Monitoring Windows Event using Operations manager 2007 - Part 3

Monitoring windows Event with operations manager 2007 provide us with other ways to monitor our server.
Monitor the missing events in the windows event log is another way to keep your eyes on the running windows system.
You can monitor the event log file within a specified time to check if this event is missed or not.
For example, every Sunday morning from 8:00 AM to 10:00 AM a third party application do a special task and after the successful end of this task , I will get an event in the application event log of the server, and I have more than 20 server has the same application
Surprise, in a normal way I will open the event viewer of each server and search for this event during this time, this will be a time consuming job for me, and this day will be my worst day in my week to do this.

But if you have Microsoft Operations Manager 2007, you can configure a monitor to check this server at this time; if the event is located I will not be notified and the system is running well.
But if the monitor did not find this event at this time, the health state of the server will be change to warning or critical state, and I have an option to fire alert with preconfigured setting.
Also, when the health state was changed to non healthy state as you configure the monitor, when the server will be in healthy state again?
Microsoft operation manager 2007 provides us with 3 ways to reset the health state:
Manual reset
Timer reset
Windows event reset

In this guide, we will discuss how to configure a unit monitor to monitor missing windows event.
Configure missing event detection unit monitor is the easy one in windows event detection unit monitor.
download the guide from the following link
http://tarek.ismail.googlepages.com/MonitoringwinEvent-part3.pdf
or contact me at Tarek_877@hotmail.com to get a copy

Monitoring Windows Event using Operations manager 2007 - Part 2

Using Microsoft operations manager to monitor windows event is one of the important task should be done by the administrator.

Monitoring event log for specific event on a group of servers in a normal way can be a e work to do this and still also not an accurate solution and not automated.

Some times when the event raised, this will not be a problem in the network but when this event repeated within a short time, this could be a problem.

Microsoft System center operations manager provide a perfect solution to monitor the repeated event based on many criteria

By using windows event monitor for repeated event, you will get a magic tool to keep your network up and healthy without manual action to these windows events.

This is the second guide about monitor windows event using operations manager, in this guide we will discuss how to configure repeated event detection monitor
It seems to be easy like working with simple event detection monitor.

download the guide from the following link
http://tarek.ismail.googlepages.com/MonitoringwinEvent-part2.pdf
or contact me at Tarek_877@hotmail.com to get a copy

Monitoring Windows Event using Operations manager 2007 - Part 1

Microsoft System Center Operations manager 2007 contains great tools to monitor conditions that can occur in monitored objects.
Monitors in operations manager are divided into three different types of monitors:
1. Unit monitors
2. Aggregate rollup monitors
3. Dependency rollup monitors.

Unit monitor is the basic element of the monitoring in Operations manager , it can be used to monitor all windows Events, Log file , Windows service, windows performance counters , SNMP , and ………….

You have an option with any monitor unit to generate an alert.
Unit monitors can be rolled up to either dependency or aggregate rollup monitors.
Windows events are a very important element we need to monitor on all windows servers and workstations.

Operations manager 2007 provide a comprehensive solution to monitor windows events using monitor units
Monitor windows events are divided into five parts as below:
1. Simple event detection
2. Repeated event detection
3. Missing event detection
4. Correlated event detection
5. Correlated missing event detection

We will discuss all of these points in details one by one in five guides plus the guide number six which will contain some tips and tricks while working with monitoring windows events.
In this guide will discuss how to work with simple event detection

download the guide from the following link
http://tarek.ismail.googlepages.com/MonitoringwinEvent-part1.pdf
or contact me at Tarek_877@hotmail.com to get a copy

Microsoft forefront client security Q & A

After install and configure Microsoft forefront client security, and start working with FCS for customers, many questions was raised by the customer and our team
In this guide I will list the most of this questions and the reply for this question.
Some of these answers were describe some behavior of the product and it is by design
Others are our solution to complete the security suite of forefront client security and to harden the system.
the document is here
http://tarek.ismail.googlepages.com/FCSQA.pdf
or contact me @ Tarek_877@hotmail.com to get a copy

Configure Microsoft forefront client security

After install Microsoft forefront client security, we need to configure the server and all related component to get the best result from FCS server.
The following items will be discussed through this guide:

• Configure windows client firewall
• Configure WSUS server
• Deploy client security
• Manually deploy forefront client security client
• Create client security policy
• Deploy client security policy
• Distributing definition and engine updates
• Controlling access to FCS MOM consoles

To Configure forefront client security server on one server you can follow the steps in the link below:

http://tarek.ismail.googlepages.com/2-ConfigureFCS.pdf

or contact me @ Tarek_877@hotmail.com to get a copy

Installing forefront client security server

• Forefront Client Security provides unified malware protection for business desktops, laptops, and server operating systems.
• Forefront Client Security Built on the same Microsoft protection technology already used by millions of people worldwide, Client Security helps guard against emerging malware threats, such as spyware and rootkits, as well as traditional threats such as viruses, worms, and Trojan horses.
• Forefront Client Security integrates with your existing infrastructure software, such as the Active Directory service, and complements other Microsoft security technologies for enhanced protection and greater control.
• Forefront Client Security is designed to protect computers running the Windows Vista, Microsoft Windows Server 2003, Windows 2000 Server, and Windows XP operating systems.
• Forefront Client Security provides many types of reports to help the organization's security status.
• Forefront Client Security Malware definition updates are distributed from Microsoft Update or WSUS server.

To install forefront client security server on one server you can follow the steps in the link below:

http://tarek.ismail.googlepages.com/InstallingandConfiguringforefrontcli.pdf

Best Regards,

Tarek Ismail

Operations Manager 2007 Backup and Recovery Guide

This guide provides guidance in planning for backup and recovery of System Center Operations Manager 2007 server roles and components. The information in this guide will complement your existing recovery strategy to avoid service disruption.
This guide includes the following:

Understanding the impact of service failure
Recommendations on what to back up and why
How to back up and restore key server roles and components
Frequently used recovery scenarios

the guide is available here

http://download.microsoft.com/download/7/4/d/74deff5e-449f-4a6b-91dd-ffbc117869a2/OpsMgr2007_Backup.doc

Operations Manager 2007 Design Guide

This guide will help you understand the building-block-level components in Operations Manager 2007 by presenting summaries of these roles.
It will help you to ask the right questions to make sure your design meets your company's needs.
It will make sure that you have answered the most fundamental design questions to ensure your design is flexible and scalable.
It will help you plan and size your Operations Manager 2007 topology using data from the Performance and Sizing Guide.
It provides guidance on how to validate your design in the lab.

the guide is here
http://download.microsoft.com/download/7/4/d/74deff5e-449f-4a6b-91dd-ffbc117869a2/OpsMgr2007_DesignGuid.doc

How to schedule discover and install agent as MOM 2005

As Before in MOM 2005, you can automatic discover your server and install agents without run the wizard every time

Now in system center Operations Manager, this is not available but you can do this using Shell command

the Script can be using to run a Windows schedule task to discover and install Ops Mgr 2007 agent based on your LDAP query

------------------------
param ($OpsMgrservername,$Domainname)
#Initialize the OpsMgr Provider
Add-PSSnapin Microsoft.EnterpriseManagement.OperationsManager.Client
# Set the location to the root of the provider namespace.
cd OperationsManagerMonitoring::
#create a connection to the Management Group
New-ManagementGroupConnection $OpsMgrservername
#change the path
cd $OpsMgrservername
#configure query setting
$ldap_query = new-ldapquerydiscoverycriteria -domain $Domainname -ldapquery "(sAMAccountType=805306369)(name=*ABC*)"
#configure discovery setting
$windows_discovery_cfg = new-windowsdiscoveryconfiguration -ldapquery $ldap_query
# discoveryresults
$discovery_results = start-discovery -managementserver (get-managementserver)-windowsdiscoveryconfiguration $windows_discovery_cfg
#install Agent
install-agent -managementserver (get-managementserver) -agentmanagedcomputer $discovery_results.custommonitoringobjects
----------------------------------------

save the file as Agentdiscoverinstall.ps1

configure the Windows schedule task as

Powershell.exe Agentdiscoverinstall.ps1 -OpsMgrservername:localhost -Domainname:tarek

How to change Agent Maximum Queue Size using a Task

This issue has surfaced in the newsgroups, to solve this issue you can create a task using to change the value in the registry and restart health service on the client
the registry key:
HKLM\SYSTEM\CurrentControlSet\Services\HealthService\Parameters\Management Groups\MG_ Name\MaximumQueueSizeKb

the value : "15 MB" 15360

the script as below:

##############
HKEY_CURRENT_USER = &H80000001
strComputer = "."
Set objReg = GetObject("winmgmts:\\" & strComputer &"\root\default:StdRegProv")
strKeyPath =
"SYSTEM\CurrentControlSet\Services\HealthService\Parameters\Management Groups\MG_ Name"
ValueName = "MaximumQueueSizeKb"
dwValue = 51200
objReg.SetDWORDValue HKEY_CURRENT_USER, strKeyPath, ValueName, dwValue
Set objShell = CreateObject("WScript.Shell")
objShell.Run "%COMSPEC% /c net stop healthservice",,1
objShell.Run "%COMSPEC% /c net start healthservice",,1

###############