SCOM 2016 – Install System Center Operations Manager 2016 – Part 2

Posted December 17th, 2016 . 4 Comments . Opsmgr, SCOM, SCOM2016 Tags: scom; SCOM 2016; Management Sever; Service Accounts

In this series off blog post I am going to take you true the steps I took to install System Center Operations Manager 2016. The Environment will be installed using the following software:

Microsoft Windows Server 2016 – Download from here
Microsoft SQL Server 2016 – Download from here
System Center Operations Manager 2016 – Download from here

My Test environment consist of the following servers,

DC01 – Domain Controller
SQL01 – Microsoft SQL 2016 server
DATA01 – Data Server
MS01 – Scom Management Server 01
MS02 – Scom Management Server 02
WEB01 – Scom Web Console Server,

Here you can find the previous blogposts

SCOM 2016 – Install System Center Operations Manager 2016 – Part 1
SCOM 2016 – Install System Center Operations Manager 2016 – Part 2
SCOM 2016 – Install System Center Operations Manager 2016 – Part 3
SCOM 2016 – Install System Center Operations Manager 2016 – Part 4
SCOM 2016 – Install System Center Operations Manager 2016 – Part 5
SCOM 2016 – Install System Center Operations Manager 2016 – Part 6

Before we can deploy System Center Operations Manager 2016 we need to create the Service accounts.

Domain\Account	Description
ms-opsmgr\Srv-OpsmgrAction	Unless an action has been associated with a Run As profile, the credentials that are used to perform the action will be those defined for the action account
ms-opsmgr\Srv-OpsmgrDataAccess	The System Center Configuration service and System Center Data Access service account is used by the System Center Data Access and System Center Management Configuration services to update information in the Operational database. The credentials used for the action account will be assigned to the sdk_user role in the Operational database.
ms-opsmgr\Srv-OpsmgrSqlRead	The Data Reader account is used to deploy reports, define what user the SQL Server Reporting Services uses to execute queries against the Reporting data warehouse, and define the SQL Reporting Services account to connect to the management server.
ms-opsmgr\Srv-OpsmgrSqlWrite	The Data Warehouse Write account is the account used to write data from the management server to the Reporting data warehouse, and it reads data from the Operations Manager database

I also created a security group “SG – Opsmgr Administrators” where the user “Srv-OpsmgrDataAccess” and “Srv-OpsmgrAction” is added. I used the following script to create the accounts.

# Powershell script to create the User accounts for System Center Operations Manager 2016
# User: Roel Knippen 
# Date: 29-11-2016
# Note: System Center Operations Manager needs the following Service Accounts
# - Opsmgr Action Account
# - Opsmgr Data Access
# - Opsmgr SQL Data Warehouse Write account 
# - Opsmgr SQL Data Warehouse Read account 
# I also create a group fore Opsmgr Administrators
# Change the <XXX> Values to your own Values 

# Declare variable.

$Group = "<XXX>"
$GroupDescription = "<XXX>"
$GroupPath = "OU=<XXX>,OU=<XXX>,OU=<XXX>,DC=<XXX>,DC=<XXX>"
$Users = "<XXX>", "<XXX>", "<XXX>", "<XXX>"
$UserPath = "OU=<XXX>,OU=<XXX>,OU=<XXX>,DC=<XXX>,DC=<XXX>"
$Password = (ConvertTo-SecureString -String "<XXX>" -AsPlaintext -Force)
$Domain = "<XXX>"

# Check if module Active Directory is loaded if not loaded then load the module.

Write-Host "Checking to see if the Active Directory Powershell module is installed"
if ((get-module -Name ActiveDirectory -ErrorAction SilentlyContinue | foreach {$_.Name}) -ne "ActiveDirectory")
{
    write-Host "Active Directory Management PowerShell module is not imported. Importing write now....
."
    Import-Module ActiveDirectory
}
else
{
    write-Host "Active Directory Management Powershell moduel is imported"   
}

# Creating Groups and Accounts
write-Host "Check if Active Directory Group exists"

if (@(Get-ADGroup $Group -ErrorAction SilentlyContinue))
{
    Write-Host "Group" $Group "Already Exists"
}
Else
{
    Write-Host "Create group" 
    New-ADGroup $Group -Groupscope Global -GroupCategory Security -Path $GroupPath -Description $GroupDescription
}
 
Foreach ($User in $Users)
{
    if (@(Get-ADUser -Identity $User -ErrorAction SilentlyContinue -WarningAction SilentlyContinue))
    {
        Write-Host "User account" $User "Already exists"
    }
    else
    {
        Write-Host "Create account" $User
        New-AdUser -Name $User -GivenName $User -Surname $user -SamAccountName $User -UserPrincipalName "$User@$Domain" -AccountPassword $Password -Path $UserPath -PassThru | Enable-ADAccount
        if ($User -eq "<XXX>") #The account you want to use for Opsmgr Action Account
        {
            Add-ADGroupMember $Group -Members $User 
        }
        if ($User -eq "<XXX>") #The account you want to use for Opsmgr Data Access
        {
            Add-ADGroupMember $Group -Members $User 
        }
    }
}

# Powershell script to create the User accounts for System Center Operations Manager 2016

# User: Roel Knippen

# Date: 29-11-2016

# Note: System Center Operations Manager needs the following Service Accounts

# - Opsmgr Action Account

# - Opsmgr Data Access

# - Opsmgr SQL Data Warehouse Write account

# - Opsmgr SQL Data Warehouse Read account

# I also create a group fore Opsmgr Administrators

# Change the <XXX> Values to your own Values

# Declare variable.

$Group = "<XXX>"

$GroupDescription = "<XXX>"

$GroupPath = "OU=<XXX>,OU=<XXX>,OU=<XXX>,DC=<XXX>,DC=<XXX>"

$Users = "<XXX>", "<XXX>", "<XXX>", "<XXX>"

$UserPath = "OU=<XXX>,OU=<XXX>,OU=<XXX>,DC=<XXX>,DC=<XXX>"

$Password = (ConvertTo-SecureString -String "<XXX>" -AsPlaintext -Force)

$Domain = "<XXX>"

# Check if module Active Directory is loaded if not loaded then load the module.

Write-Host "Checking to see if the Active Directory Powershell module is installed"

if ((get-module -Name ActiveDirectory -ErrorAction SilentlyContinue | foreach {$_.Name}) -ne "ActiveDirectory")

{

write-Host "Active Directory Management PowerShell module is not imported. Importing write now....

Import-Module ActiveDirectory

}

else

{

write-Host "Active Directory Management Powershell moduel is imported"

}

# Creating Groups and Accounts

write-Host "Check if Active Directory Group exists"

if (@(Get-ADGroup $Group -ErrorAction SilentlyContinue))

{

Write-Host "Group" $Group "Already Exists"

}

Else

{

Write-Host "Create group"

New-ADGroup $Group -Groupscope Global -GroupCategory Security -Path $GroupPath -Description $GroupDescription

}

Foreach ($User in $Users)

{

if (@(Get-ADUser -Identity $User -ErrorAction SilentlyContinue -WarningAction SilentlyContinue))

{

Write-Host "User account" $User "Already exists"

}

else

{

Write-Host "Create account" $User

New-AdUser -Name $User -GivenName $User -Surname $user -SamAccountName $User -UserPrincipalName "$User@$Domain" -AccountPassword $Password -Path $UserPath -PassThru | Enable-ADAccount

if ($User -eq "<XXX>") #The account you want to use for Opsmgr Action Account

{

Add-ADGroupMember $Group -Members $User

}

if ($User -eq "<XXX>") #The account you want to use for Opsmgr Data Access

{

Add-ADGroupMember $Group -Members $User

}

You can find it here

The next step that we need to make the group “SG – Opsmgr Administrators” local administrator on the two management Servers named “MS01” and “MS02” I am going to do this using Group Policy’s

Start the “Group Policy Management Console”
On the Organization Unit where you moved the Management Server to right click “Create a GPO in this domain, and link it here”
In the “New GPO” windows enter the name that you want to give the GPO. I named mine “Default Opsmgr Policy”
Right click on the “GPO” and click “Edit”
In the “Group Policy Management Editor” browse tot the following location “<Gpo Name>\Computer Configuration\Policies\Windows Settings\Security Settings\Restricted Groups”
In the “Group Policy Management Editor” select “Restricted Groups”. Right click on “Restricted Groups” and click “Add Group”
On the “Add Group” page. browse to the above create group. In my case “SG – Opsmgr Administrators” and click “Ok”
In the “Ms-opsmgr\SG – Opsmgr Administrators properties” screen in the “This group is member is off” click “Add” and add a Local “Administrators” group. and click “Ok”
Close the “Group Policy Management Editor”
On the clients “MS01” and “MS02” run the command “Gpupdate /force” and restart the Computer. The result should look something like this:

Now that al prerequisites are installed it’s time to install the first management Server.

Log in to the first management server "MS01" that is member of the "SG – Opsmgr Administrators"
Run "Setup.exe"
On the “Operations Manager” screen click “Install”
On the “Operations Manager” screen, in the “Select features to install” section select “Management Server” and click “Next”
On the “Operations Manager” screen, in the “Select Installation location” section click “Next”
On the “Operations Manager” screen, in the “Proceed with setup” section click “Next”
On the “Operations Manager” screen, in the “Specify an installation option” section, select “Create a first management server in a new management group” and enter “Management group name” in my case I entered “Ms-opsmgr” and click “Next”
On the “Operations Manager” screen, in the “Please read the license term” section, check the “I have read, understood, and agree with the license terms” and click “Next”
On the “Operations Manager” screen, in the “Configure the Operational Database” enter the “Server Name and Instance” press “Tab”. When the connection is made click “Next”
On the “Operations Manager” screen, in the “configure the data warehouse database” section enter the “Server name and instance name” and click “Next”
On the “Operations Manager” screen, in the “Configure Operations Manager Accounts” section enter the accounts that you created above and click “Next”. The result should look something like this:
On the “Operations Manager” screen, in the “Diagnostic and Usage data” section click “Next”
On the “Operations Manager Setup” screen, in the “Windows Update” section, check “Off” and click “Next”
On the “Operations Manager Setup” screen, on the “Installation Summary” section click “Install”
On the “Operations Manager Setup” screen, on the “Setup complete” screen click “Close”

When finished installing Systeem Center Operations Manager 2016 om MS01 its time to enter the License key. This is done by taking the following steps:

Start the "Operations Manager Shell" as "Administrator"

Type the following command and press "Enter":

Set-SCOMLicense -ProductId "XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"<br /><br /><br /><a href="http://www.ms-opsmgr.eu/wp-content/uploads/2016/12/InstallLicense01.png"><img title="InstallLicense01" style="border-left-width: 0px; border-right-width: 0px; background-image: none; border-bottom-width: 0px; float: none; padding-top: 0px; padding-left: 0px; margin-left: auto; display: block; padding-right: 0px; border-top-width: 0px; margin-right: auto" border="0" alt="InstallLicense01" src="http://www.ms-opsmgr.eu/wp-content/uploads/2016/12/InstallLicense01_thumb.png" width="602" height="317" /></a><br />

Set-SCOMLicense -ProductId "XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"<br /><br /><br /><a href="http://www.ms-opsmgr.eu/wp-content/uploads/2016/12/InstallLicense01.png"><img title="InstallLicense01" style="border-left-width: 0px; border-right-width: 0px; background-image: none; border-bottom-width: 0px; float: none; padding-top: 0px; padding-left: 0px; margin-left: auto; display: block; padding-right: 0px; border-top-width: 0px; margin-right: auto" border="0" alt="InstallLicense01" src="http://www.ms-opsmgr.eu/wp-content/uploads/2016/12/InstallLicense01_thumb.png" width="602" height="317" /></a><br />

In the Next Part we are going to install the second management server and the console.

4 Responses to “SCOM 2016 – Install System Center Operations Manager 2016 – Part 2”

[…] SCOM 2016 – Install System Center Operations Manager 2016 – Part 2 […]

Pingback by SCOM 2016 – Install System Center Operations Manager 2016 – Part 1 « MS-Opsmgr — December 17, 2016 @ 9:42 pm
[…] SCOM 2016 – Install System Center Operations Manager 2016 – Part 2 […]

Pingback by SCOM 2016 – Install System Center Operations Manager 2016 – Part 3 « MS-Opsmgr — December 29, 2016 @ 12:09 pm
[…] SCOM 2016 – Install System Center Operations Manager 2016 – Part 2 […]

Pingback by SCOM 2016 – Install System Center Operations Manager 2016 – Part 4 « MS-Opsmgr — February 11, 2017 @ 4:11 pm
[…] SCOM 2016 – Install System Center Operations Manager 2016 – Part 2 […]

Pingback by SCOM 2016 – Install System Center Operations Manager 2016 – Part 5 « MS-Opsmgr — March 16, 2017 @ 3:54 pm

RSS feed for comments on this post. TrackBack URL

Leave a Response

about me:

This website is run by Roel Knippen. I work as System Engineer at ROC De Leijgraaf , a comprehensive school located in Veghel.

Besides the regular certifications (MCSA, MCSE) I am also certified for SCOM 2007 r2 (System Center Operations Manager).

I am currently working with: System Center Operations Manager 2012, System Center Operations Manager 2012 R2, System Center Configuration Manager 2012.

My twitter Posts:

Disclaimer:

The information in this weblog is provided 'AS IS' with no warranties, and confers no rights

This weblog does not represent the thoughts, intentions, plans or strategies of my employer. It is solely my opinion.

Feel free to challenge me or to disagree with me in the comments section of each blog entry, but I reserve the right to delete any comment for any reason whatsoever (abusive, profane, rude, or anonymous comments). So keep it polite, please