The first script will walk the entire Active Directory Forest and gather the distinguished name of every Exchange 2003 Mailbox Store, which we will need in order to query the LastFullBackupTime value. Copy the contents of this script into a new text document named "GetMailBoxStoreDN.vbs".

Set objRootDSE = GetObject("LDAP://RootDSE")
configurationNamingContext = objRootDSE.get("configurationNamingContext")

Set cn = CreateObject("ADODB.Connection")
Set cmd = CreateObject("ADODB.Command")
Set rs = CreateObject("ADODB.Recordset")

cn.Open "Provider=ADsDSOObject;"

query = "<LDAP://" & configurationNamingContext & ">;(objectCategory=msExchPrivateMDB);name,cn,distinguishedName;subtree"

cmd.ActiveConnection = cn
cmd.CommandText = query
Set rs = cmd.Execute

While rs.EOF <> True And rs.BOF <> True
wscript.echo rs.Fields("distinguishedname").Value
rs.MoveNext
Wend

Set rs = Nothing
Set cmd = Nothing
Set cn = Nothing

Now that we have the first script ready, you'll need to execute it by opening up a command prompt and navigating to the location where the script resides. Type "cscript GetMailBoxStoreDN.vbs > MailBoxStoreDN.txt" to execute the script and pipe the results to a text file which will be used in the next step to query for the LastFullBackupTime value.

Once the first script has completed we'll need to use the 2nd script to gather the LastFullBackupTime value. Before we do so, you'll need to edit the resulting txt file from the first script and remove the first few lines at the top so the file only contains the distinguishedName of each Mailbox Store. Copy the contents of the script below into a new text document named "GetLastFullBackupTime.vbs". This script will loop through the contents of the MailBoxStoreDN.txt file and query the LastFullBackupTime value from each Mailbox Store. You'll need to execute this script in a similar fashion, by opening a command prompt and navigating to the location of the MailBoxStoreDN.txt and GetLastFullBackupTime.vbs. Type "cscript GetLastFullBackupTime.vbs > LastFullBackupTime.txt" to execute the script and pipe the results to a text file.

Option Explicit
On Error Resume Next
Dim oFSO, sFile, oFile, sText, mdbobj
Set oFSO = CreateObject("Scripting.FileSystemObject")
set mdbobj = createobject("CDOEXM.MailboxStoreDB")
sFile = "MailBoxStoreDN.txt"
If oFSO.FileExists(sFile) Then
Set oFile = oFSO.OpenTextFile(sFile, 1)
Do While Not oFile.AtEndOfStream
sText = oFile.ReadLine
If Trim(sText) <> "" Then
mdbobj.datasource.open "LDAP://" & sText
Wscript.echo "Mailbox Store:," & sText & ",Last Backed Up : " & mdbobj.LastFullBackupTime
End If
Loop
oFile.Close
Else
WScript.Echo "The file was not there."
End If

Once the script has completed running,  open the LastFullBackupTime.txt file to view the results, or copy the contents into Excel if you prefer to make use of the text-to-columns and sorting features for better readability. While we admit this solution lacks elegance and requires a small bit of intervention from start to finish, this method is very effective for quickly determining the status of backups against Exchange for the entire enterprise and can easily be modified to query for the Last Incremental Time as well if necessary.

Fortunately, there are tools readily available within the Windows Server Support Tools suite as well as free tools that can help you accomplish this task; for the purposes of this demonstration we will cover two alternate methods.

Method 1: Using ldp.exe from the Windows Server Support Tools suite

Assuming you have the Windows Server 2000 or 2003 Support Tools installed, you can simply execute ldp.exe from your run console or from the command prompt.

Once you have ldp up, you will need to connect to the environment for which you wish to execute a SID query by clicking on the "Connection" menu, selecting "Connect" and entering the name of the domain for which the SID in question resides.

Assuming a successful connection, you can now select the "Utilities" menu, and then select "Sid lookup". Type in your SIDs in a comma separated format and click ok.

For this example, we have entered the SID for the Everyone group; S-1-1-0. As you can see, in the right hand field, we have been returned the results "Everyone [S-1-1-0]".

This method can prove helpful, however the requirement with this tool is that you must know the SID in question, and this tool has no ability to do reverse lookups of name to SID, only SID to name.

Method 2: Using SidConverter.exe

SidConverter.exe is a freely available tool (Author unknown) that has the ability to do forward and reverse SID lookups, among other functions.

To do forward SID lookups (SID to name), simply type the SID into the top box labeled "SDDL" and click the Convert button.

To do reverse SID lookups (name to SID), check the "Do Account Name Lookup" box, type the name of the account into the "Account Name" box, and click Convert.

The SidConveter.exe tool can be obtained by clicking this link: SidConveter.exe . You will need to rename the file from SidConverter.exe_renamed to SidConverter.exe .

Event ID: 35
Source: WinMgmt
Description: WMI ADAP was unable to load the ASP.NET_64_2.0.50727 performance library because it returned invalid data: 0×0

Event ID: 35
Source: WinMgmt
Description: WMI ADAP was unable to load the ASP.NET_64 performance library because it returned invalid data: 0×0

Event ID: 40
Source: WinMgmt
Description: WMI ADAP was unable to create the object Win32_PerfRawData_ASPNET_64_2050727_ASPNETAppsv2050727 for Performance Library ASP.NET_64_2.0.50727 because error 0×80041001 was returned

Event ID: 40
Source: WinMgmt
Description: WMI ADAP was unable to create the object Win32_PerfRawData_ASPNET_64_ASPNETApplications for Performance Library ASP.NET_64 because error 0×80041001 was returned

More details of this issue can be found here:

http://connect.microsoft.com/OpsMgrFeedback/feedback/ViewFeedback.aspx?FeedbackID=328738

These events can occur frequently, and depending on the number of agents and your configuration can become quite bothersome in large environments. The errors are related to a known MS Bug having to do with WMI attempts to query the ASP.Net performance counters, for which no hot fix currently exists. Assuming that on the agent managed host you have no additional needs outside of System Center to monitor the ASP.Net performance counters there are two ways to rid yourself of these errors:

1: Download the Windows 2000 Resource Kit tool "Extensible Performance Counter List" (exctrlst.exe) here: http://www.microsoft.com/downloads/details.aspx?familyid=7ff99683-b7ec-4da6-92ab-793193604ba4&displaylang=en

Install and launch the tool, once you have it open, uncheck the "Performance Counters Enabled" check box for all versions of ASP.Net that you have installed.

2: If you have large environments and installing the tool on each impacted machine is not a realistic option, you can script the registry key that exctrlst.exe is modifying. The net impact of setting the "Performance Counters Enabled" checkbox is that the DWORD Value of "Disable Performance Counters" is set to 1. This DWORD can be located at:
HKLM\SYSTEM\CurrentControlSet\Services\%Insert ASP.net node%\Performance

Note: In some instances this key does not exist and must be created.

Once these changes have been implemented you should see a clean event Application Event log on the impacted server.

• You cannot create a Remote Desktop Protocol (RDP) connection to the server.
• You cannot connect to shares on the server from a computer on the local area network.
• You cannot join a client computer to the domain.
• You cannot connect to Microsoft Exchange Server from a computer that is running Microsoft Outlook.
• You can only connect to Web sites that are hosted on the server or on the Internet by using a secure sockets layer (SSL) connection. In this scenario, you cannot connect to a Web site that does not use SSL encryption.
• You experience slow network performance.
• You cannot create an outgoing FTP connection from the server.
• The DHCP Server service crashes.
• Clients experience slow domain logons.
• Network Address Translation (NAT) clients that are located behind Windows SBS 2003 experience intermittent connection failures.
• You experience intermittent RPC communications failures.
• Clients that are configured as SecureNat clients may be unable to connect to the Internet.
• Some Outlook clients may be unable to connect to Exchange.
• You cannot run the Configure E-mail and Internet Connection Wizard successfully.
• Microsoft Internet Security and Acceleration (ISA) Server blocks RPC communications.
• Clients cannot visit the http://companyweb Web site.
• You cannot browse Internet Information Services (IIS) Virtual Directories.

To combat this issue, here is an excellent .cmd script that was written to revert certain TCP/IP "features" to pre-SP2 functionality, and resolve these problems:

@echo off
REM ———————————————————————————————–
REM Add Registry entries in:
REM HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPIP\Parameters
REM
REM Created By: Bill Miles
REM
REM ———————————————————————————————–
REM — Check OS version, must be 5.1(XP) or greater (Windows 2000 not supported)
FOR /F "usebackq tokens=2 delims=[" %%a IN (`ver`) DO (
REM echo [%%a
FOR /F "usebackq tokens=2 delims= " %%b IN ('%%a') DO (
REM echo %%b
FOR /F "usebackq tokens=1,2 delims=." %%c IN ('%%b') DO (
REM echo %%c.%%d
IF %%d LSS 1 (
echo Current Windows version [%%a not supported!
goto :END
)
)
)
)
SET REGROOT=HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPIP\Parameters
SET REGKEY=unknown
REG ADD %REGROOT% /v TcpWindowSize /t REG_DWORD /d 256960 /f
REG ADD %REGROOT% /v TcpMaxDataRetransmissions /t REG_DWORD /d 10 /f
REM — IF EXIST —
SET REGKEY=EnableTCPA
FOR /F "usebackq skip=2 tokens=1,2,3 delims= " %%a IN (`REG QUERY %REGROOT% /v %REGKEY%`) DO (
REM %%a == Key Name
REM %%b ==
REM %%c == Key Value
echo %%a %%c
IF "%%a" NEQ "%REGKEY%" (
echo %REGKEY% does not exist.
) ELSE (
IF "%%c" NEQ "0×0" (
REG ADD %REGROOT% /v %REGKEY% /t REG_DWORD /d 0 /f
)
)
)
SET REGKEY=EnableTCPChimney
FOR /F "usebackq skip=2 tokens=1,2,3 delims= " %%a IN (`REG QUERY %REGROOT% /v %REGKEY%`) DO (
REM %%a == Key Name
REM %%b ==
REM %%c == Key Value
echo %%a %%c
IF "%%a" NEQ "%REGKEY%" (
echo %REGKEY% does not exist.
) ELSE (
IF "%%c" NEQ "0×0" (
REG ADD %REGROOT% /v %REGKEY% /t REG_DWORD /d 0 /f
)
)
)
SET REGKEY=EnableRSS
FOR /F "usebackq skip=2 tokens=1,2,3 delims= " %%a IN (`REG QUERY %REGROOT% /v %REGKEY%`) DO (
REM %%a == Key Name
REM %%b ==
REM %%c == Key Value
echo %%a %%c
IF "%%a" NEQ "%REGKEY%" (
echo %REGKEY% does not exist.
) ELSE (
IF "%%c" NEQ "0×0" (
REG ADD %REGROOT% /v %REGKEY% /t REG_DWORD /d 0 /f
)
)
)
:END
sleep 12
exit

The script is a great first resort for mysterious network issues and has resolved many production problems in the past. Keep in mind, it requires a reboot to kick into effect.

More information about this bug can be found @ the MS KB Article: http://support.microsoft.com/kb/936594 

MOM 2005: How to Create a Repeat Alert

In MOM 2005 you may have found that it is easy to set up a notification when a service goes down and comes back up, but what if you wanted to get an alert every so often while the service was down until it came back up?

This is something that is much easier to do in SCOM 2007, but if you haven't upgraded to this version yet, you can still make it work with a little bit of effort.

The following gives an example of how you can:

* Check to see if the Print Spooler service is running every 15 minutes
* Create an internal MOM Event ID 12345, if it is not running
* Create an email notification every 15 minutes if it is not running

Create the Script

The first thing you will need to do is go into the Scripts section of the Administration Console and create a new Script. Give it a descriptive name, leave the Language field as the default (VBScript) and paste the following code into the source code area:

'miory 11/19/2007
'Creates MOM Event 12345 if the Print Spooler (Spooler) service is not running
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2")
Set colRunningServices = objWMIService.ExecQuery _
("Select * from Win32_Service where Name='Spooler'")
For Each objService in colRunningServices
If objService.State <> "Running" Then
CreateError "Print Spooler not Running"
End If
Next
Function CreateError(ByVal sMessage)
On Error Resume Next
Dim oScriptErrorEvent
Set oScriptErrorEvent = ScriptContext.CreateEvent()
With oScriptErrorEvent
.EventNumber = 12345
.EventType = EVENT_TYPE_ERROR
.Message = sMessage
.SetEventParameter """PRINT SPOOLER SERVICE"""
.SetEventParameter sMessage
End With
ScriptContext.Submit oScriptErrorEvent
ScriptContext.Echo "ThrowScriptError('" & sMessage & "')"
End Function
‘End Script

You do not need to specify any parameters for the script, so you can just click Finish.
Create the Rules and Alerts

Create a new rule group.

In that new rule group, create the following rules:

1. A Timed Event Rule using the provider name: Schedule every 15 minutes synchronize at 00:00. After the rule is created go to the Responses tab and click Add > Launch a script and then choose the script you created earlier.
2. An Event Rule using the provider name: Script-Generated data. Set the Criteria to with event ID and type 12345. On the Alert tab check the Generate Alert checkbox.
3. Create an Alert Rule and under Criteria select of Severity and then select Critical Error. Next select only match alerts generated by rules in the following group and choose the new rule group that you created earlier. On the Responses tab click Add > Send a notification to a Notification Group. Choose the appropriate group and put a checkmark in Run this response before duplicate alert suppression.

To complete the changes, just right-click on Management Packs and click Commit Configuration Change.

Reference: The Manageability Team Blog

With the release of System Center Operations Manager 2007, the need for repeating notifications still exists. Instead of having to create a script for every single monitor within System Center Operations Manager 2007 that you wish to receive (as was required in MOM 2005), Microsoft has created alert aging notification option which can be used to accomplish this task. The original purpose of the alert aging notification options in System Center Operations Manager is to enable escalation of events, and assist in reducing notification traffic on certain items unless they remain in an unhealthy state for longer than the specified value.

For example:

For reducing notifications of systems becoming unavailable in the event of a reboot where the system will be down for a short period of time and then come back online. The administrator could make use of the alert aging notification options to configure System Center Operations Manager to only send out notifications if the server remains unavailable for longer than the expected time required for a server to reboot. Additionally, the Administrator can setup duplicate notifications utilizing the alert aging notification option to create an escalation path to Sr. administrators if certain events remain in an alert state for longer than a specified amount of time.

By leveraging the alert aging notification options and creating duplicate notification subscriptions , an Administrator can configure System Center Operations Manager 2007 to send out as many notifications as required, in the intervals required.

For example:

An administrator wants to create a notification that alerts upon the failure of a certain monitor. Additionally, the administrator wants the notification to be resent if the alert stays in a failed state for more than 15 minutes after the original notification, and then every 30 minutes up to an hour from the first notification before an alert is sent to the Sr. administrators.

To accomplish this, the administrator will create 5 new identical notification subscriptions related to their desired monitoring group that he or she wishes to monitor with the exception of the Alert aging values, which will be set as follows:

Notification 1: Alert aging disabled

Notification 2: Use alert aging with a value of 15

Notification 3: Use alert aging with a value of 30

Notification 4: Use alert aging with a value of 60

Notification 5: Sr. Administrators will be included on the recipient list, Alert Aging notification turned on with a value of 60.

This method of configuring System Center Operations Manager allows for granular escalation and easy modification of repeat notification requirements on a more global scale than is available through a script based approach.

To correct this problem, first ensure that third-party browser extensions are enabled in Internet Explorer. If you have not properly enabled third-party browser extensions you will see the following error:

Once you have enabled third party browser extensions, launch a web capture session from within the System Center Operations Manager Ops Console. When an instance of Internet Explorer is spawned, do the following to enable the web capture:

Go to Tools –> Toolbars –> Explorer Bar –> Web Recorder:

You should see the web recorder tracking your session on the left hand side of the screen now. Proceed with recording the steps that you need System Center Operations Manager to perform, and click Stop within the web recorder when you are finished. This will take you back to the Operations Console for a summary of the session.

Please keep in mind that System Center Capacity Planner is the official Microsoft sizing tool.

Download

Click here to download the full size PDF poster (5.2MB).

1. Create a .vbs script to monitor the values that we're interested in and return that data to System Center Operations Manager.
2. Create an appropriately scoped Monitor Management Pack Object to leverage the newly created script.
3. Test the Monitor Object for the desired results.

Creating a .vbs script that can interface with System Center Operations Manager 2007 requires adding only a couple of additional steps to your script :

• We need to make sure that the script is leveraging the MOM Scripting API.
• We need to make sure that we return the results of our script back to System Center Operations Manager in a manner that it can understand.

'*******************************************************************************
'*For more guides and scripts visit http://www.mcpguides.com
'*This System Center Operations Manager 2007 Script will monitor a Windows
'*Server and detect if the computer requires a reboot.
'*If no reboot is required, the state will be healthy. If a reboot is required
'*the state will switch to unhealthy.
'*******************************************************************************
'*Configure system parameters and variables
Dim flgRebootNeeded, oAPI, oBAG
Set oAPI = CreateObject("MOM.ScriptAPI")
Set oBag = oAPI.CreateTypedPropertyBag(StateDataType)
Set objSystemInfo = WScript.CreateObject("Microsoft.Update.SystemInfo")
'*******************************************************************************
'*Check reboot value; if objSystemInfo = 0, no reboot is required. If it = -1,
'* a reboot is required.
flgRebootNeeded = objSystemInfo.rebootrequired
If flgRebootNeeded = 0 Then
Call oBag.AddValue("State","GOOD")
Else
Call oBag.AddValue("State","BAD")
End If
Call oAPI.Return(oBag)
'*******************************************************************************
'*End of Script

In the script above, we are monitoring a Windows Server for the "rebootrequired" flag. We are then taking the results of that flag, and passing a "GOOD" or "BAD" string, depending on the results, to a newly created System Center Operations Manager 2007 parameter called "State". Click Read On to contine….

Now we are ready to configure the Monitor Management Pack Object, to leverage this script.

1. Open the System Center Operations Manager 2007 Operations Console.

2. Select the Authoring pane, then expand Management Pack Objects. Right click on Monitors and choose "Create a monitor" then "Unit Monitor".

3. In the following window, expand the Scripting folder, then expand the Generic folder. Select "Timed Script Two State Monitor". Make sure that you create this monitor is the appropriate management pack. If you are unsure, create a new management pack specifically for this monitor in case you need to easily delete it in the future.

4. Provide a logical name and description for the new monitor. Select a Monitor target that makes sense; in this case we'll select the Windows Server target because we want this monitor to watch all Windows servers regardless of version. Finally, select a Parent monitor that makes sense and enable the monitor. In this case leaving it with Availability is appropriate.

5. Select a schedule that is appropriate for the task at hand. Keep in mind that certain scripts, if run too often, could create unwanted performance impacts on the target systems. For this example, we will stick with the default of running every 15 minutes.

6. Enter a logical name for the script that will make it easy to identify if you need to troubleshoot errors in the future. Select a timeout setting for the script; in this case 1 minute will suffice. Paste the script into the script text box, and click Next.

7. For the Unhealthy Event Expression, click "Insert" and select "Expression". For the Parameter name enter "Property[@Name="State"], Select "Equals" for the Operator, and type in "BAD" (or whatever value you used in your script to represent an unhealthy state).

8. For the Healthy Event Expression, click "Insert" and select "Expression". For the Parameter name enter "Property[@Name="State"], Select "Equals" for the Operator, and type in "GOOD" (or whatever value you used in your script to represent a healthy state).

9. Configure the appropriate Health State for your Healthy and Unhealthy script events. In this case because a system that requires a reboot is not a critical event, we will set the Unhealthy state to "Warning".

10. Configure alerting to have System Center Operations Manager populate an alert in the Monitoring pane when the state of this object changes to Unhealthy.

Now that the Monitor creation is complete,switch back to the monitoring pane to verify that the monitor is working properly. Click on a computer in the Computers State View underneath Monitoring. Next, click on the Health Explorer in the actions column in the right hand pane.

You should see your newly created Monitor Object and the state of the monitor in the Health Explorer.