Chris Summers at myITforum.com

[NAP] NPS/NAP Reporting - Architecture

CSummers311 — Sun, 20 Dec 2009 15:40:28 GMT

This is part 2 of my NAP Reporting series.

At this phase in my NAP project we are in a DHCP reporting mode. This is the easiest way to get your feet wet with NAP, you install NPS on your DHCP servers, and create NAP policies that allow all health levels access to the network. In order to define my security policies at 1 location, I've got all DHCP servers configured as RADIUS clients to a central NPS server. This simplifies NAP administration and also allows me to enable ACS on the central server instead of having it enabled on all DHCP servers. If I wanted to have a decentralized model, ACS could just as easily handle it.

So why ACS? There are several problems with the NPS SQL logging that are handled automatically by ACS. ACS provides you with the database, tables, views, reports, and grooming jobs. With NPS SQL logging your on your own to create all of that. Plus as I mentioned in the last post, the event log has more information than what is provided in SQL logging. Using ACS isn't perfect though, the format of the database is difficult to use at first and it's not suitable for long term storage. If you've got some event log collection software already implemented you may want to consider the pros and cons of using it vs. ACS. I plan on eventually creating a data warehouse to solve my reporting issues but I'm not familiar with that process yet. If or when I get there, I'll blog about it, until then SecureVantage or EnterpriseCertified might have a product that helps.

I'm not going to get into the details of how to set NAP up because Microsoft's step by step guides are excellent. This diagram show's how I've got my environment setup, it's not too complicated and should apply whether you're doing DHCP NAP reporting or any of the other enforcement methods such as 802.1x or IPSec.

[NAP] NPS/NAP Reporting - Introduction

CSummers311 — Fri, 11 Dec 2009 03:53:24 GMT

I've spent a lot of time this year working on a MS NAP implementation. I'm nowhere near complete with this project but I would like to share what I've got so far in reference to reporting.

The best article I could find on NAP reporting is a guest post on the Microsoft NAP blog by Alex Chalmers from Ball State University. I'm sure it works fine but it's much more complicated than my environment warrants and since I'm a OpsMgr/ConfigMgr guy, I figured I would try it using ACS instead.

The benefits of ACS is that we don't need to have NAP SQL reporting enabled which eliminates a failure point for authentication and many SQL services depending on how many NPS servers you are running. The built in SQL reporting feature also doesn't include the health validator results while the event log does. Without this we can't determine why a client failed to meet our policy. ACS also takes care of data grooming for us.

ACS sounds pretty easy, all we need to do is enable the ACS forwarder on the NAP server and we're good…

Almost… There are a few road blocks that I've had to overcome. OpsMgr RTM/SP1's EventSchema did not include the events related to NAP. With R2, the events are included in the schema but the last few parameters of the event get truncated which throws out the SHV result.

This is going to be at least a 5 part series. In my next post, I'll outline the server architecture. In Part 3, I'll go over my EventSchema.xml customizations. In part 4, I'll show you how to parse the SHV result in SQL. In Part 5, I'll give you some sample reports. I hope to have these completed in the next 2 weeks. If I slack off, nudge me via the contact form.

[OpsMgr] Compare Management Packs Across Management Groups

CSummers311 — Fri, 11 Dec 2009 03:10:24 GMT

The following query will give you the version of each management pack on multiple management groups. Replace MG1 and MG2 with your management group names. This is only useful if you have multiple management groups reporting to the same data warehouse.

With MPs(MG, MP, Version)
AS (
SELECT     vManagementGroup.ManagementGroupDefaultName, vManagementPack.ManagementPackDefaultName, vManagementPackVersion.ManagementPackVersion
FROM         vManagementGroupManagementPackVersion INNER JOIN
                      vManagementGroup ON vManagementGroupManagementPackVersion.ManagementGroupRowId = vManagementGroup.ManagementGroupRowId INNER JOIN
                      vManagementPackVersion ON
                      vManagementGroupManagementPackVersion.ManagementPackVersionRowId = vManagementPackVersion.ManagementPackVersionRowId INNER JOIN
                      vManagementPack ON vManagementPackVersion.ManagementPackRowId = vManagementPack.ManagementPackRowId
)
Select MP, MG1, MG2
from MPs
Pivot (
      max(Version)
      FOR MG in ([MG1], [MG2])) as pvt

Sample Output:

MP	MG1	MG2
Windows Cluster Library	6.1.7221.0	6.0.6278.0
Windows Core Library	6.1.7221.0	6.0.6278.0
Windows Server 2000 Operating System	6.0.6667.0	6.0.6321.5
Windows Server 2003 Operating System	6.0.6667.0	6.0.6321.5
Windows Server 2008 Internet Information Services 7.0	NULL	6.0.6539.0
Windows Server 2008 Operating System (Discovery)	6.0.6667.0	6.0.6321.5
Windows Server 2008 Operating System (Monitoring)	6.0.6667.0	6.0.6321.5
Windows Server Internet Information Services 2000	NULL	6.0.6539.0
Windows Server Internet Information Services 2003	NULL	6.0.6539.0
Windows Server Internet Information Services Library	NULL	6.0.6539.0
Windows Server Operating System Library	6.0.6667.0	6.0.6321.5
Windows Service Library	6.1.7221.0	6.0.6278.0
WS-Management Library	6.1.7221.0	6.0.6278.0

Use a Query String To Populate the Computer in Ron Crumbaker's Web Remote Tools

CSummers311 — Thu, 12 Feb 2009 19:59:00 GMT

These changes will allow you to link to the Web Remote Tools and automatically populate the computer input box using a query string. For example: http://configmgr/tools/default.asp?sMachine=computer1

Open Default.asp and make this change:

Line 21:

<frame name="contents" scrolling="no" target="Nav" "resizable=yes,scrollbars=yes" src="MachRest.asp?sMachine=<%=sMachine%>" topmargin="2" tabindex="-1">

Open machrest.asp and add these lines to the top:

Line 1:	<%
Line 2:	dim sMachine: sMachine = Request.QueryString("sMachine")
Line 3	%>

Disappearing DNS Community Fix

CSummers311 — Fri, 07 Nov 2008 13:14:00 GMT

From Ian Blyth - System Center Technologies Blog

"I mentioned the problem that a number of people are having with the latest DNS MP in a previous post. Apparently Microsoft are aware of the bug but they can not repro it. Without being able to reproduce it they are having a problem fixing it. However Daniele Grandini contacted me with a fix that he has created. In his environment his DNS servers went from 38 to 53 after applying his fix and they have not disappeared since.
He says
The discovery script has a bug when the WMI query fails, in this case it will return an empty discovery document, this in turn will delete the previous discovery. This explains the flip flop behaviour with disappearing and reappearing DNS Servers. It must be added that the discovery runs every 15 mins making this more visible."

More @ http://ianblythmanagement.wordpress.com/2008/11/07/disappearing-dns-community-fix/

Importing Drivers Fails in ConfigMgr 2007

CSummers311 — Wed, 16 Jul 2008 18:00:00 GMT

This is probably a rare issue but I'm going to blog about it since I didn't quickly find anything on the web about this.

Today I ran into an issue where our OSD guy could no longer import drivers. Every time he would try to import drivers he would get the message "An error occurred while importing the selected driver."

Cause

He created a new driver package the used the same source directory as the source of the drivers he was importing. Configuration Manager must stamp the directory in a way that causes the imports to fail.

UPDATE: Single Instance Store (SIS) was enabled on the drive. I now believe this was the root cause

Solution
Do not create a Driver Package with the same source directory as Drivers.

UPDATE: If my new cause theory is correct, disable SIS

Troubleshooting Details
First thing I did was open C:\SMSADMIN\AdminUI\AdminUILog\SmsAdminUI.log with SMS Trace which shows the error below.
Description = "Error creating driver digest. Code 0x80004005";
ErrorCode = 16389;

That didn't get me anywhere so I opened DriverCatalog.log on the SMS server.
HashFile failed as \\server\smssource\osd\drivers\delloptiplex755\e1e5132.inf is a Reparse Point that SMS does not support via downloads, -1Since I had noticed earlier that he had created the driver package in the same folder I created a new driver source directory for him and he was again able to import drivers.