenanceWindow -startTime:$startTime -endTime:$endTime -monitoringObject:$healthServiceWatcher -comment:$comment -Reason:$reason
Write-host " "

}

#################################
#Init the connection to SCOM srv
#################################
if(-not (Get-pssnapin | Where-Object {$_.Name -eq "Microsoft.EnterpriseManagement.OperationsManager.Client"}))
{
Add-PSSnapin Microsoft.EnterpriseManagement.OperationsManager.Client
}
new-managementGroupConnection -ConnectionString:$RMS
Set-Location "OperationsManagerMonitoring::" -ErrorVariable errSnapin ;
Set-Location $RMS -ErrorVariable errSnapin ;

##########################
#Agent installation
##########################
#Creating the computers list
$ComputersList = @()
$ComputersList = Get-Content $myFile

#Define a WindowsDiscoveryConfiguration
$discoConfig = New-WindowsDiscoveryConfiguration –ComputerName: $ComputersList –PerformVerification: $true -ComputerType: "Server" #–ActionAccountCredential: $creds

#Start the discovery process.
$managementServer = Get-ManagementServer | Where-Object {$_.PrincipalName -like "*$MS*"}

$discoResult = Start-Discovery –ManagementServer: $managementServer –WindowsDiscoveryConfiguration: $discoConfig

#Check that the discovery process discovered the Windows computers you specified.
$discoResult.CustomMonitoringObjects

if($discoResult.CustomMonitoringObjects -ne $null)
{
Write-Host "Agent installation in progress..."
Write-Host ""
Install-Agent –ManagementServer $managementServer –AgentManagedComputer $discoResult.CustomMonitoringObjects

Write-host "Installation Finished, waiting for 60 secondes"
Start-Sleep -s 60
}
else{
Write-Host "No servers discovered"
}

####################################################################
#We have to check if all the agent has been well installed + Maintenance mode
#####################################################################
Write-Host ""
Write-Host "Installation Checking"
Write-Host ""

$InstallArray = @()
foreach($srv in $ComputersList)
{
$Value = $null
$Value = Get-agent | Where-Object {$_.ComputerName -like "*$srv*"}

if($Value -ne $null)
{
Write-Host "$srv - Agent installed "
$InstallTime = $Value.InstallTime
$HealthState = $Value.HealthState
$AgentInstalled = $true

#Write-Host "Activation of the Maintenance Mode"
#Put the server in Maintenance Mode
if($MaintenanceModeEnable -eq $true){SetToMaintenanceMode $RMS $srv $MaintenanceModeDuration $comment $reason}

}
else{
Write-Host "$srv - Agent not installed"
$AgentInstalled = $false
$InstallTime = ""
$HealthState = ""
}

$obj = New-Object PSObject
$obj | Add-Member Noteproperty -Name "Name" -Value $srv
$obj | Add-Member Noteproperty -Name "AgentInstall" -Value $AgentInstalled
$obj | Add-Member Noteproperty -Name "InstallTime" -Value $InstallTime
$obj | Add-Member Noteproperty -Name "HealthState" -Value $HealthState
$InstallArray += $obj
}

Write-Host ""
Write-Host "Save the Result File"

$InstallArray | Export-Csv "$ResultPath\$(get-date -uformat '%Y-%m-%d_%Hh%Ms%S').csv"
Stop-Transcript

Christopher Keyaert

VI Toolkit / PowerShell : How to connect to more than one Virtual Center at the same time

Christopher Keyaert — Thu, 20 May 2010 20:28:10 +0000

Hello All,

If you only use the command GET-VM, you will receive back the VMs List only from the Virtucal Center that you last connect on. If you want the get all the VM from your both virutal centers, you absolutely need to add the parameter -server $vcs to you command.

If you want to connect to more than one virtual center at the same time, here the starting code :

1
2
3
4
5
6
7

$vcs = @()
$vcs += connect-viserver vc1.mydom.local
$vcs += connect-viserver vc2.mydom.local
# You could add many as you need...

# Command example
get-vm -server $vcs | export-csv C:\Export.csv

In a general way, don’t forget to add -server $vcs to every command than you use with the VI Toolkit.

As always, RTM -> the documentation on VI Toolkit :
http://communities.vmware.com/docs/DOC-4210

Christopher Keyaert

SCOM / PowerShell : Number of locked AD accounts

admin — Thu, 06 May 2010 17:47:21 +0000

Dear All,

Here a new little powershell script that creates an event 6970 in the event viewer when there is more than X accounts locked in less than Y minutes. Now, you just have to create a new rule in SCOM that collect event with the ID6970 and schedule that script to run every 10 minutes.

Thanks to that you can be alert when there is an attack attempt to your Active Directory.

########################################################
#Get the number of lock account in less than 10 minutes
########################################################
###########################
# Param
###########################
$LockedSince = 10 #Minutes
$NumberofLockedAccount = 50 #

###########################
# FUNCTIONS
###########################
###########################
# SCRIPT
###########################
$objDomain = New-Object System.DirectoryServices.DirectoryEntry
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher
$objSearcher.SearchRoot = $objDomain
$objSearcher.PageSize = 1000
$objSearcher.Filter = "(&(objectClass=User)(lockoutTime>=1))"
$colProplist = "name","samaccountname","lockoutTime"

foreach ($i in $colPropList){$objSearcher.PropertiesToLoad.Add($i) | out-null}
$colResults = $objSearcher.FindAll()

$cpt = 0
$result = $null
$result2 = $null

foreach ($objResult in $colResults) {

$domainname = $objDomain.name
$samaccountname = $objResult.Properties.samaccountname

$user = [ADSI]"WinNT://$domainname/$samaccountname"
$ADS_UF_LOCKOUT = 0x00000010
#$objResult.Properties

if(($user.UserFlags.Value -band $ADS_UF_LOCKOUT) -eq $ADS_UF_LOCKOUT) {
$Sam = $objResult.Properties.samaccountname
$Name = $objResult.Properties.name
[String]$LockTime = $objResult.Properties.lockouttime
[datetime] $LockTime = [datetime]::FromFileTime($LockTime)

#We want all the account locked in the last 24h
$DayDate = Get-Date
$DayDateBefore = $DayDate.AddMinutes(-$LockedSince)

if(($LockTime -gt $DayDateBefore) -and ($LockTime -lt $DayDate))
{
Write-Host "************"
Write-Host "User : $sam"
Write-Host "Name : $name"
Write-Host "LockTime : $lockTime"
Write-Host "************"
Write-Host ""

$result2 += "************`r"
$result2 += "User : $sam`r"
$result2 += "Name : $name`r"
$result2 += "LockTime : $lockTime`r"
$result2 += "************`r"
$result2 += "`r"

$cpt += 1
}
}
}

Write-Host "************"
Write-Host "There is $cpt account(s) locked in the last $LockedSince minutes"
Write-Host "************"

$result += "************`r"
$result += "There is $cpt account(s) locked in the last $LockedSince minutes`r"
$result += "************`r"
$result += $result2

if($cpt -ge $NumberofLockedAccount)
{
Write-Host ""
Write-Host "Limit reached, /!\ ALERT /!\"
Write-Host ""
$infoevent=[System.Diagnostics.EventLogEntryType]::Error
}
else{
$infoevent=[System.Diagnostics.EventLogEntryType]::Information
}

############################
#Var for the event creation
############################
$evt = new-object System.Diagnostics.EventLog("Application")
$evt.Source = "AD-SCOM"
$evt.MachineName = "."
$evt.WriteEntry($result,$infoevent,6970)