• The FC is the kernel of the Microsoft Azure cloud operating system.  It monitors and manages most Azure resources.  It also detects and responds to both software and hardware failure automatically.

Partitioning

Azure's Fabric Controller uses two types of partitions: Update Domains(UDs) and Fault Domains(FDs).

• An Update Domain is used to upgrade a service’s role instances in groups. Azure deploys service instances into multiple update domains. For an in-place update, the FC brings down all the instances in one update domain, updates them, and then restarts them before moving to the next update domain. This approach prevents the entire service from being unavailable during the update process.
• A Fault Domain defines potential points of hardware or network failure. For any role with more than one instance, the FC ensures that the instances are distributed across multiple fault domains, in order to prevent isolated hardware failures from disrupting service. All exposure to server and cluster failure in Azure is governed by fault domains.

• Why and what type of availability is required for a specific workload within the Datacenter?
• How fast can the workload recover from a SAN storage outage?
• Can a workload recover automatically from a host failure?
• How many identical copies of my VM disks is maintained?

1. This blog IS NOT a recommendation for managing your workloads High Availability(HA) in Azure.  Guidance is provided here Manage the availability of virtual machines
2. [Update] Microsoft does offer SLA for single instance VM with very specific requirements.  Please visit the SLA for Virtual Machines webpage for more info.

• Azure Resiliency Technical Guidance https://azure.microsoft.com/en-us/documentation/articles/resiliency-technical-guidance/
• Windows Azure Storage: What’s Coming, Best Practices, and Internals https://channel9.msdn.com/Events/Build/2013/3-541
• Service Healing - Auto-recovery of Virtual Machines https://azure.microsoft.com/en-us/blog/service-healing-auto-recovery-of-virtual-machines/
• Windows Azure Storage: A Highly Available Cloud Storage Service with Strong Consistency https://www-bcf.usc.edu/~minlanyu/teach/csci599-fall12/papers/11-calder.pdf

1. First, a reverse lookup zone must exist.  To create a IPv4 DNS Reverse lookup zone consult: https://technet.microsoft.com/en-us/library/cc816676(v=ws.10).aspx

1. Create a new Group Policy using GPEdit.msc and browse to:  Computer configuration / Policies / Windows Settings / Scripts (Startup/Shutdown) 
2. In the Details pane, double-click on Startup
3. In the Startup properties window, click on the PowerShell Scripts tab
4. Then click on Show Files button, and paste the attached NICConfigPS.ps1 PowerShell script.
5. In the Startup properties window, click on Add, then Browse and select the file NICConfigPS.ps1, then OK to Close
6. Click OK to complete the Startup script

1. Once the GPO is created, it needs to be applied.  I would suggest to apply at an Active Directory Site level which defines the virtual network(s) hosted in Azure

1. *** IMPORTANT ***  A reboot is necessary for the changes to take effect once the GPO is applied.
2. In DNS Manager, under the reverse DNS Zone, you should see a PTR record for your computer fully qualified domain name (FQDN).
3. Also, from a command prompt: PING -a <IP Address of your server>.  Now, it should return the FQDN of your server

• OpsMgr Certificates Overview and Concepts
• How to obtain an OpsMgr certificate from Win2008 Enterprise CA
  
• Gateway approval process to initiate communication from MS to Gateway (OpsMgr 2012 only)
  
• Sample screenshot of a valid OpsMgr certificate
  

-------------------------------------------------------------------------------------------------------------------

OpsMgr Communication using Certificate Overview

Overview

Communication between OpsMgr servers (MS, GTW, Agents) in untrusted domains is done through certificates. So computers need its own OpsMgr certificates.  OpsMgr uses 2 certificates on each computer, only one must be provided by a trusted authority

• OpsMgr Certificate X.509 (generated by a trusted authority)

     This certificate is located in the Local Computer / Personal / Certificates Container

• OpsMgr Self-Signed Certificate (auto-generated by MOMCertImport or agent restart)

     This certificate is located in the Local Computer / Operations Manager / Certificates Container

   

OpsMgr Certificate Requirements

1. All servers involve in the authentication using a certificate must trust the certificate authority where the certificate originate.  They must have the CA root chain of the CA in their trusted root authorities.  (Does not have to be same Root CA, but Root CA must be trusted by source and target)

2. Each computer must have its own certificate loaded in the Local Computer Personal store.  (See sample screenshot in Appendix)

   1. Must include the Private Key

   2. Subject Name must match computer FQDN (CN=<ServerName>)

   3. Must be trusted all the way to the root (Chain)

3. Certificates configuration options:

   1. Hash Algorithm does not need to be same between source and target.  (Ex. SHA1 on MS and SHA256 on GTW works)

   2. Key size can be 2048 and 4096

   3. Does not appear to validate with CRL.  Even if CRL distribution point is not available, Cert load successfully.  (Also tried Clearing CRL Cert Cache)

       

OpsMgr Self-Signed Certificate Requirements

1. If OpsMgr Self-Signed Cert (MOMCertImport) is not there, data flow is not being process

   1. OpsMgr Self-Signed certificate is not used for authentication.

   2. MOMCerImport seems to be an optional task as restarting the agent also does generate the OpsMgr self-signed certificate

       

Obtaining a Certificate from Win2008 Enterprise CA

This section is based on the following TechNet article with some additional details to help simplify the process

How to Obtain a Certificate Using Windows Server 2008 Enterprise CA
https://technet.microsoft.com/en-us/library/hh467900.aspx

• Create an OpsMgr Certificate Template (Enterprise CA)

• Download and Import Trusted Root (CA) Certificate (and Sub CA)

• Request OpsMgr Certificate

• Import OpsMgr Certificate

Create an OpsMgr Certificate Template (Enterprise CA)

Note: A PKI Administrator privileges is required to perform the following steps.

To create a certificate template

1. On the computer that is hosting your enterprise CA, on the Windows desktop, click Start, point to Programs, point to Administrative   Tools, and then click Certification Authority.

2. In the navigation pane, expand the CA name, right-click Certificate Templates, and then click Manage.

3. In the Certificate Templates console, in the results pane, right-click IPsec (Offline request), and then click Duplicate Template.

4. In the  Duplicate Template  dialog box, select

   1. Windows Server 2008 Enterprise Edition

5. In the Properties of New Template dialog box, on the General tab, in the Template display name text box, type a new name for this template; for example, <OpsMgrCert>.

6. On the Request Handling tab, select Allow private key to be exported.

7. Click the Extensions tab, and in Extensions included in this template, click Application Policies, and then click Edit.

8. In the Edit Application Policies Extension dialog box, click IP security IKE intermediate, and then click Remove.

9. Click Add, and in the Application policies list, hold down the CTRL key to multi-select items from the list, click Client Authentication and Server Authentication, and then click OK.

10. In the Edit Application Policies Extension dialog box, click OK.

11. Click the Security tab and ensure that the Authenticated Users group has Read and Enroll permissions, and then click OK.

12. Close the Certificate Templates console.

To add the template to the Certificate Templates folder

1. On the computer that is hosting your Enterprise CA, in the Certification Authority snap-in, right-click the Certificate Templates folder, point to New, and then click Certification Template to Issue.

2. In the Enable Certificate Templates box, select the certificate template that you created

   Ex: OpsMgrCert

3. Click OK.

Download and Import Trusted Root (CA) Certificate (and Sub CA)

To download the Trusted Root (CA) certificate

1. Log on to a host in the domain. (Any)

2. Start Internet Explorer, and connect to the computer hosting Certificate Services.

   Ex.: https://<PKIServerName>/CertSrv

3. On the Welcome page, click Download a CA Certificate, certificate chain, or CRL.

4. On the Download a CA Certificate, Certificate Chain, or CRL page, click Encoding method, click Base 64, and then click Download CA certificate chain.

5. In the File Download dialog box, click Save and save the certificate

   Ex.: TrustedRootCert.p7b

6. When the download has finished, close Internet Explorer.

To import the Trusted Root (CA) certificate

1. Logon to the host you want to import the Root CA. 

2. Click Start, and then click Run.

3. In the Run dialog box, type mmc, and then click OK.

4. In the Console1 window, click File, and then click Add/Remove Snap-in.

5. In the Add/Remove Snap-in dialog box, click Add.

6. In the Add Standalone Snap-in dialog box, click Certificates, and then click Add.

7. In the Certificates snap-in dialog box, select Computer account, and then click Next.

8. In the Select Computer dialog box, ensure that Local computer: (the computer this console is running on) is selected, and then click Finish.

9. In the Add Standalone Snap-in dialog box, click Close.

10. In the Add/Remove Snap-in dialog box, click OK.

11. In the Console1 window, expand Certificates (Local Computer), expand Trusted Root Certification Authorities, and then click Certificates.

12. Right-click Certificates, select All Tasks, and then click Import.

13. In the Certificate Import Wizard, click Next.

14. On the File to Import page, click Browse and select the location where you downloaded the CA certificate file, for example: TrustedRootCA.p7b, select the file, and then click Open.

15. On the File to Import page, select Place all certificates in the following store and ensure that Trusted Root Certification Authorities appears in the Certificate store box, and then click Next.

16. On the Completing the Certificate Import Wizard page, click Finish.
    
    

Note: Perform for each computer that needs a certificate

Request OpsMgr Certificate

To create a setup information (.inf) file

1. Click Start, and then click Run.

2. In the Run dialog box, type Notepad, and then click OK.

3. Create a text file containing the following content: (Modify bold text)

[NewRequest]
Subject="CN=<FQDN of computer you are creating the certificate, for example, the gateway server or management server.>"
Exportable=TRUE
KeyLength=2048
KeySpec=1
KeyUsage=0xf0
MachineKeySet=TRUE
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1
OID=1.3.6.1.5.5.7.3.2

1. Save the file with an .inf file name extension.  Ex.: OpsMgrTemplate.inf

2. Close Notepad.

To create a request file to use with an enterprise CA

Note:   The CertReq command MUST BE PERFORMED on the computer the certificate needs to be installed. (Each computer must have its own certificate (MS, GTW, Agent)
 

1. On the host you need a certificate for, copy the .inf file created in the previous section and update the subject.

2. In a command window, type:

   CertReq –New –f OpsMgrTemplate.inf Server1.req

    

To submit a request to an enterprise CA

Note: Request can be submitted manually or using the Web Interface, choose the one you prefer from any host in the domain.

Manually submitting a request:

CertReq -submit -attrib certificatetemplate:OpsMgrCert Server1.req 

Submitting a request using the Web interface:

1. Log on to a host in the domain. (Any)

2. Start Internet Explorer, and connect to the computer hosting Certificate Services.

   Ex.: https://<PKI>/CertSrv

3. On the Microsoft Active Directory Certificate Services Welcome screen, click Request a certificate.

4. On the Request a Certificate page, click advanced certificate request.

5. On the Advanced Certificate Request page, click Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.

6. On the Submit a Certificate Request or Renewal Request page, in the Saved Request text box, paste the contents of the request file from the previous procedure. Ex.: Server1.req

7. In the Certificate Template select the certificate template that you created

   Ex.: OpsMgrCert

8. Then click Submit.

9. On the Certificate Issued page, select Base 64 encoded, and then click Download certificate.

10. In the File Download – Security Warning dialog box, click Save, and save the certificate

    Ex.: Server1.cer

11. Close Internet Explorer.
    
    

Note: Request a certificate for each MS, GTW  and Agents(Untrusted) servers

Import OpsMgr Certificate

To import the certificate into the certificate store

1. On the computer hosting the Operations Manager role for which you are configuring the certificate, click Start, and then click Run.

2. In the Run dialog box, type mmc, and then click OK.

3. In the Console1 window, click File, and then click Add/Remove Snap-in .In the Add/Remove Snap-in dialog box, click Add.

4. In the Add Standalone Snap-in dialog box, click Certificates, and then click Add.

5. In the Certificates snap-in dialog box, select Computer account, and then click Next.

6. In the Select Computer dialog box, ensure that Local computer: (the computer this console is running on) is selected, and then click Finish.

7. In the Add Standalone Snap-in dialog box, click Close.

8. In the Add/Remove Snap-in dialog box, click OK.

9. In the Console1 window, expand Certificates (Local Computer), expand Personal, and then click Certificates.

10. Right-click Certificates, select All Tasks, and then click Import.

11. In the Certificate Import Wizard, click Next.

12. On the File to Import page, click Browse and select the location where you downloaded the CA certificate file, for example: Server1.cer, select the file, and then click Open.

13. On the File to Import page, select Place all certificates in the following store and ensure that Personal appears in the Certificate store box, and then click Next.

14. On the Completing the Certificate Import Wizard page, click Finish.

Create the self-signed certificate into Operations Managers container using MOMCertImport

1. Log on to the computer where you installed the certificate with an account that is a member of the Administrators group.

2. Double-click on the MOMCertImport.exe tool

3. Select the Certificate imported earlier

4. Click OK.

5. Restart System Center Management Service.

Sample Validation of a Certificate on a Gateway server

1. Confirm an event 20053 in Operations Manager event log exist which says the certificate is loaded successfully.

   

Gateway Approval process to initiate communication from MS to Gateway Server

IMPORTANT:   New in Operations Manager 2012, Management Server can initiate communication to the Gateway server, so no need to open port TCP 5723 in the Firewall from GTW to MS.

Follow the steps outline in the section How to Deploy a Gateway Server on TechNet, except during the gateway approval process, follow the step below.

To run the gateway approval tool

1. On the management server that was targeted during the gateway server installation, log on with the Operations Manager Administrator account.

2. Open a command prompt, and navigate to the Operations Manager installation directory or to the directory that you copied the Microsoft.EnterpriseManagement.gatewayApprovalTool.exe to.

3. At the command prompt, run: 

   Microsoft.EnterpriseManagement.gatewayApprovalTool.exe
       /ManagementServerName=<managementserverFQDN>
       /GatewayName=<GatewayFQDN>
       /Action=Create 
       /ManagementServerInitiatesConnection=True

4. If the approval is successful, you will see the approval of server <GatewayFQDN> completed successfully.

5. If you need to remove the gateway server from the management group, run the same command, but substitute the /Action=Delete flag for the /Action=Create flag.

6. Open the Operations console to the Monitoring view. Select the Discovered Inventory view to see that the gateway server is present.

Sample Screenshot of a valid Operations Manager Certificate

This posting is provided "AS IS" with no warranties and confers no rights.

# Load Operations Manager SDK assemblies (Installed with the Operations Manager console) $assembly1 = [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.EnterpriseManagement.Core") $assembly2 = [System.Reflection.Assembly]::LoadWithPartialName("Microsoft.EnterpriseManagement.OperationsManager")

# Connect to Management Server (Use Credentials from user calling the script)  $mg = New-Object Microsoft.EnterpriseManagement.ManagementGroup("MyServer")

# Define Criteria for All New Alerts  (Should provide the alert ID instead, but just to demo, all active alerts...) $Criteria = New-Object Microsoft.EnterpriseManagement.Monitoring.MonitoringAlertCriteria("ResolutionState = 0")

# Return all Alerts matching the criteria $AllNewAlerts = $mg.GetMonitoringAlerts($Criteria)

foreach($NewAlert in $AllNewAlerts) {   # For a Rule $AlertRule = $mg.GetMonitoringRule(($NewAlert.MonitoringRuleId))   # For a Monitor   $AlertRule = $mg.GetMonitor(($NewAlert.MonitoringRuleId))   # Retrieve all knowledge Articles associated to the rule/monitor (Product and Company)   $KnowledgeArticles = $mg.GetMonitoringKnowledgeArticles(($AlertRule.Id))   # Determine if Product or Company Knowledge.  The basic idea is if it is in the same MP, it is Product, if not it's Company (Company knowledge can only be in a separate MP, therefore can only apply to rule/monitor from a sealed MP    … }

Overview of the components of my 3-tier LOB distributed application:

• Database(s)
• Website(s)
• Windows Service(s)

So, how do I populate a DA Component group for the All Web Sites DA using PowerShell? 

Type Definitions required

1- Class definition needed. 

    <!-- Seed class -->
    <ClassType ID="MyDynamicAppDA.Computers.Seed.Class" Accessibility="Internal" Abstract="false" Base="Windows!Microsoft.Windows.LocalApplication" Hosted="true" Singleton="false" />

    <!-- All Web Sites DA component group class -->
    <ClassType ID="MyDynamicAppDA.AllWebSites.DA" Accessibility="Public" Abstract="false" Base="MicrosoftSystemCenterServiceDesignerLibrary7084320!Microsoft.SystemCenter.ServiceDesigner.ServiceComponentGroup" Hosted="false" Singleton="true" />

Note:  I don't need a class for my Web Sites as I want to re-use the IIS web site class (see below)

2- Relationship definition needed.  In here, I specify the class that can be member of my DA component group

     <RelationshipType ID="MyDynamicAppDA.AllWebSitesDAContainsWebSite2008" Accessibility="Public" Abstract="false" Base="System!System.Containment">
          <Source>MyDynamicAppDA.AllWebSites.DA</Source>
          <Target>IIS2008!Microsoft.Windows.InternetInformationServices.2008.WebSite</Target>
     </RelationshipType>

PowerShell Script for Web Site discovery

1- My discovery must target my seed class 

    <!-- Sample discovery script for specific Web Sites targeted at instances of myDynamicAppDa Seed Servers  -->
    <!-- This script populate the DA component and build the relationship -->
    <Discovery ID="MyDynamicAppDA.AllWebSites.DA.Discovery" Enabled="true" Target="MyDynamicAppDA.Computers.Seed.Class" ConfirmDelivery="false" Remotable="true" Priority="Normal">
      <Category>Discovery</Category>
      <DiscoveryTypes>
        <DiscoveryClass TypeID="MyDynamicAppDA.DA" />
        <DiscoveryClass TypeID="MyDynamicAppDA.AllWebSites.DA" />
        <DiscoveryRelationship TypeID="MyDynamicAppDA.DAContainsAllWebSitesDA" />
        <DiscoveryRelationship TypeID="MyDynamicAppDA.AllWebSitesDAContainsWebSite2008" />
        <DiscoveryRelationship TypeID="MyDynamicAppDA.AllWebSitesDAContainsWebSite2012" />
        …

2- I use WMI to query local Websites for a specific name and return the Name and SiteID

    IMPORTANT: You must have installed the 'IIS Management Scripts and Tools' for the 'IIS Role' for populating the All WebSites DA on the Server where the discovery will be executed.

    #  Using IIS7 Management Scripts and Tools.
    $sites = Get-WmiObject -Namespace "root/webadministration" -Class Site | ? {$_.Name -match 'Microsoft System Center 2012 Orchestrator'} | Select Name, ID

3- When a web site that should be part of my DA component group is found, then I create an instance of each class for my DA Component Group

    # Add Instance for the WebSites DA class 
    $Instance1 = $DiscoveryData.CreateClassInstance("$MPElement[Name='MyDynamicAppDA.AllWebSites.DA']$")
    $Instance1.AddProperty("$MPElement[Name='System!System.Entity']/DisplayName$", "All Web Sites")
    $DiscoveryData.AddInstance($Instance1) 

    # Add Instance for the WebSites class
    $Instance2 = $DiscoveryData.CreateClassInstance("$MPElement[Name='IIS2008!Microsoft.Windows.InternetInformationServices.2008.WebSite']$")
    $Instance2.AddProperty("$MPElement[Name='Windows!Microsoft.Windows.Computer']/PrincipalName$", $oTarget)
    $Instance2.AddProperty("$MPElement[Name='IISCommonLibrary!Microsoft.Windows.InternetInformationServices.WebSite']/SiteID$", "W3SVC/$($Site.ID)")
    $DiscoveryData.AddInstance($Instance2)

Note: 
The WebSite Instance should have already been discovered by the IIS MP, so to insure OpsMgr will not create a new web site instance for this discovery, we have to match the index of the web site class.  In this case, the index of the IIS Web Site class is the Site ID as follow: "W3SVC/$($Site.ID)"

4- Once I have the instance of each class, then I create an instance for the relationship:

    # Add Relationship class WebSites contains WebSite
    $Relation1 = $DiscoveryData.CreateRelationshipInstance("$MPElement[Name='MyDynamicAppDA.AllWebSitesDAContainsWebSite2008']$")
    $Relation1.Source = $Instance1
    $Relation1.Target = $Instance2
    $DiscoveryData.AddInstance($Relation1) 

The above detailed is a quick overview for advanced MP authors and there is definitely more to it.  Included in this blog post, is a fully functional sample MP with detailed comments in it.  I would highly recommend anyone interested to open the MP using a text editor to review all the comments.

MyDynamicApp Sample MP

Notes: 

1. You cannot edit this DA using the DA User Interface from the Authoring tab of the OpsMgr console.  It is suggested to seal the MP to avoid making any unwanted modifications
2. It may take some time for the distributed application to roll up health.

This posting is provided "AS IS" with no warranties and confers no rights.

I have created  2 simple PowerShell scripts: 
  - GetRunbookGUIDs.ps1
  - ListAllRunbookGUIDs.ps1

Download the script from the Script Center Repository here

This posting is provided "AS IS" with no warranties and confers no rights.