Note:- Please get the environment setup from previous blog. https://blogs.technet.microsoft.com/chandanbharti/2017/04/27/advanced-threat-analyticsata-deployment-steps-part-i/

• Login to the client machine with user account and open a cmd prompt window and type nslookup -->ENTER

• Hit exit on cmd prompt to close the window.
• Log in to ATACenter VM and browse to https://10.1.1.6
• check notification

• You should see the activity of DNS activities has been logged.It should be logged with "Reconnaissance Using DNS" suspicious activity. Navigate around to check the severity and more information about this.

• You should be able to get the details view to get more details.

• Login to client machine and on cmd prompt, type nslookup -->ENTER
• Type "ls hallo.com" -->ENTER
• Type fabricam.com -->ENTER

• Move over to ATACenter VM and browse to console https://10.1.1.6
• Notice the suspicious activity recorded,

• Check the details of each activity that you see and also time stamp on it.

• Login to client machine again with HoneyToken user

Note: HoneyToken user is the account that is inactive and not used, I have created an account with name Fake User (CONTOSO\ADMINUSER). Whole idea is to check what if suddenly an inactive account gets active one fine day and tries to log in to resources.

• Please use password something like WWAATT which is not correct, and i want to make an unsuccessful attempt.
• Now lets go to ATA center and log into console https://10.1.1.6. You should see something like this

• Go to details and severity. Most common resolution is suggested and also you should see some action that you can perform.

• Login to DC with domain admin and run dsa.msc to open users and computers console.
• Navigate to User account OU and select all the user and delete them.

• Once done, close the user and computer console.
• Go to ATAcenter console https://10.1.1.6 and check the notification. It should show something like "Massive object deletion Alert"

• Log into the client machine. (Please download sysinternal tools and save it in a folder in client machine.)
• At command prompt, type "psexec \\dc notepad.exe"  (note: note that an account is trying to make a remote connection and execute a command)
• Exit out of command prompt and log into ATACenter console.

• Go through the details of the activities to understand it better.

• Log in to client CM and open a command prompt
• Type these 2 commands. "net user /domain" and "Net group /domain"
• connect to ATA center console and check on activities you may have received named "Reconnaissance using directory services enumeration"

• Go through the details to get better understanding.

Note:- We are trying to simulate few scenarios that is usually performed during a cyber attacks. These rules can be modified and created at will.

• In Hyper-V manager, go to settings for DC -->Advanced features -->Port mirroring.
• Change the mirroring mode to Source from drop down menu.

• Connect to ATAGateway and note down MacAddress. (Remember to have 2 network adaptor for ATA gateway server and i am checking Mac address of 2nd adaptor named capture)

• Scroll down for this adaptor and enable mirroring mode to set it as destination.

• To verify your port mirroring is success and correctly configured, you can use network monitor tool.

Note: ATAGateway server should be able to query DC via LDAP using the account credentials that ATA is going to use. this is necessary to retrieve the users, computers and other objects. This is a requirement. I will use LDAP connection from ATAGateway to DC using account contoso\ATAService. This account will need read permission to access all object that will be monitored.

• On ATAGateway VM, run LDP.exe
• On connection, client connect on top left corner and enter your DC name. in my case its DC.Contoso.com -->OK

• Again click on connection and select Bind -->Bind with credential--> Enter. Input credential (Contoso\ATAservice) and click OK, notice the output as you will be expecting when all is good

Note: If you click on view and expand Tree, you should see objects of domain.

• On elevated cmd prompt, type the command 'dsacls "CN=Deleted Objects,DC=Contoso,DC=Com" /takeownership'  -->ENTER. this will take ownership on deleted object container.

• Again on elevated cmd prompt type: dsacls "CN=Deleted objects,DC=Contoso,DC=com" /G CONTOSO\ATAService:LCRP  -->ENTER to grant permission to view objects

Note: Upto this point, we have completed our pre installation steps of ATA. Next we will go with installation. Lets start with Step4

• Run the downloaded setup file.

• As you move forward accepting the EULA with default steps and you reach to below page, Enter details.

Note: 

1. ATA center service IP address is used by ATA Gateway to communicate with ATA Center. ATA console IP is used to connect to ATA console. As you install Gateway, ATA Gateway will register with ATA center using ATA Console IP on port 443

2. In case you have one IP address, you can modify the port number used by ATA center service. ATA console will always use 443

3. In production, we recommend you to use PKI cert instead of self signed certificate.

• Launch the page by hitting on launch after completion message. Click Continue to this website(not recommended) hyperlink to continue.

• Enter credential in directory services page

• On PS prompt, type: Get-AdUser Admin -->ENTER to get SID

• Copy the SID and paste under detection settings -->Save  (Don't forget to hit on + next to ID before saving)

Note: We are done with configuration. Next we will install ATA Gateway

• On ATAGateway server, go to URL https://10.1.1.6 (Console IP address)
• Click on "Download Gateway setup and install the first Gateway" --> save the file
• Extract the file and run the setup.

Note:-.Net framework 4.6.1 has to be preinstalled. if preinstalled, it will avoid reboot while installation of ATA Gateway.

• Select the available option as below after you pass welcome window.

• In the next page, we will create a self signed certificate. and enter user name and password -->Install

Note:-The user account is set for gateway and is domain admin here.

• Launch once install is completed.

• Once you hit Launch in previous step, the page opens. and you see the status of gateway below. Click on Not Configured

• Enter the information as below. And select Capture check box (Remember 2 network adapter of ATA gateway from above and we are selecting second adapter) -->Save

• Verify "Microsoft Advanced Threat Analytics gateway" service is running, this may take long time before it reaches to running from starting.

• Once service is started, verify if user and computer are synced in ATA console.

Note: Once we have ATA gateway installed, we will setup our lightweight Gateway.

• On DC2, browse to console IP https://10.1.1.6 and download gateway setup and save it.
• Run Microsoft ATA Gateway setup.exe. (Remember to extract it and not run from zip file)
• Setup automatically identifies already installed ATAgateway and asks you to install lightweight gateway.

• Enter credential as you did for ATAGateway.
• Once done, service will turn into running.

Note:- First time the service starts will take approx. 15-20 min until it turns from starting to running.

Hope you remember the steps to integrate Intune with configmanager

This is part 2 in the series. My intention is to make your device safe, secured and encrypted.

 So what I have for you here is to set policies for your mobile device that has been enrolled. You wouldn’t want the device that has company emails and information to be left without password. correct ?. Here I am going to show you, how you can enforce those policies. We have very limited number of steps here

1. Create a configuration item for the mobile device
2. Create a baseline for the device
3. Deploy

 We ll discuss these in detail. Lets start,

Step 1: Go to Assets and Compliance -> Compliance settings --> configuration Item and create a new Configuration Item.

Remember to select Mobile Devices as type of configuration Item.

At this point, I am just going to select Password. You can definitely play around with different option.

You see a lot of them, Just make password setting as required and define a minimum length of password.

We are set with Configuration Item created

Step 2:  Go to Assets and Compliance -> Compliance settings -->Configuration Baselines  and create a new baseline and associate the CI that you created in step 1.

Step 3: In Part 1, we created a collection of users, lets target the baseline to this collection. Additionally follow below option for the obvious reasons

Believe it or not, but we are done. Isn't that so simple :)

What's going to happen now? As soon as the device is enrolled, the policies are enforced and you are prompted to perform even if you don’t want to.

This is all about how you manage your mobile device over cloud.

Any feedback? Please add to the comment section

Please check out part one of this series for Mobile device management

-Chandan Bharti

Premier Field Engineer-Microsoft

This blog is all about integration between configmanager 2012 and Intune to manage and deploy application on mobile device. We have our setting, users and app saved at cloud in extremely secured way. We would definitely like to be trusted by our customer and partners in terms of cloud, Devices and Security handling. To achieve that, we understand the importance and take our extreme steps to maintain privacy. Let’s get started with the steps of integration.

  Part  2 is published for configuring the client settings, do look at that too.

1)  Register to Windowsintune.com as a trial account

2)   Add Cloud UPN that you got after above registration, in my case, its Chandan.bharti@chandanbharti.onmicrosoft.com. So my UPN is chandanbharti.onmicrosoft.com

Open active directory domain and trust--> Properties, and add the UPN

3)  Change UPN for the existing users in AD

Go to active directory users and Computers, and change the UPN for the users that needs to access the portal later. You can script it to make change if you have many users. That way to avoid any manual work

4)  After you are done with AD, if you log in to https://account.manage.microsoft.com/ with your credentials, you have to Install and configure the Directory Synchronization tool.

Download the tool from https://g.microsoftonline.com/0BX10en/571 and install it. Installation would take 10 min to complete. Below is a run through directory sync configuration.

Enter the credential that you used to log into Intune subscription.

In the next screen, you have Domain credential, Basically domain Admin in form of domain\user

Rest are going to be straight forward options. Also let the passwords sync. This process takes 10 min, Monitor the event log to check if sync has gone well and what has synced,

5)  In Configmanager 2012 console, create a collection for the users that you would like as target

In my case, I have created collection "My Intune UserCollection"

6)  Add the subscription that you created now in your configmanager console

Sign in with your Intune account that you are registered with

Next, you are asked to configure your settings. I have created collection "My Intune UserCollection" as a target.

For the moment, I am selecting Android device, Reason being, Android has no certificate requirement. But others have, for one month trial account, you don’t need certificate for Windows phone 8 as well. We will make use of this at later point, for now let's go next with below setting as shown.

This needs the support team contact information (Optional)

7)  Add the site system role "Windows Intune Connector" on your site server.

You can monitor the log file if the installation was a successful . Log File:  Connectorsetup.log

This is to be done in CAS

Looks like role is setup successfully.

Remaining steps are for creations of apps and deployment to user collection.

Basic steps are

a) Create application for Company portal

b) Create application for the mobile app

c) Deploy these application

Let’s start:

8)  Download below tool for the purpose that is defined below. Basically this contains your sample apps and company portal.

https://www.microsoft.com/en-sg/download/details.aspx?id=39079

I have installed it at C:\Program Files (x86)\Microsoft\Support Tool for Windows Intune Trial management of Windows Phone\Support Tool

Install it on configmanager server.

9)  Now create an application for windows phone (*.xap) with the normal method

We have targeted company portal to the user collection that we created

Now we have to add the application in Intune subscription that we already created.  Remember you were told not check the box for windows phone 8 at above line.  Notice below, it’s unchecked. But that’s not what we want. but not our end goal.

10)  Open cmd prompt run as administrator and cd to location where support tool is installed.

C:\Program Files (x86)\Microsoft\Support Tool for Windows Intune Trial management of Windows Phone\Support Tool

This is to activate your trial certificate for Windows phone 8. Run below command

C:\Program Files (x86)\Microsoft\Support Tool for Windows Intune Trial management of Windows Phone\Support Tool>ConfigureWP8Settings_Field.vbs <SiteServerName> querysspmodelname

Output: Operation completed successfully

Now we are going to save settings using company portal ID. This ID is your application ID from the console. Also termed as Company Portal ID

ScopeId_5A69269C-EFC8-4996-AD73-FCABAECD20CC/Application_0904feff-40b7-8844f38a6760a58b

C:\Program Files (x86)\Microsoft\Support Tool for Windows Intune Trial management of Windows Phone\Support Tool>ConfigureWP8Settings_Field.vbs <SiteServerName>

savesettings ScopeId_5A69269C-EFC8-4996-AD73-FCABAECD20CC/Application_0904feff-7c83-40b7-8844-f38a6760a58b

Now if you visit intune subscription properties back,

Notice, Windows Phone 8 Enrollment is enabled.

****Optional****

Optional step: Only when you have certificate for device in production scenario.

Command line to codesign the application:  If you have certificate for windows Phone 8 in production scenario, You may have to code sign the company portal application.

c:\Windows\System32>XapSignTool.exe sign /f "<Certificate file.PFX>" /p <Password> "<Path of company portal or application ex. ssp.xap>"

Now to check if application is signed, go to properties of Xap file and check Digital Signature tab for the file.

Idea of company portal is to show LOB application, contact info for the company, you can create your own company portal as well. The one that you download from Microsoft is just a sample.

 ****Optional****

11)  Create an application for windows phone. Select below option.

I have selected the one from below location that’s where my support tool is installed

\\CM12CAS\c$\Program Files (x86)\Microsoft\Support Tool for Windows Intune Trial management of Windows Phone\Sample Apps\ClickMeV1.1.xap

Finish the wizard

And deploy this application to user collection that was created at the initial stage.

With Intune subscription, we have cloud DP created automatically. Distribute it to the cloud DP

Once distributed. You need to look at the log "outgoingcontentmanager.log" if the content is successfully distributed to cloud DP.

Now you can deploy the application to the user collection, Remember option of available or required is based on the supportability for the devices. Leave it available for now.

Creating an application from windows app store

============================================

Go to Microsoft  store for apps and pick up the URL

My app address is:

https://apps.microsoft.com/windows/en-us/app/tour-spain/258839b5-88ed-4154-bf83-93912dc03257

In configmanager console, just create a new application from windows store as shown below. And location should have the URL of the application that you copied above,

Complete the wizard

Deploy the application, you don’t need to distribute it to the DP, because it’s from cloud and is already distributed

Here completes you server side configuration and activities.

Now we are going to enroll the devices and application. Your Intune solution is in cloud

================================================

12)  Add account in windows phone 8,  

Go to settings -->Workplace-->Add account

 Add the user name that we migrated from AD to Intune

Click next and add the server name. For the demo, the server name is going to be. Server name: enterpriseenrollment-s.manage.microsoft.com

User name is going to be in format of user@chandanbharti.onmicrosoft.com

This is how it may look

You should see the device under mobile device in the Configmanager 2012 console :)

And we should be good. We are all set to manage our mobile devices on cloud :)

I am going to sleep now, when i wake up. i will post another one for  compliance settings that you can configure for mobile devices  and i am sure, you are going to enjoy reading that.

Any Feedbacks or comments are welcome!!

Few important stuffs that you need to know on reliability on support we have for intune You can follow the link to understand overall process with support involved. https://technet.microsoft.com/en-US/library/dn646963.aspx

-Chandan Bharti, Premier Field Engineer-Microsoft

Linux client installation is straight forward when the site is on HTTP, https://blogs.technet.com/b/chandanbharti/archive/2013/06/26/package-deployment-amp-hardware-inventory-for-linux-in-configmanager-2012-sp1.aspx

I have illustrated Linux client installation when the site is on HTTPS.

Before you go for client install, Make sure you have PKI in place. Refer https://technet.microsoft.com/en-us/library/gg682023.aspx

Create a Linux template by duplicating Workstation template. Make the private key exportable, also make the Subject "Supply in the request".Issue the new template.  This part doesn’t have a section in the above document like the Windows and Mac clients do.

Important note: Linux client should always be named with FQDN. It cant be short name. DomainHostName command should return the domain name info.

Lets Start,

STEP 1:  Generate host.key and host.csr on linux client.

openssl req -newkey rsa:2048 -nodes -keyout host.key -out host.csr -subj /CN=RHEL55A.AB.COM

You have host.csr file available at the same location, open the file and you should see below content.

STEP 2: Issue a cert using the contents of the CSR on the Windows CA Cert Server website, using the new Linux template. Copy the content and paste it at the request page to generate the certificate.

 Navigate to below path on the page.

https://Servername/certsrv --> Request a certificate--> advanced certificate request --> Submit a certificate request by using base-64-encoded

Choose base64 when you download or you will have to convert the DER separately. You can save it as host.cer

Save the certificate as host.cer.

STEP 3:  Copy host.cer from step 4 to the Linux host and combine host.key, host.cer, and your CA chain (all of it if you have a subordinate CA as well, mine was provided as base64)  to create a .pfx file :

openssl pkcs12 -export -in host.cer -inkey host.key -certfile RootCA.cer -name host -passout pass:1234 -out host.pfx

I get .pfx file that I can use with installation of client. 1234 is going to be the password of .pfx file.

-name is the friendly name that can be the name that you like.

Now that I have it,

STEP 4:

Download the Configmanager client for Linux, extract and place it at same location where I have other certificate.  It's not mandatory to have same path, but was convenient for me

Now let's try installing the client using .PFX file that we created last.

./install -mp pri.ab.com -sitecode PRI -UsePKICert host.pfx -certpw 1234 -httpsport 443 -NoCRLCheck ccm-Universalx64.1.0.0.4580.tar

And this is what you should see once the installation completes.

=======================================================================================

Checking Prerequisites...

Checking existence of /lib/libssl.so.0.9.8e-fips-rhel5 and /lib/libcrypto.so.0.9.8e-fips-rhel5 ...

Checking existence of /lib/libssl.so.0.9.8--5 and /lib/libcrypto.so.0.9.8--5 ...

Checking existence of /lib/libssl.so.0.9.8e and /lib/libcrypto.so.0.9.8e ...

  Found /lib/libssl.so.0.9.8e and /lib/libcrypto.so.0.9.8e ...

Running preinstall validator

All pre-install tests succeeded!

Beginning installation of Config Manager in /opt/microsoft/configmgr

Creating install directory...

Extracting archive file to /opt/microsoft/configmgr...

Installing OMI

Generating a 2048 bit RSA private key

.+++

..............................................+++

writing new private key to '/opt/microsoft/omi/etc/ssl/certs/omikey.pem'

-----

Successfully installed OMI under: /opt/microsoft/omi/.

Checking existence of /lib/libssl.so.0.9.8e-fips-rhel5 and /lib/libcrypto.so.0.9.8e-fips-rhel5 ...

Checking existence of /lib/libssl.so.0.9.8--5 and /lib/libcrypto.so.0.9.8--5 ...

Checking existence of /lib/libssl.so.0.9.8e and /lib/libcrypto.so.0.9.8e ...

  Found /lib/libssl.so.0.9.8e and /lib/libcrypto.so.0.9.8e ...

Setting CM_HOME in omiserver...

Disabling HTTP Ports...

Modifying install scripts for OMI

Registering Providers...

Created /opt/microsoft/omi/./etc/omiregister/root-cimv2/scxcmprovider.reg

Performing post installation cleanup...

Linking startup script...

Initializing data store.  This may take a few minutes...

Importing the Client Signing certificate...

CRL validations will be ignored.

Loading & validating the certificate

Successfully verified the Client certificate.

Imported the issued certificate to the store.

Installing boot-time scripts...

Starting Configuration Manager...

Installation complete.

[root@RHEL55A Linux-Chandan]#

=======================================================================================

And you should see the machine in the Configmanager console.

Remember, you don’t need to approve the client manually as you have while you install the client on HTTP.

In 5-10 min, you should see the inventory available in the resource explorer.

Linux client is ready to communicate to site on HTTPS :)

-Chandan

Many a times we get a requirement on how to restrict a user
only to do a specific action in the console. In our case, we want a non admin
user to perform two operations

1)     Import computer information

2)     Operating system Deployment

We don’t want the user to view the “All system collection”
but still wants to import a computer and target a Task sequence. So let’s get started!

Considering you already have a user account created in AD

1)     Create two collections “OSD Test” and OSD Test2.
Note down the limiting collection of both the collections.

 
  
  
  
  
In my case, I have limiting collection for
OSD test, you can use limiting collection based on the department name such as
Finance, HR, etc. Limiting collection of OSD Test2 is OSD test.

2)     Create administrative users. Administration-->Security-->Administrative Users

I have created user named AB\User.

3)     Under Security Roles, Make a copy of “Infrastructure
Administrator” role and name it as “Modify Collection” and disable every other
permission except collection permission.

4)     Under administrative users, go to properties of
AB\User we created in Step2 and under Security Roles, add below two roles.

And under Security Scopes, Add OSD Test and
Default under instance selection.

5)     Now open a console with the user AB\User and
navigate to Asset and Compliance and check if you are able to see “OSD test”
and “OSD test2”. Make sure that “OSD Test” is not modifiable but “OSD Test2”
is. You can check by getting into properties of each of these two collections.

6)     Point to Devices under Assets and Compliance and
on the top left, import Computer Information. In my case, I tried importing a
single computer

Under Choose Target collection, select the
available collection “OSD Test2”. And in a while, you should be able to see
MyComputer under “OSD test2” collection. Need patience here J

Now you are good to Deploy TS to the
collection with your restricted user account.

So the idea here is to grant access to the
users who are separated by region or departments. And also that I wanted to
show you how RBAC works and the way you control the access using this.

Will be happy to see if you have any feedback or
would like to see more information.

Disclaimer:  This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at https://www.microsoft.com/info/cpyright.htm

Before we go ahead with the SW deployment in a Linux machine, we should be aware of supported options https://technet.microsoft.com/en-us/library/jj573943.aspx

i deployed the client,  but for some reason, i am unable to see the client in the console, that's when we refer the logs on what went wrong. it may be a single scenario but can have multiple approaches.

after installing the client, i noticed the log located @ /var/opt/microsoft/scxcm.log

SCXCM.log
===========
2013-06-22T02:38:34,908Z Error [NetworkInterfaceInfo:1162:5575:47424302669776] for net device sit0 can not map sa_family to AdapterType, sa_family is : 776 LinuxUNIXClient 6/22/2013 8:08:34 AM 1884737912 (0x7056D178)
2013-06-22T02:38:54,544Z Info [scx.client.core.CCMExec:611:5824:47981362380752] Requesting for Policy assignment request and evaluation run LinuxUNIXClient 6/22/2013 8:08:54 AM 3379970920 (0xC9764368)
2013-06-22T02:39:30,929Z Error [scx.client.messaging.HttpBroker:219:5575:1114495296] FAILURE on socket transmission! LinuxUNIXClient 6/22/2013 8:09:30 AM 1114491832 (0x426DCBB8)
2013-06-22T02:39:30,929Z Error [scx.client.messaging.HttpBroker:148:5575:47424302669776] Failed to connect to server : pri.ab.com On port 80 LinuxUNIXClient 6/22/2013 8:09:30 AM 1884738296 (0x7056D2F8)

As the error suggests, i tried telnet to the site server on port 80 from Linux machine and i see failure. so aim is to fix that. Once done, i could see the clients appearing in console and go ahead and approve it. If you need more information or detailed logging, you may very well enable TRACE.

Simply edit /opt/microsoft/configmgr/etc/scxcm.conf from WARNING to TRACE at two locations in the conf file and restart the service "service /etc/init.d/ccmexecd restart".

As long as the service is not being used or unable to connect to site server, the service ccmexecd will remain stopped, if you try to start it, you may see below error scxcm.log. So the service crashes here.Maybe

><06-22-2013 08:14:34.000+330><thread=47580187459536 (0x7fffe8f61998)>
terminate called after throwing an instance of 'CCM::Client::Messaging::MessengerException'

If you try to initiate the policy, say HW inventory policy "/opt/microsoft/configmgr/bin/ccmexec -rs hinv"

[root@localhost init.d]# Logging Configuration File for SCX CM::/opt/microsoft/configmgr/etc/scxcm.conf
Schedule with id : {00000000-0000-0000-0000-000000000001} was not found. Could not trigger.

This only means that the HW inventory policy is not identified.

After restarting the service "service /etc/init.d/ccmexecd restart", Monitor the log under "/var/opt/microsoft/scxcm.log"

2013-06-22T05:55:59,370Z Trace [scx.client.agents.inventory.InvDataStore:786:6473:1088377152] Inventory report preparation has begun for class Win32_Service LinuxUNIXClient 6/22/2013 11:25:59 AM 1088359560 (0x40DF0C88)
2013-06-22T05:56:00,770Z Trace [scx.client.agents.inventory.InvDataStore:786:6473:1088377152] Inventory report preparation has begun for class Win32_NetworkAdapter LinuxUNIXClient 6/22/2013 11:26:00 AM 1088359560 (0x40DF0C88)
2013-06-22T05:56:00,848Z Trace [scx.client.agents.inventory.InvDataStore:786:6473:1088377152] Inventory report preparation has begun for class Win32_ComputerSystem LinuxUNIXClient 6/22/2013 11:26:00 AM 1088359560 (0x40DF0C88)
2013-06-22T05:56:00,872Z Trace [scx.client.agents.inventory.InvDataStore:786:6473:1088377152] Inventory report preparation has begun for class SMS_Processor LinuxUNIXClient 6/22/2013 11:26:00 AM 1088359560 (0x40DF0C88)
2013-06-22T05:56:00,890Z Trace [scx.client.agents.inventory.InvDataStore:786:6473:1088377152] Inventory report preparation has begun for class SMS_LogicalDisk LinuxUNIXClient 6/22/2013 11:26:00 AM 1088359560 (0x40DF0C88)
2013-06-22T05:56:00,928Z Trace [scx.client.agents.inventory.InvDataStore:786:6473:1088377152] Inventory report preparation has begun for class Win32_DiskDrive LinuxUNIXClient 6/22/2013 11:26:00 AM 1088359560 (0x40DF0C88)
2013-06-22T05:56:00,954Z Trace [scx.client.agents.inventory.InvDataStore:786:6473:1088377152] Inventory report preparation has begun for class Win32_BIOS LinuxUNIXClient 6/22/2013 11:26:00 AM 1088359560 (0x40DF0C88)
2013-06-22T05:56:00,979Z Trace [scx.client.agents.inventory.InvDataStore:786:6473:1088377152] Inventory report preparation has begun for class Win32_NetworkAdapterConfiguration LinuxUNIXClient 6/22/2013 11:26:00 AM 1088359560 (0x40DF0C88)
2013-06-22T05:56:01,025Z Trace [scx.client.agents.inventory.InvDataStore:786:6473:1088377152] Inventory report preparation has begun for class Win32Reg_AddRemovePrograms LinuxUNIXClient 6/22/2013 11:26:01 AM 1088359560 (0x40DF0C88)
2013-06-22T05:56:13,523Z Trace [scx.client.agents.inventory.InvDataStore:786:6473:1088377152] Inventory report preparation has begun for class Win32_DiskPartition LinuxUNIXClient 6/22/2013 11:26:13 AM 1088359560 (0x40DF0C88)
2013-06-22T05:56:13,538Z Trace [scx.client.agents.inventory.InvDataStore:786:6473:1088377152] Inventory report preparation has begun for class Win32_OperatingSystem LinuxUNIXClient 6/22/2013 11:26:13 AM 1088359560 (0x40DF0C88)

[scx.client.Agents.Inventory.CollectionTask:833:6473:1088377152] Building HWInv data for class root/cimv2/win32_pnpentity (OMI referenced as win32_pnpentity)

Notice these instances being discovered. These are specific to Linux machine placed by configmanager provider. 

These are the success messages in the log, and if you wait for a while, you should see the HW inventory information under resource explorer. This can take around 15 min to appear. Little bit of patience is required :)

Now that i see client well connected, i decide to go for package deployment in Linux 5.8 x64.

If you refer the technet as specified above, only legacy method of package deployment is supported currently. No application deployment is supported. 

Creation of package works exactly the same way as windows, but the options are restricted. I have included some screenshot below to make you comfortable in creating a package.

As you can see the command line is what it needs to be passed to Linux client. Remaining option support, please refer to Technet  https://technet.microsoft.com/en-us/library/jj573943.aspx

Once done, create a deployment. Again, not all the options are supported.

It always has to be "required". and can not be available

Rest of the option goes by default.

Once you have the deployment ready, either you can opt to wait till the policy reaches the client, or you can initiate the policy. 

“/opt/microsoft/configmgr/bin/ccmexec -rs policy”

Monitor the scxcm.log

2013-06-25T20:16:37,207Z Error [scx.client.agents.softwaredist.RejectPolicyMgr:353:6732:1103982912] query WMI . The query was select * from CCM_RejectedPolicy where AdvertisementID = "PRI20001" and ProgramID = "RPM Install program" and PackageID = "CAS0000B" and User = "System"
2013-06-25T20:16:37,367Z Warning [scx.client.agents.softwaredist.CSoftwareDistPolicyMgr:3297:6732:1104892224] Package: CAS0000B LinuxUNIXClient 6/26/2013 1:46:37 AM 1104877576 (0x41DB1808)
2013-06-25T20:16:37,367Z Warning [scx.client.agents.softwaredist.CSoftwareDistPolicyMgr:3298:6732:1104892224] program: RPM Install program LinuxUNIXClient 6/26/2013 1:46:37 AM 1104877576 (0x41DB1808)
2013-06-25T20:16:37,368Z Warning [scx.client.agents.softwaredist.CSoftwareDistPolicyMgr:3300:6732:1104892224] initial validation. Check the log for details. LinuxUNIXClient 6/26/2013 1:46:37 AM 1104877576 (0x41DB1808)

We have the policy available, and the client has received the package ID. package is validated and command line is attached.

In the above log, i just have warnings available, but in case you want to see the complete steps of receiving the policy and installation command line, enable trace with the command line specified above.

-Chandan

For setting up the connector, check the link

After we confirmed that our connector service and Provider are in place. Good to see that.

Look into the log scxcimd.log at /var/opt/Microsoft/scx/log

I see below alarming entries. So we are not able to validate the wsman account.

06/28/2012-02:13:03 SEVERE  cimserver: Provider is not a CMPI style provider. library /opt/microsoft/scx/lib/providers/libSCXInteropProviderModule.so, error ProviderLoadFailure: (/opt/microsoft/scx/lib/providers/libSCXInteropProviderModule.so:SCX_ConnectorProvider):Cannot load library, error: /opt/microsoft/scx/lib/providers/libSCXInteropProviderModule.so: wrong ELF class: ELFCLASS64

You can also see this is scinteropd.log

<SOAP-ENV:Fault xmlns:SOAP-ENV="https://www.w3.org/2003/05/soap-envelope"><SOAP-ENV:Code><SOAP-ENV:Value>SOAP-ENV:Receiver</SOAP-ENV:Value><SOAP-ENV:Subcode><SOAP-ENV:Value>wsman:InternalError</SOAP-ENV:Value></SOAP-ENV:Subcode></SOAP-ENV:Code><SOAP-ENV:Reason><SOAP-ENV:Text xml:lang="en-US">CIM_ERR_FAILED: ProviderLoadFailure: (/opt/microsoft/scx/lib/providers/libSCXInteropProviderModule.so:SCX_ConnectorProvider):Cannot load library, error: /opt/microsoft/scx/lib/providers/libSCXInteropProviderModule.so: wrong ELF class: ELFCLASS64</SOAP-ENV:Text></SOAP-ENV:Reason></SOAP-ENV:Fault>

DEBUG Microsoft.SystemCenter.Interop.NoProviderAvailableException: Could not connect to any providers to retrieve update events

Event Type: Error
Event Source: OpsMgr Connector for HP OpenView Operations
Event Category: None
Event ID: 0
Date: 6/26/2012
Time: 10:07:49 PM
User: <MS Name>

Description:
Service cannot be started. System.ApplicationException: Could not find configuration for 'OpsMgr Connector for HP OpenView Operations'
 at Microsoft.SystemCenter.Interop.Configuration.Config.Load(String key)
 at Microsoft.SystemCenter.Interop.Configuration.Config..ctor(String configName)
 at Microsoft.SystemCenter.Interop.ConnectorService.OnStart(String[] args)
 at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

For more information, see Help and Support Center at https://go.microsoft.com/fwlink/events.asp.

It only means that some of the library files are not loaded. It doesn’t look strange to me. Just to let you know, this happens when we have x64 bit agent installed on x86 machine and vice versa. And that was found true. We definitely did that.

To check what bit (32 or 64) agent installed, run below command,

file /opt/microsoft/scx/bin/scxcimserver

To check bit information if provider, run below

File /opt/microsoft/scx/lib/providers/libSCXInteropProviderModule.so

Both output should match to come to conclusion.

When you enable the verbose logging on the UNIX machine with below command.

scxadmin -log-set all verbose

We were able to see below messages in cimserver.trc

1340870984s-99035us: SSL [30728:4148087648:TLS.cpp:196]: In SSLSocket::incompleteSecureReadOccurred : err = 5 error:00000000:lib(0):func(0):reason(0)

1340870984s-99044us: Http [30728:4148087648:HTTPConnection.cpp:2075]: Total bytesRead = 0; Bytes read this iteration = 0

1340870984s-99054us: XmlIO [30728:4148087648:HTTPConnection.cpp:2107]: <!-- No request message received; connection closed: queue id: 20 -->

Possibility:

1)      The version of OpenSSL on the RHL 5.8 box is slightly incompatible

2)      Network issue Or the certificate, however with the current data, I don’t see it in log.

So next step is, install x86 agent on x86 hardware and so on. This should fix the issue. As soon as done, we didn’t see any such entries. That was good.

So here is the steps of install on the provider part.

1)    Have scx-1.0.4-265.rhel.5.x64.rpm installed which is a provider component, (If x64)

2)    Next install MSFTInteropOvo.xxxx  (Only if we are going for interop connector)

Note: Provider component 1^st, Connector on MS 2^nd.

We did it,

We still can’t validate the wsman credential. OK no problem, let’s check if this command works

"winrm enumerate https://schemas.microsoft.com/wbem/wscim/1/cim-schema/2/SCX_Processor__cimnamespace=root/scx -auth:basic -remote: https://<Linux server>:1270  -username:<Username> -password:<Password> -encoding:utf-8 -skipCAcheck -skipCNcheck"

And it fails with “Access denied” error. Though I have used root account.

Immediately I think of this link https://support.microsoft.com/kb/2653882  but this is something related to Solaris, here I have Linux 5.8.

I check below file if this exists, may be something wrong with PAM.

# cat /etc/pam.d/scx

cat: /etc/pam.d/scx: No such file or directory

So the PAM doesn’t exist at all here. This is the file, that is created while the install goes on, there should be scx file that should be created automatically. SO we can make use of sshd. So try this

So SCX file should look like this, when you run command “cat scx”

Now try running your winrm command from above. And it goes success!!!

But still we are not able to validate the WSMAN credentials in the connector configuration wizard.

I can definitely think of checking my certificate, so I run winRM command without –skipCNcheck and –skipCAcheck, it works fine, so its not a certificate issue. If there is a failure, you can take a look at

https://support.microsoft.com/kb/2651766

Event Type: Error
Event Source: OpsMgr Connector for HP OpenView Operations
Event Category: None
Event ID: 1500
Date: 6/28/2012
Time: 12:37:51 PM
User: N/A
Computer: <MS Name>

Description:
2012-06-28 12:37:51.511 [Microsoft.SystemCenter.Interop.Framework.Modules.WSManModule] ERROR No providers could be contacted. Could not get update events. Cannot create WSManConfig for any providers

We couldn’t make the wsman validation work, so I decided to manually import the certificate. By using below command by going into the directory

%Program Files%\System center Operations Manager 2007 R2 Connectors\opsMgr Connector For HP OpenView Operations

"Scicert <Provider machine> <User account> <Password> “OpsMgr Connector for HP Openview Operations” silent"

This popped some error

“Connector certificate import operation returned an error code. Certificate installation was not complete. Please refer to connector Deployment Guide for further details”

Then I found, I had incorrect Operations manager server in the server names. So make sure that you have correct server names here. So this issue can happen when you have incorrect names.

As soon as I corrected the operations manager server name, and enter on “Configure” it returned success!!.

OK, now i was able to get my wsman credential validated. 

At some point in the event, i still see below event of access denied.

Event Type: Error
Event Source: OpsMgr Connector for HP OpenView Operations
Event Category: None
Event ID: 1151
Date: 6/28/2012
Time: 12:12:42 PM
User: N/A
Computer: Machine name

Description:

2012-06-28 12:12:42.779 [Microsoft.SystemCenter.Interop.Framework.Modules.OpsMgrModule] ERROR Not authorized to connect to server: <Machine name>. The user <User account> does not have sufficient permission to perform the operation.

Remember going through Kevin’s blog for checking the rights of the account. https://blogs.technet.com/b/kevinholman/archive/2010/09/23/installing-the-opsmgr-r2-universal-connector.aspx

That means, this is the account that runs the connector service. And needs to have below permission.

After all, I got this after successful validation

Then I tried forwarding the alerts to the connector and it was success with ticket ID field populated.

Note:-

Another one I thought of bringing to notice.

While Integration between SCOM 2007 and HP Operations Manager (OM) on Red Hat Linux.

In the log /var/opt/microsoft/scx/log/scxcimd.log:

06/22/2012-15:52:46 INFO    cimserver: Authentication failed for user=<opc_adm>

06/22/2012-15:52:46 INFO    cimserver: Authentication failed for user=<opc_adm>

06/22/2012-15:53:16 INFO    cimserver: Authentication failed for user=<opc_adm>

Remember, this account is an HPOVO administrator by default. So you may need to check if below steps are correct.

1)      Verify is password entered is correct

2)      Verify if you are able to log into HPOVO with opc_adm account

If you are not sure about the password and wondering what password you have entered and how to re-enter the password for account “ops_adm” ,

To know what password you have entered, try below

vi /etc/init.d/scx-scinteropd

Change the log level to 51

-D51 (instead of -D1 or whatever it is now)

that will verify the password is being decrypted successfully

Once this is done, restart the provider service. Then check the log again. You will see below information along with the password entered. Check scinteropd.log

05-29-2012 17:32:46 - INFO: Debug Level = '51'

05-29-2012 17:32:46 - INFO: Instance name = 'SciInst'.

05-29-2012 17:32:46 - INFO: Operator name = 'opc_adm'.

05-29-2012 17:32:46 - INFO: DELETE FROM LOG - Password = <Password>

05-29-2012 17:32:46 - ERROR: Cannot connect to the MSI!

05-29-2012 17:32:46 - INFO: opc_connect() - Invalid password!

OK, here is how you can update your password of ops_adm. Run below

“/etc/opt/microsoft/scx/conf/scicrypt.bin <New or correct Password>” --> ENTER

This way, you have updated or changed the password. And access denied or password issues should be resolved,

If this doesn’t, There are two chances,

1)      ops_adm is not able to connect to HPOVO API called “opc_connect()”

2)      there are chances that MSI  "Message Stream Interface" - MSI has been corrupt

At this point, you may need to engage HPOVO expert to find. But you know where you are with the issue.

We already have a template to create a log file rule which you should be able to see under rule section, but here we are just trying to create a Unit Monitor. So lets start in a simple way.

Step 1: Install an authoring console from tool kit  Here

Step 2: Create a new MP and add below references to it.

• Microsoft.Unix.Library
• Microsoft.Unix.LogFile.Library

Rest libraries are already added. So no worries.

Step 3: Go to health model Pane and check Monitors.

Create a new monitor (Custom Unit Monitor)

Step 4: Go to Type LIbrary Pane and right on the blank space to create New composite monitor Type, 

             Name: <Name that you want>, Fill the General Tab

           States: State 1-->healthy and State2-->Critical

            Member Modules: Click on Add, and uncheck Condition detection and Probe action, and select "Log File Datasource" from the list, (2 times as shown below)

    Here GoodExpression and BadExpression are the module ID

        Regular: Check good Expression box and select Monitor state output from drop down from 2nd box. Double click on "Complete" which is set to "NO' it will turn to "Yes" as below

         On Demand: leave it as it is

        Configuration Schema: Its difficult to describe, but below should tell you what to do :)

             Overridable Parameters: Create 3 Parameters. 

Step 5:  Name: <name that you want>

             Target: Unix computer

             Parent Monitor: Entity Health <Your wish to select which ever you want>

Step 6: Hit configuration tab and click on Browse where your Monitor type should be “Linux Log File Monitor Type”

            Host :  $Target/Property[Type="Unix!Microsoft.Unix.Computer"]/PrincipalName$

            LogFile:  <Your log File location and name>

           GoodRegex:  <Value that makes monitor healthy>

           BadRegex:  <Value that makes your monitor critical or unhealthy>

Step 7: Define your healthy and critical criteria.

Step 8: Define alerting

And you are done.!!

Save this MP and import to your OpsMgr console. Expressions, Log file & location and targets are overridable parameter here.           

Note: This is again a probe based module so defined expression is queried every 5 min. Either that’s a healthy or unhealthy expression. So we have to be patient. So for any state change based on what log has got, it needs to wait for 5 min.

LinuxLogMonitor.xml

Here is how you can create a Diagnostic task for Unix/Linux services.

<!-- Add below lines just below the tag </Discoveries> and right above the tag <Recoveries> -->

<Diagnostics> 
  <Diagnostic Accessibility="Public" ID="Microsoft.Unix.ACPID.Restart.Diagnostic" Remotable="true" Target="MicrosoftUnixServiceLibrary!Microsoft.SystemCenter.UnixService" Enabled="false"              Timeout="300" ExecuteOnState="Error" Monitor="MicrosoftUnixServiceLibrary!Microsoft.Unix.Generic.Service.Monitor" Comment="In response">
      <Category>Maintenance</Category>
    <ProbeAction ID="Invoke" TypeID="Unix!Microsoft.Unix.SSHCommand.ProbeAction">                          
     <Host>$Target/Property[Type="MicrosoftUnixServiceLibrary!Microsoft.SystemCenter.UnixService"]/ComputerName$</Host>
     <Port>22</Port>
     <UserName>$RunAs[Name="Unix!Microsoft.Unix.PrivilegedAccount"]/UserName$</UserName>
    <Password>$RunAs[Name="Unix!Microsoft.Unix.PrivilegedAccount"]/Password$</Password>
    <Command>/etc/init.d/acpid -status</Command>
    <TimeoutSeconds>20</TimeoutSeconds>
   </ProbeAction>
  </Diagnostic>
</Diagnostics>

Once this is done, please add the Display string as well

<DisplayString ElementID="Microsoft.Unix.ACPID.Restart.Diagnostic">
  <Name>ACPID Diagnostic</Name> 
   <Description>WARNING: Running this diagnostic is unsecure, do not run this against machines you do not trust as it may expose credentials to an unknown system.</Description> 
</DisplayString>

Also please make sure to edit your Recovery task Where you have an entry "ExecuteOnState="Error"  Described in https://blogs.technet.com/b/chandanbharti/archive/2011/12/21/creating-the-recovery-task-for-linux-services-in-scom-2007.aspx

So basically you have to change it to ExecuteOnDiagnostic="Microsoft.Unix.ACPID.Restart.Diagnostic"

Remember, this is created under a custom MP. Next import the MP to the console. You should see your Diagnostic task created     

-Chandan