Thursday, September 30, 2010

How to Use the Health Service Lockdown Tool in Operations Manager 2007


On computers requiring high security, for example a domain controller, you may need to deny certain identities access to rules, tasks, and monitors that might jeopardize the security of your server. The Health Service lockdown tool (HSLockdown.exe) enables you to use various command-line options to control and limit the identities used to run a rule, task, or monitor.

You will be unable to start the OpsMgr Health Service if you have used the Health Service Lockdown tool to lock out the Action Account. To be able to restart the OpsMgr Health Service, follow the second procedure in this topic to unlock the Action Account.
The following command-line options are available:
  • HSLockdown [ManagementGroupName] /L - List Accounts/groups
  • HSLockdown [ManagementGroupName] /A - Add an allowed account|group
  • HSLockdown [ManagementGroupName] /D - Add a denied account|group
  • HSLockdown [ManagementGroupName] /R - Remove an allowed/denied account|group
Accounts must be specified in one of the following fully qualified domain name (FQDN) formats:
  • NetBios : DOMAIN\username
  • UPN : username@fqdn.com
If you used the add or deny options when running the Health Service Lockdown tool, you will need to restart the OpsMgr Health Service before the changes take effect.
When evaluating allowed and denied listings, know that denies takes priority over allows. If a user is listed as allowed, and the same user is a member of a group that is listed as denied, the user will be denied.

To use the health service lockdown tool

  1. Log on to the computer with an account that is a member of the Administrators group.
  2. On the Windows desktop, click Start, and then click Run.
  3. In the Run dialog box, type cmd and then click OK.
  4. At the command prompt, type : (where is the drive where the Operations Manager 2007 installation media is located) and then press ENTER.
  5. Type cd\Program Files\System Center Operations Manager 2007 and then press ENTER.
  6. Type HSLockdown [Management Group Name] /D [account or group] to deny the group or account, and then press ENTER.

To unlock the Action Account

  1. Log on to the computer with an account that is a member of the Administrators group.
  2. On the Windows desktop, click Start, and then click Run.
  3. In the Run dialog box, type cmd and then click OK.
  4. At the command prompt, type : (where is the drive where the Operations Manager 2007 installation media is located) and then press ENTER.
  5. Type cd\Program Files\System Center Operations Manager 2007 and then press ENTER.
  6. Type HSLockdown [Management Group Name] /A and then press ENTER.

Thursday, September 23, 2010

Backup Basics in Windows Server 2008 R2

nstallation
First off, we need to install the backup feature, as it's not installed by default. Use the Add Features wizard in Server Manager and add the Windows Server Backup Features (Figure 1). I'm going to use the command-line tools sub-feature so that I can use Windows PowerShell, which I will explain in more detail later in this article.
You can also use command-line tools, including ServerManagerCMD.exe, to install the feature:
C:\ servermanagercmd -install backup-features

[Click on image for larger view.]
Figure 1. The backup feature is not installed by default, so you must install it using the Add Features Wizard.
The next step is to identify locations for your backups. You can back up files to a network share, a local volume or a dedicated disk. You can't back up data to tape, but given the growth and widespread availability of inexpensive USB-attached storage, this isn't that much of a setback these days.
Creating a Backup Job
Windows Backup is intended to provide a one-stop setup to protect a server. You can enable a scheduled task to back up files and the system state, or to provide for a bare-metal restore. Microsoft assumes you'll have one scheduled task for this purpose. I'm assuming that you're using the Windows Backup feature because of limited budget and are after maximum protection given the utility's constraints.
After you install the Windows Backup feature, expand the Storage node in Server Manager and select Windows Server Backup. In the Actions pane, select "Backup Schedule," which will start the Backup Schedule Wizard. Then, click Next on the Getting Started screen.
During step two, specify what type of backup you want. Try doing a complete server backup. You can also create a custom backup and pick items such as selected files and system state. I'll show you how to do a quick file backup later, but for now I'm assuming you want complete server protection.
In the third step, specify when you want the backup task to run. Most of the time, a single backup should be sufficient, but you can run it more than once a day. If you're backing up critical files, this might be a good choice.
In step four, determine where to store the backup. Microsoft recommends using a dedicated hard disk. Remember, this drive will be reformatted and unavailable for anything else. You can also use a volume or a network share. Pay close attention to the warnings and limitations. You might see a warning reminding you that the disk will be reformatted. If you don't see all the disks, click the Show All Available Disks button to refresh. When you select a new disk, you'll be warned.
Once selected, you'll have a chance to confirm your backup settings. If anything is incorrect, use the Previous button to go back and correct the error. If all goes well, you should get a summary screen. The next day, you can check the Windows Server Backup node for results or errors.
You can also use Windows Backup to run a one-time backup. Select the Backup Once option in the Actions pane. You can use the same settings as your scheduled job or pick something completely different. If you select the latter, the wizard runs again and you can enter new parameters. For example, you might want to copy files to a network share. Remember, any existing backups to the same folder will be overwritten. The backup will execute immediately. If this is a separate backup task you'd like to do often, then you'll want to take advantage of a scripted solution from the command line or Windows PowerShell. I'll cover that procedure later.
Restoring Data
Windows Backup uses a time stamp as version information. Using the Recover task launches a wizard that's easy to follow. Select the appropriate backup source. The Recovery Wizard will display a datetime control of all available backups (see Figure 2). Select the appropriate one. Depending on the type of backup, you may only have once choice.

[Click on image for larger view.]
Figure 2. Data recovery is easy with the Recovery Wizard.
Moving on, select what type of data you want to recover. If you select Files and Folders, you'll be able to highlight the files you want to recover. Unfortunately, selecting files from multiple directories is next to impossible. You can easily recover everything or recover selected files from one directory. Keep that in mind when you set up the backup job.
When you recover files, you'll need to specify the target folder, which can be the original folder or an alternate location. You can also control what happens when you restore a current file if a current version exists. You can create a copy so that you have both versions; you can overwrite the existing version; or you can skip restoring if an existing version is detected. The recovery process happens immediately.
Using WBADMIN.EXE
If you installed the command backup tools, then you have a few more options. Open a command prompt and look at help for WBADMIN.EXE. You can use the tool to set up a scheduled backup, but I think the GUI is much easier. I find this tool more useful for creating one-time backup jobs. Run the following command to see syntax help:
C:\> wbadmin start backup /?
I don't have space to cover all the options, but let me demonstrate how you might use the command-line tool to periodically back up files to a network share:
@echo off
::Demo-Backup.bat
::demonstration script using WBADMIN.EXE on a 
Windows Server 2008 R2 Server

rem backup share UNC
set backupshare=\\mycompany-dc01\backup

rem files and folders to include
set include=c:\scripts,c:\files

rem define date time variables for building 
the folder name
set m=%date:~4,2%
set d=%date:~7,2%
set y=%date:~10,4%
set h=%time:~0,2%
set min=%time:~3,2%
set sec=%time:~6,2%

rem defining a new folder like \\mycompany-dc01\
backup\RESEARCHDC\12152009_132532
set newfolder=%backupshare%\%computername%\
%m%%d%%y%_%h%%min%%sec%
echo Creating %newfolder%

mkdir %newfolder%

rem run the backup
echo Backing up %include% to %newfolder%
wbadmin start backup -backuptarget:%newfolder% 
-include:%include% -quiet
rem Clear variables
set backupshare=
set include=
set m=
set d=
set y=
set h=
set min=
set sec=
set newfolder=
I don't want to overwrite any existing backups, so I'll create a new folder that uses the computer name and a datetime stamp as part of the file name. The batch file has code to handle that task. The main function of the script is to call WBADMIN.EXE to create a backup on the specified share. Look at syntax help if you want to tweak this step. I like this script because I can set up my own scheduled task using the Task Scheduler. So, even though the backup wizard only lets me create one scheduled task, I can create as many as I want using WBADMIN.EXE. I can also use this tool to create system state backups, as well.
To see what backup jobs have executed, run this command:
C:\> wbadmin get versions
Pay attention to the version identifier; you'll need it to recover files using WBADMIN (you can also use the Recovery Wizard).
Backing up with PowerShell
The other command-line approach is to use Windows Backup PowerShell cmdlets. To access them, you'll first need to load the Windows backup snap-in:
PS C:\> add-pssnapin Windows.ServerBackup
To see which cmdlets are included, use Get-Command:
PS C:\> get-command -pssnapin windows.server 
backup
Unfortunately, creating a backup job is a multistep process. While you can type the necessary commands at the prompt interactively, I think you'll find it easier with a scripted approach. Here's a PowerShell version of my original batch file:
#requires -version 2.0
#requires -pssnapin Windows.ServerBackup

#Demo-WBBackup.ps1

$policy = New-WBPolicy
$files=new-WBFileSpec c:\scripts,c:\files
Add-wbFileSpec -policy $policy -filespec $files
$backdir=("\\mycompany-dc01\backup\{0}\{1:MMd 
dyyyy_hhmmss}" -f $env:computername,(get-date))

write-host "Creating $backdir" -foregroundcolor Green
mkdir $backdir | out-null

$backupLocation = New-WBBackupTarget -network 
$backdir 

Add-WBBackupTarget -Policy $policy -Target 
$backupLocation

write-host "Backing up $files to $backdir" -fore 
groundcolor Green
$policy
Start-WBBackup -Policy $policy
The PowerShell cmdlets are based around creating and executing a policy. The policy includes the files or volumes to include or exclude, as well as where to back up the files and a few assorted options. You can also create system-state and bare-metal recovery jobs. In my demonstration, I'm simply backing up a few directories. The Start-WBBackup cmdlet carries out the backup task.
When you look at the list of Windows Backup cmdlets, you'll notice one glaring omission. There are no cmdlets for restoring data. I imagine the assumption is that you wouldn't want to automate this step, although you can with WBADMIN.EXE. Perhaps cmdlets will be added in the future. In the meantime, you can use the Recovery Wizard or WBADMIN.EXE to restore files.

Friday, September 17, 2010

installing dotnet framework 3 in windows 2008 roles

The Windows Server 2008 operating system brings a powerful set of features to the .NET Framework developer. The .NET Framework version 2.0 is included in all the versions of Windows Server 2008. Internet Information Services (IIS) 7.0 includes new flexibility and capabilities for building scalable Web sites and applications. By adding the Application Server role, Windows Server 2008 enables an improved environment for deploying and running custom, server-based business applications. It also includes support for Web services built on Windows Communication Foundation (WCF), Windows Workflow Foundation (WF), and more.
If you have existing .NET Framework applications, you should be aware of the available support provided by Windows Server 2008 for the various .NET Framework versions. The following table outlines the support provided.
.NET Framework Version
Supported in Windows Server 2008
Comments
1.0
No
You should migrate these applications to a more recent version of the .NET Framework.
1.1 Service Pack 1
Yes
Applications written using the .NET Framework 1.1 SP1 will continue to work on Windows Server 2008.
Note the end dates of support for this version of the Framework, which are not related to the product life cycle of Windows Server 2008. For more information, see the .NET Framework 1.1 dates in Microsoft Support Life Cycle.
2.0 Service Pack 1
Yes
Included in Windows Server 2008.
Supported regardless of the server roles selected. You can run applications built for the .NET Framework 2.0 without installing additional software or requiring additional configuration of your server.
3.0 Service Pack 1
Yes
Included in Windows Server 2008.
Configuring Windows Server 2008 as an Application Server activates the included support for the .NET Framework 3.0 Service Pack 1.
3.5
Yes
Windows Server 2008 does not ship with the .NET Framework 3.5. However, you can install this version to take advantage of the new features it offers.
Note: This version depends on the .NET Framework 2.0 Service Pack 1 and the .NET Framework 3.0 Service Pack 1, which are included in Windows 2008 Server.
For more information about .NET Framework support in Windows Server 2008, see the following:

scom 2007 r2 microsoft sql server is required. please see details

When installing OpsMgr on SQL 2008 R2 the installation will not find the SQL instance and give the following error: Microsoft SQL Server is required. Please see details
prereq
To go around this requirement, use the DBCreateWizard.exe that you find on the OpsMgr media \SupportTools\\DBCreateWizard.exe
Observe that this is NOT TESTED OR SUPPORTED by Microsoft!!!
And that one will find the instance.
sqlr2
Observe that this is NOT TESTED OR SUPPORTED by Microsoft!!!

Tuesday, September 7, 2010

xmlnotepad 2007 slow


We have discovered a problem in XML Notepad 2007 related to our new schema files we are using in Wolverine.  If you encounter a problem where XML Notepad is producing errors when it shouldn’t be or freezing/crashing then I have the solution for you!

How to fix XML Notepad:
1.       Open XML notepad (may need to open a file that uses a schema, it would hang if I tried to use a file with no schema such as .cfg).
2.       Click View -> Schemas…
3.       In the new window that opens click File -> Clear.
4.       Click OK.

How to make sure it STAYS fixed:
1.       Open XML Notepad (but make sure not to have a file that specifies a schema/.xsd file).
2.       Clear the schemas as above.
3.       Close XML Notepad.
4.       Browse to the XML Notepad confg file (usually found at C:\Documents and Settings\\Local Settings\Application Data\Microsoft\Xml Notepad\)
5.       Right click on the ‘xmlnotepad.settings’ file.
6.       Click Properties.
7.       Check the option for Read Only.
8.       Click OK.