Canberra Premier Field Engineering: Team Blog

Windows Firewall Public profile when using IPsec

JimmyF_Aus — Thu, 16 Aug 2018 12:03:10 GMT

Hi there - Jimmy here with a brief summary of an IPsec / Network Location Awareness interaction issue a customer encountered recently. Hopefully it saves you some time. Symptoms When Windows Server virtual machines were rebooted, they would occasionally fail to identify their local network as Domain profile. The result was that an incorrect set of firewall rules (public profile) were in affect, but otherwise network connectivity seemed fine. Evidence from the logs showed a DNS failure for a DCLocator query during system startup. This is important, as this is what causes the NLA service to indicate this is a Public network rather than a Domain network. It was observed that network connectivity between server and Domain Controller was not fine during system startup, but subsequently the same DNS queries were succeeding. That period of network connection failures happened while the Network Location Awareness service was discovering the network, and now the firewall was inappropriately configured. Other information

IPsec (Connection Security Rules) was configured between the affected system and the Domain controller (DNS server)
The start of the IPsec Policy Agent service appeared delayed when reviewing service start events
The domain controller was configured to log IPsec Driver Audit Failure events, and we consequently observed a number of instances of Event ID 4965 ("IPsec received a packet from a remote computer with an incorrect Security Parameter Index (SPI)") being raised in the Security log of the domain controller coinciding with the restart of the client/server.

What happened? Depending on the speed of the system restart activity (virtual machines can be quick!) the domain controller may still have active IPsec Quick Mode security associations with the restarted host. Network traffic between the hosts may fail until the security association timeout period (5 mins) has expired. The DNS lookup required for Network Location Awareness selection of the Domain profile fails if an old IPsec Quick Mode security association exists between the hosts, according to the Domain Controller, and the query from the NLA service on the client is sent to the DC with which the SA exists. For a better technical description of the mechanics of the issue and what to do about it, check out the following knowledge base article: https://support.microsoft.com/en-us/help/2997061/ipsec-qmsa-is-not-deleted-on-isakmp-notify Jimmy

SCOM - Add network device to network discovery rule via PowerShell

Rafaela Brownlie — Tue, 08 Aug 2017 13:09:14 GMT

I posted a powershell script here to create a new network discovery rule. You can only create one rule per management server, so once created you just update with new devices. The script bellows doesn't create the discovery rule, just adds a single device to a current rule.


# Name: Add-Device-to-Network-Discovery-Rule.ps1
# Written by: Rafaela Brownlie
# Date: 20/06/17
# Description: The script programmatically builds SNMP run as account, and adds a new host/ip to an existing network discovery rule
# $OMFQDN stores the FQDN for the SCOM server
# $HostIP  = Network device ip address
# $networkdiscoveryname = stores the name of the discovery rule to be updated.

# I wrote it for SCOM 2012 R2. I haven't tested on SCOM 2016, but I believe it should work.


$OMFQDN = ""
$hostIP = ""
$networkdiscoveryname = ""

New-SCOMManagementGroupConnection -ComputerName $OMFQDN

Get-SCOMManagementGroupConnection

$mg = Get-SCOMManagementGroup -ComputerName $OMFQDN

$discovery = $mg.NetworkDiscovery.GetNetworkDiscovery($NetworkDiscoveryName)

$Account = Get-SCOMrunAsAccount -Name "SNMPv2 Account"

If($Account -eq $null)
{

Write-Host "Creating account" -ForegroundColor Magenta
# $a = Get-Credential -Message "Enter community string in password field"
Write-Host "Creating account" -ForegroundColor Magenta
Add-SCOMRunAsAccount -Name "SNMPv2 Account" -Description "Account used for Network device monitoring" -CommunityString -String $a.Password
$Account = Get-SCOMrunAsAccount -Name "SNMPv2 Account"
Write-Host "distributing account" -ForegroundColor Magenta
Set-SCOMRunAsDistribution -RunAsAccount $Account -LessSecure

Write-Host "Waiting for account to be created" -backgroundColor Magenta

sleep -Seconds 60
}

$Profile = Get-SCOMRunAsProfile -DisplayName "SNMP Monitoring Account"
Set-SCOMRunAsProfile -Action "Add" -Profile $Profile -Account $Account


Write-Host "creating SNMP host object" -ForegroundColor Magenta
$SNMPCommunity =[Microsoft.EnterpriseManagement.NetworkMonitoring.Snmpv1Community]::create($mg, $account
$snmpHost = New-Object Microsoft.EnterpriseManagement.NetworkMonitoring.SnmpHost

#my snmp host IP addresses.
$snmpHost.Host = $hostIP
$snmpHost.Community = $SNMPCommunity
#you could add more than one host here:
$discovery.Configuration.Seeds.add($snmphost)
$discovery.configuration.Communities.add($SNMPCommunity)


$mg.NetworkDiscovery.UpdateNetworkDiscovery($discovery)
#allow some time for discovery creation
sleep -Seconds 40
#Run the discovery once it's created:
Start-SCOMTask -Task (get-scomtask -name System.NetworkManagement.FullOnDemandDiscovery) -Instance (Get-SCOMMonitoringObject -Class (Get-SCOMClass -DisplayName "Network Discovery Server"))

Windows Server 2016 - Nano Server and how it has changed already

Andrew Nathan — Tue, 18 Jul 2017 10:54:57 GMT

One of the things that I was most excited about working with in Windows Server 2016 was Nano Server. The ability to have super fast, super scalable servers to run infrastructure roles (to me) seemed like an awesome addition particularly given that it was the smallest server footprint we'd ever delivered and booted in record times. I consumed as much information about it as I could. I delivered a few talks on how I thought it would be one of the most adopted new features coming from our new product set and I even encouraged some of my customers to do some proof of concept trials in their Dev environments. Then because IT is constantly evolving, and Microsoft is always listening to our customers and consumers, Nano Server changed before it even really took off. The feedback that we received from customers was that Nano Server was great but that it was primarily being used for Containers and that they wanted it to be even smaller again. So we listened and at Microsoft Build in May 2017 we announced the changes. You can read the announcement here https://blogs.technet.microsoft.com/hybridcloud/2017/05/10/windows-server-for-developers-news-from-microsoft-build-2017/. Now I am fielding questions from my customers and students in my workshops about what the changes mean and how containers can benefit them, but more importantly "what are containers?". So let's deal with those questions (not going to deep dive though haha, just a brief overview): 1 - The changes mean that Nano Server, from the most recent update, will no longer be able to implement Server infrastructure roles. It can no longer, for example, run IIS or DNS in your environments like it could at from the earliest Technical Previews right up until the RTM version. What administrators in particular need to understand is that this update is gearing Nano Server to be more focused on applications and the Dev lifecycle, allowing your environments to be more adaptable and capable of change. Something that has been said to me over and over since I started with Microsoft is "cloud first, mobile first" and these changes to Nano are following that path. Please bear in mind though that any infrastructure capability you wanted to run on Nano you can run on Server Core and we recommend you look at that option. Server Core is much smaller in footprint than the Desktop experience version allowing you to continue to maximise your storage space amongst other great benefits. 2. What are containers and how can they benefit you? (I'll try to keep this as brief as I can) Containers are isolated instances that allow system level virtualisation and they come in two flavours, Windows Containers and Hyper-V Containers. They are independent of each other and are stateless, which means you can easily discard them as required without impacting anything else in your environment but more importantly they can run regardless of the other containers running in your environment. The difference between Windows and Hyper-V containers is essentially in the abstraction of the kernel. Hyper-V containers have their own virtualised kernel which allows for much greater isolation and performance as they don't require access to the host kernel to run. Containers allow your developers and programmers to abstract their applications within your environment which benefits administrators by reducing administrative overhead and benefits Dev teams by allowing them to have dynamic deployments without the need for infrastructure changes. Their apps can potentially deploy anywhere (on prem, in the cloud or on a laptop) as containers are completely portable due to their isolation from the OS. Gone are the days of single app to server scenarios. Containers also benefits the money managers in your organisations because they don't have to outlay for more hardware to support their developers. You can create customer container images or pull down Microsoft and other vendor images from Docker, there is an amazing amount of support out there for them. Additionally container images are available in both Nano and Server Core iterations but the important distinction between the two is that Nano is highly optimised and focused on born in the cloud applications while Server Core is more focused on traditional applications. So there is my brief overview on the changes to Nano and how Containers could benefit you and your teams. I could go on for hours so please feel free to post questions.

SCOM – Remotely update Management Group configuration on SCOM agent via PowerShell

Rafaela Brownlie — Mon, 10 Jul 2017 05:00:32 GMT

One of my customers installed the agent via SCCM and it had a typo in the management group name. This script removes the current management group configuration the agent is assigned to, and adds a new management group configuration with the correct management group name.

$OLDMG = "oldMG"
$newMG = "newMG1"
$MS = "serverOM"
$Agentlist = "computer1",”computer2”,”computer3”
$Agentlist | % {Invoke-command -computername $_ -ArgumentList $oldMG,$newMG,$MS -scriptBlock {
    param($oldMG,$newMG, $MS)
    try {$o = new-object -com AgentConfigManager.MgmtSvcCfg
        #remove old MG name and disable AD integration
        try {
            $oMG= @($o.getmanagementgroup($oldMG))
            if ($oMG.count -ne $null)
            {
                $o.RemoveManagementGroup($oldMG)
                $o.DisableActiveDirectoryIntegration()
                $o.reloadconfiguration()
                write-host "Removed $oldMG from agent configuration" -ForegroundColor Green
                $o=new-object -com AgentConfigManager.MgmtSvcCfg
                $o.getmanagementgroups()
          }
        }
        catch {write-host "MG $oldMG not found" -ForegroundColor Magenta}
        #add new MG Name
        try {$nMG= @($o.getmanagementgroup($newMG))
        Write-Host "agent already configured with $newMG" -ForegroundColor Magenta}
        catch {
write-host "MG $newMG not found. Adding the new MG to agent's configuration" -ForegroundColor Green
            $o.AddManagementGroup($newMG,$MS,5723)
            $o.reloadconfiguration()
            write-host  "$newMG MG has been added to agent" -ForegroundColor Green
            #clear the healthstore cache
            get-service -Name HealthService | Stop-Service
            Remove-Item "C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Health Service Store" -re -Force
            get-service -Name HealthService | Start-Service      
        }
    }  
    catch {write-host "Microsoft Monitoring Agent not installed"}
}
}

I'm always after this script, and I seem to always have re-write it. Maybe next time I need it I'll remember it's here

SCOM - Create new network discovery rule via PowerShell

Rafaela Brownlie — Mon, 10 Jul 2017 01:15:56 GMT

I recently had to setup a lot of SCOM management groups with the same network discovery rule. I soon found out there isn't a powershell cmdlet for it. Of course, it's the kind of thing you don't really need that often, as only one discovery rule is allowed per management server. Anyway, I needed one, so I wrote one, and I hope this saves someone some time in the future.


#
# Name: Udated OM-Create-Network-Discovery-Rule.ps1
# Written by: Rafaela Brownlie
# Date: 20/06/17
# Description: The script programatically builds SNMP run as account, and builds a discovery rule to discover the UPS
# $OMFQDN stores the FQDN for the SCOM server
# $HostIP  = Network device ip address
# I wrote it for SCOM 2012 R2. I haven't tested on SCOM 2016, but I believe it should work.
# the functionality requires the the Operations Manager firewal rules for ping back and snmp enabled.


$OMFQDN = ""
$hostIP = ""


Write-Host "enbling firewall rules for $OMFQDN" -ForegroundColor Magenta
$Netrules = @('Operations Manager SNMP Response','Operations Manager SNMP Request', 'Operations Manager SNMP Trap Listener', 'Operations Manager Ping Response (Echo Response - ICMPv4 IN)')
invoke-command -ComputerName $OMFQDN -Args $Netrules -ScriptBlock {
param($rule1, $rule2,$rule3,$rule4)
$rule1, $rule2,$rule3,$rule4 | %{get-netfirewallrule -DisplayName $_ | set-netfirewallrule -enabled true}
}


#enable scom firewall rules
Get-SCOMManagementGroupConnection | Remove-SCOMManagementGroupConnection


Write-Host "Connecting to SCOM MG $OMFQDN" -ForegroundColor Magenta


New-SCOMManagementGroupConnection -ComputerName $OMFQDN

Get-SCOMManagementGroupConnection

$mg = Get-SCOMManagementGroup -ComputerName $OMFQDN
$resourcepool = get-scomresourcepool -DisplayName "All Management Servers*"

$discovery = $mg.NetworkDiscovery.GetNetworkDiscoveries()

if ($discovery -ne $null){
Write-Host "there is one network discovery for this MS" -BackgroundColor Magenta

break
}

$Account = Get-SCOMrunAsAccount -Name "SNMPv1 Account"

If($Account -eq $null)
{

Write-Host "Creating account" -ForegroundColor Magenta
# $a = Get-Credential -Message "Enter community string in password field"
Write-Host "Creating account" -ForegroundColor Magenta
Add-SCOMRunAsAccount -Name "UPS SNMPv1" -Descrption "Account used for Eaton UPS monitoring" -CommunityString -String $a.Password
$Account = Get-SCOMrunAsAccount -Name "UPS SNMPv1"
Write-Host "distributing account" -ForegroundColor Magenta
Set-SCOMRunAsDistribution -RunAsAccount $Account -LessSecure

Write-Host "Waitin for account to be created" -backgroundColor Magenta

sleep -Seconds 60
}

$Profile = Get-SCOMRunAsProfile -DisplayName "SNMP Monitoring Account"
Set-SCOMRunAsProfile -Action "Add" -Profile $Profile -Account $Account

$ms = (Get-SCOMManagementServer)
#set account distribution to more secure.

Write-Host "creating configuration object" -ForegroundColor Magenta
$networkconfiguration = New-Object Microsoft.EnterpriseManagement.NetworkMonitoring.NetworkDiscoveryConfiguration
$networkconfiguration.DefaultRetryCount = 3
$networkconfiguration.DefaultSnmpPort = 161
$networkconfiguration.SnmpDefaultAutoTimeoutMilliseconds = 1500
$networkconfiguration.IcmpDefaultAutoTimeoutMilliseconds = 500
$networkconfigurationtype = New-Object Microsoft.EnterpriseManagement.NetworkMonitoring.NetworkDiscoveryType
$networkconfigurationtype.value__ = 0
$networkconfiguration.Type = $networkconfigurationtype
Write-Host "creating SNMP host object" -ForegroundColor Magenta
$SNMPCommunity =[Microsoft.EnterpriseManagement.NetworkMonitoring.Snmpv1Community]::create($mg, $account
$snmpHost = New-Object Microsoft.EnterpriseManagement.NetworkMonitoring.SnmpHost

#my snmp host IP addresses.
$snmpHost.Host = $hostIP
$snmpHost.Community = $SNMPCommunity
#you could add more than one host here:
$networkconfiguration.Seeds.add($snmphost)
$networkconfiguration.Communities.add($SNMPCommunity)
Write-Host "creating discovery object" -ForegroundColor Magenta
$networkdiscovery = new-object Microsoft.EnterpriseManagement.NetworkMonitoring.NetworkDiscovery
#Name of the discovery rule:
$networkdiscovery.DisplayName = "NetoworkDiscovery"
$networkdiscovery.Enabled = $true
$networkdiscovery.MonitoringServerPool = $resourcepool
$networkdiscovery.Configuration = $networkconfiguration
$networkdiscovery.NetworkDiscoveryAgent = Get-SCOMClassInstance -Class (Get-SCOMclass -DisplayName "health service") | where displayname -eq $OMFQDN

Write-Host "creating Disccovery rule" -ForegroundColor Magenta
$mg.NetworkDiscovery.InsertNetworkDiscovery($networkdiscovery)
#allow some time for discovery creation
sleep -Seconds 40
#Run the discovery once it's created:
Start-SCOMTask -Task (get-scomtask -name System.NetworkManagement.FullOnDemandDiscovery) -Instance (Get-SCOMMonitoringObject -Class (Get-SCOMClass -DisplayName "Network Discovery Server"))

Change OMS Log Analytics Retention Period in the Azure Portal

Rafaela Brownlie — Wed, 25 Jan 2017 01:51:34 GMT

Where previously you could only change the retention settings for OMS Log Analytics using PowerShell, now you can do it using the Azure Portal. The Log Analytics retention settings allow you to configure a minimum of 31 days (if not using a free tier) up to 730 days. Login to https://portal.azure.com then go to Log Analytics, select your workspace name, then select Retention. Slide the bar to your desired number of days, then save it! You can find more information on pricing here: https://azure.microsoft.com/en-us/pricing/details/log-analytics/

Change “Create Request” button-label on SCSM 2012 R2/2016 HTML5 Portal to “Create Incident”

arbappy — Fri, 09 Dec 2016 21:27:12 GMT

Default HTML5 portal, has button labelled “Create Request” which in default configuration opens the Generic Incident form to create Incident. The label creates confusion to user as it is used for Incident, not for Service Request. We can change the label to “Create Incident” by modifying the resource file as explained in this blog.

Note from Product team: “We allow the customers to modify their display strings from the resource files, but these changes can get replaced if any future updates contain addition of new strings and/or modifications in that resource file. Please set this expectation with the customer that they might will need to make these string changes again after such update(s). To preserve the modifications, you can keep the copy of modified resource file, which can be later used for comparing whenever the original file gets replaced.”

Steps:

Open SelfServicePortalResources.resx file in Notepad from C:\inetpub\sswwwroot\SelfServicePortal\App_GlobalResources:

Go to the following section:

Create Request

Change data name = “CreateIncident” and tag to “Create Incident”

Create Incident

Save the file and exit.

Open Offerings.cshtml in Notepad from C:\inetpub\wwwroot\SelfServicePortal\Views\Home folder:

Find “.CreateRequest” button section/tag and rename @Resources.SelfServicePortalResources.CreateRequest to @Resources.SelfServicePortalResources.CreateIncident

From: To:

Save and exit.

Refresh or reopen the portal. The button should labelled as "Create Incident".

OMS Search Query Command “Display”

Rafaela Brownlie — Fri, 18 Nov 2016 04:13:16 GMT

Saved searches has been in OMS Log Analytics since the beginning. Though if you preferred a specific display type, you couldn't save that as part of your search.

Now the OMS team has introduced a new command named "Display" allowing you to choose how you display your results directly from your query.

There are 3 new "Display" options in OMS search syntax:

Display LineChart

Display StackedBarChart

Display Table

LineChart

Type=Perf (ObjectName=Processor) Computer=SCOM* | measure avg(CounterValue) as Average by Computer Interval 10Minutes | Display LineChart

StackedBarChart

Type=Perf (ObjectName=Processor) Computer=SCOM* | measure avg(CounterValue) as Average by Computer Interval 10Minutes | Display StackedBarChart

Table

Type=Perf (ObjectName=Processor) Computer=SCOM* | measure avg(CounterValue) as Average by Computer Interval 10Minutes | Display Table

Great job team! Looking forward to more display options!

Maintenance Mode for OMS Alerts

Rafaela Brownlie — Wed, 16 Nov 2016 02:14:51 GMT

Azure Automation Runbook to enable and disable OMS Alerts

OMS is a hyper scale, hybrid and heterogenous monitoring system which can alert on thresholds from any system anywhere. The alerting can be either an email notification, a webhook or even a runbook. Now what happens when you want to suspend alert during a maintenance window? SCOM has the ability of pausing workflows and suspending alerts for a period. In OMS you would have to disable the alerts one by one: Or you can trigger or schedule a runbook to do it for you! This blog takes you step by step on setting your runbook to start or stop a maintenance window. First things first. You’ll need:

OMS workspace with alerts configured
Azure Automation

That’s it!

Step 1 – Create your SPN for authentication:

I use a service principal get a token for authentication. You can find more details here: https://docs.microsoft.com/en-us/azure/resource-group-authenticate-service-principal You can create it in the new portal, or via powershell:

$app = New-AzureRmADApplication -DisplayName "{app-name}" -HomePage "https://{your-domain}/{app-name}" -IdentifierUris "https://{your-domain}/{app-name}" -Password "{your-password}"

New-AzureRmADServicePrincipal -ApplicationId $app.ApplicationId New-AzureRmRoleAssignment -RoleDefinitionName Contributor -ServicePrincipalName $app.ApplicationId.Guid Or via the portal: Click on Azure Active Directory, then choose “App Registrations”: Click on Add, enter a name for the app, choose “Web App / API” and choose a Sign-on URL, then click on Create. Click on the app, then settings and then “Keys”. Create a new key and click on save. Make sure you copy the key before you close the blade Take note of the AppID and run this powershell line: New-AzureRmRoleAssignment -RoleDefinitionName Contributer -ServicePrincipalName $app.ApplicationId.Guid

Step 2 – Add Assets to your Automation Account:

Add a connection asset for your SPN, with your Subscription ID, your Tenant ID, the SPN Application ID, the Application key (in the certificate thumbprint) called 'AzureRunAsSPN': Add a variable for your OMS workspace details called "OMSWorkspaceName": And another one for the name of the resource group for your OMS called "OMS-Resource-Group-Name":

Step 3 – Create your runbooks:

Create a Powershell runbook, called “Start-OMS-MaintenanceMode” with the following code:


$AlertsEnabled = "false"

$OMSResourceGroupId = Get-AutomationVariable -Name 'OMS-Resource-Group-Name' $OMSWorkspaceName = Get-AutomationVariable -Name 'OMSWorkspaceName'

$SPNConnection = Get-AutomationConnection -Name 'AzureRunAsSPN'
$SubscriptionID = $SPNConnection.SubscriptionId
$TenantID = $SPNConnection.TenantID
$AzureUserNameForOMS = $SPNConnection.ApplicationId
$AzureUserPasswordForOMS = $SPNConnection.CertificateThumbprint

#region Get Access Token
$TokenEndpoint = {https://login.windows.net/{0}/oauth2/token} -f $TenantID
$ARMResource = "https://management.core.windows.net/";

$Body = @{
'resource'= $ARMResource
'client_id' = $AzureUserNameForOMS
'grant_type' = 'client_credentials'
'client_secret' = $AzureUserPasswordForOMS
}

$params = @{
ContentType = 'application/x-www-form-urlencoded'
Headers = @{'accept'='application/json'}
Body = $Body
Method = 'Post'
URI = $TokenEndpoint
}

$token = Invoke-RestMethod @params -UseBasicParsing
$Headers = @{'authorization'="Bearer $($Token.access_token)"}
#endregion

#get all saved searches
$savedSearches = (([string] (Invoke-WebRequest -Method Get -Uri "https://management.azure.com/subscriptions/$SubscriptionID/Resourcegroups/$OMSResourceGroupId/providers/Microsoft.OperationalInsights/workspaces/$OMSWorkspaceName/savedsearches?api-version=2015-03-20" -Headers $Headers -ContentType 'application/x-www-form-urlencoded' -UseBasicParsing).Content) | ConvertFrom-Json).Value.id

foreach ($savedSearch in $savedSearches)
{
#call for schedules associated with the saved searches
$schedules = (([string] (Invoke-WebRequest -Method Get -Uri "https://management.azure.com/$savedSearch/schedules?api-version=2015-03-20" -Headers $Headers -ContentType 'application/x-www-form-urlencoded' -UseBasicParsing).Content) | ConvertFrom-Json).value
#check if the saved search has a schedule
if ($schedules -ne $null)
{
$schedules.value.Properties.Enabled = $AlertsEnabled
$scheduleurl = $schedules.value.id + "?api-version=2015-03-20"
$body = $schedules | ConvertTo-Json
#set new property to schedule
Invoke-WebRequest -Method Put -Uri "https://management.azure.com/$scheduleurl" -Headers $Headers -ContentType 'application/json' -Body $Body -UseBasicParsing
}
}

You can now associate whatever schedule to suit you. To stop maintenance mode, create another runbook called “Stop-OMS-MaintenanceMode”, changing the following line in the code: From $AlertsEnabled = "false" To $AlertsEnabled = "true"

Hide Recommendations from your OMS SCOM Assessment dashboard

Rafaela Brownlie — Fri, 11 Nov 2016 00:04:54 GMT

OMS Log Analytics can now provide insight on the health and risk of your SCOM management groups. The System Center Operations Manager Assessment solution is now in public preview. The solution is based on Microsoft's Proactive Premier Services which provides customers with report and analysis of health and risk issues on Microsoft's technologies stack at a certain point in time. With OMS you can now get a subset of this report every 7 days. Because you're using SCOM to run the assessment, you can also change the behaviour of the assessment by using overrides: https://blogs.technet.microsoft.com/momteam/2016/11/10/public-preview-of-system-center-operations-manager-assessment-solution-on-operations-management-suite-available/ You can also ignore issue items from your dashboard if you want to:

Creating an IgnoreRecommendations.txt text file on each management server you want to ignore on - SystemDrive:\Program Files\Microsoft System Center 2012 R2\Operations Manager\Server.
Find the RecommendationId you want to ignore in your OMS workspace: Type=SCOMAssessmentRecommendation RecommendationResult=Failed | select Computer, RecommendationId, Recommendation | sort Computer
Paste or type each RecommendationId for each recommendation that you want OMS to ignore on a separate line and then save and close the file.