MS-Opsmgr

Microsoft System Center Operations Manager

SCOM 2016 – Monitor Changes to the Domain Administrators Group

In this blog post I am going to take you thru the steps I took to monitor changes made to the Domain Administrators Group inside a Active Directory.

First step is to create a management pack where we store the WMI-Discovery, the Monitors and the Views. A manual on how to create a management pack using the system center operations manager console can be found here

  1. Start the “System Center Operations Manager Console” and navigate to “Authoring
  2. In the “System Center Operations Manager Console” in the “Authoring” section expand “Management Pack Object” and select “Attributes
  3. In the “System Center Operations Manager Console” in the “Attributes” section right click “Attributes” and click “Create a New AttributeAttribute01 
  4. In the “Create Attribute Wizard”in the “General Properties” section  give the attribute the name  “Running Domain Controller Service” and click “Next
    Attribute02
  5. In the “Create Attribute Wizard” in the “Discovery Method” section, change the following settings:
    • Change the "Discovery Type" to "WMI Query"
    • Change the "Target" to "Windows Server"
    • Change the "Management Pack" to "Group Member Changes"

    In the “Create Attribute Wizard” in the “Discovery Method” section click “Next”. The result should look something like this:
    Attribute03

  6. In the “Create Attribute Wizard” in the “WMI Configuration” section change the following settings:
    • Change the "WMI Namespace" to "root\cimv2"
    • Change the "Query" to "select * from Win32_OperatingSystem where (ProductType = "2""
    • Change the "Property Name" to "ProductType"
    • change the "Frequency" to "900"

    In the “Create Attribute Wizard” in the “WMI Configuration” section click “Finish”. The result should look something like this:
    Attribute04

Now that we created the attribute we need to create a Group.

  1. Start the “System Center Operations Manager Console” and navigate to “Authoring
  2. In the “System Center Operations Manager Console” in the “Authoring” section select “Groups
  3. In the “System Center Operations Manager Console” in the “Authoring” section right click “Groups” and click “Create a New Group
    Group01
  4. In the “Create Group Wizard” in the “General Properties” section change the following settings: 
    • Change the "Name" to "Servers Running Domain Controller Service"
    • Change the "Management Pack" to "Group Member Changes"

    In the “Create Group Wizard” in the “General Properties” section click "Next". The result should look something like this.
    Group02

  5. In the “Create Group Wizard” in the “Explicit Members” section click “Next
  6. In the “Create Group Wizard” in the “Dynamic Members” section click “Create/Edit Rules
  7. In the “Create Group Wizard -  Query Builder” wizard, set the following settings: 
    • Change the "Select the Desired class and click add button to begin building the formule" to "Windows Server_Extended" click "Add"
    • From the Pull down list select "Running Domain Controller Service"
    • Set the Operator to "Greater"
    • Change the Value to "2" and click "Ok"

    In the “Create Group Wizard” in the “Dynamic Members” section click "Next". The result should look something like this.:
    Group04

  8. In the “Create Group Wizard” in the “Subgroups” section click "Next".
  9. In the “Create Group Wizard” in the “Excluded Members” section click "Create".

When you look at which servers are managed by the above created groups

Group05

Now its time to create a custom rule to monitor the changes made to the Domain Admins Groups

  1. Start the "System Center Operations Manager Console" and navigate to “Authoring
  2. In the “System Center Operations Manager Console” in the “Authoring” section expand “Management Pack Object” and select “Rules
  3. In the “System Center Operations Manager Console” in the “Attributes” section right click “Attributes” and click “Create a New Rule
    Rule01
  4. In the “Create Rules Wizard” in the “Rule Type” section, set the following settings:
    • In the "Select the type of rule to create" expand "Alert Generating Rules", "Event Based" and select "NT Event Log (Alert)"
    • In the "Management pack" section select the "Group Member Changes" management pack

    In the “Create Rule Wizard” in the “Rule Type” section click "Next". The result should look something like this.:
    Rule02

  5. In the “Create Rule Wizard”, in the “General” section, set the following settings:
    • Enter the "Rule Name" "Security Group Alert – User Added to Group"
    • Change the "Rule Category" to "Alert"
    • Change the "Rule Target" to "Windows Server"
    • Uncheck "Rule is enabled"

    In the “Create Rule Wizard” in the “General” section click "Next". The result should look something like this.:
    Rule03

  6. In the “Create Rule Wizard” in the “Event Log Type” section change the log name to “Security” and click “Next
  7. In the “Create Rule Wizard” in the “Build event Expression” section., change Event-ID Value to “4782”, change the event source to “Parameter 3” whit the value “Domain Admins”. Click “Next” The result should look something like this:
    Rule04
  8. In the “Create Rule Wizard” in the “Configure Alerts” section. Click “Create.
    Rule05

When you now add a user to the Domain Admins group the following alert is generated.

Warning

I created a management pack which is also monitoring the “Domain Admins”, “Schema Admins”, “Enterprise Admins”. The only difference. is that a warning is generated and that the rules are enabled. You can download the management pack from here

Opsmgr Agent install Error 25218

When I install a opsmgr agent manually on a Windows Server 2008 r2 domain controller. I am getting the following error.

1

I used the following steps to resolve the issue:

  1. Start the “wmimgmt.msc
  2. Right click “WMI Control (Local)” if you see the following: “Failed to initialize all required WMI Classes
     2
  3. Stop the “WMI Services
  4. Open a “command prompt” and change the directory to “c:\windows\SysWOW64\wbem
  5. Type the following command to make sure that all WBEM DLL’s are correctly registrered: “for /f %s in (‘dir /b *.dll’) do regsvr32 /s %s
     3
  6. Run the following command “Net stop /y winmgmt
  7. Run the following command “for %i in (*.mof, *.mfl) do Mofcomp %i
     4
  8. Start the “net start winmgmt
  9. Start the “wmimgmt.msc
  10. Right click “WMI Control (Local)” if you see the following: “Failed to initialize all required WMI Classes” 
    5
  11. Install the agent.