The following are the list of steps that I took to install the Operations Manager (OpsMgr) 2012 agent on a workgroup based Windows Server Core 2008 R2 computer using certificates and without using a gateway server. Sometimes you might have a few servers in a workgroup e.g. DMZ that need to be monitored, so the below are the exact steps I took with the help of this article from Microsoft http://support.microsoft.com/kb/947691 In fact, these steps for the certificate template, requesting certificates, adding certificates to the local computer store and using the momcertimport tool are all exactly the same for adding certificates to gateway servers (communication between gateway and management servers), also agents (communication between the agent and gateway servers). See this link from the Microsoft TechNet Library for firewall rules using port 5723. I am writing this from the perspective of the command line, so that it will work for GUI based and non-GUI servers.
The first thing you need to do is get the workgroup based computers/servers to trust your internal domain certificate authority/PKI. So you’ll need to download the certificate chain as a .p7b file, then import this into the Server Core workgroup server. This ensures that the workgroup server can fully trust your domain based certificate authority, so that later the workgroup Server Core workgroup server can successfully take part in the certificate exchange. I am assuming here that your Operations Manager server is in the same domain as the certificate authority.
Prior to starting, make sure you change the security for manual agent installs to Review new manual agent installations in pending management view. This setting can be found under Administration > Security.
- Logon to the certificate authority issuing server http://<certificateserver>/certsrv or https://<certificateserver>/certsrv from a domain based computer in the same domain where your certificate authority lives.
- Click Download a CA certificate, certificate chain, or URL
- Select Base 64 and click on Download CA certificate chain
- Save the .p7b file to a location on your computer.
- Now you will need to give yourself access to the Server Core workgroup server from the same domain based computer that you are on. Open command prompt > type in cmdkey /add:<ServerName> /user:<UserName> /pass:<password> Where: ServerName is the name of the server running the Server Core installation, and UserName is the name of an administrator account in the format of <servername>\<username>.
- Open the Microsoft Management Console (mmc.exe), click start > run > type mmc > click OK.
- Click on File > Add/Remove Snap-in > click Certificates on the left > click Add > Click Computer Account > Another Computer. Here you type in the name of the Server Core workgroup computer, then click Finish. Click OK to the other box.
- Expand the Certificates node > expand Trusted Root Certification Authorities
- Right click on the Certificates folder > choose All Tasks > Import.
- Browse to the .p7b file you created before > click next > click next > click Finish.
The next thing that you will need to do is create a certificate template. Do this on the certificate server.
- Open Certificate Templates, Click Start > click Run > type mmc > click OK.
- From the File menu, click Add/Remove Snap-in > click Add > under Add Standalone Snap-in, click Certificate templates > click Add > click Certification Authority > choose local computer > click Finish > click OK.
This is what you will see:
- Click Certificate Templates > right click Computer > select duplicate template. Select Windows Server 2003
- On the General Tab type a name like ‘OpsMgrWorkGroup’
- On the Request Handling > select Allow private key to be exported
- Click the Subject name tab > click Supply in the Request option
- On the Security Tab, Authenticated users, Domain Admins, Domain Computers and Enterprise Admins should have Enroll and Auto Enroll permissions.
- Add the new template to the CA. Right click Certificate Templates > New > certificate template to issue > choose the template you just created
- Verify that the new template appears in the details pane, and then verify that the Server Authentication entry and the Client Authentication entry appear under Intended Purpose.
- Open command prompt > type in gpupdate /force > hit enter.
The next thing you will need to do is request and import a certificate for the Management Server and on the workgroup computer
- Create a certificate request .inf file:
For most non-domain workgroup computers, the CN= equals NetBIOS name. Example: Subject="CN=MyWorkGroupPC". However, this may not work and you might receive errors in the event log after you finish all these steps. In this case, look for Event ID: 20052 in the Operations Manager event Log on the agent machine.
Event 20052
The specified certificate could not be loaded because the Subject name on the certificate does not match the local computer name
Certificate Subject Name: dc-au-hv-20
Computer Name: DC-AU-HV-20.domain.localTo make sure you enter the correct CN name for the certificate in the request file, you can do a ping -a 1.1.1.30 on the server using it’s IP address, this should return the correct CN name to use.
And here’s the contents of the request file:
[NewRequest]
Subject="CN=<FQDN>"
Exportable=TRUE
KeyLength=2048
KeySpec=1
KeyUsage=0xf0
MachineKeySet=TRUE
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1
OID=1.3.6.1.5.5.7.3.2
Save as RequestConfig.inf - Convert the INF into a binary REQ file. Run the following command line to create BinaryRequest.req from RequestConfig.inf
certreq -new -f RequestConfig.inf BinaryRequest.req
- Now you will need to submit the request to your domain based certificate authority. Submit the binary request to the CA and retrieve the resulting certificate. Run the following command line to submit BinaryRequest.req to CorpCA
- From a domain based computer, logon to http://<certificateserver>/certsrv or https://<certificateserver>/certsrv > click Request a certificate.
- Click on Advanced certificate request
- Click on Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.
- Paste the contents of the BinaryRequest.req file you created above into the box > select the OperationsManagerCert template > click Submit
-
Retrieve the certificate. Select Base 64 encoded > click on Download certificate
Download the certificate and save as NewCertificate.cer
- From a domain based computer, logon to http://<certificateserver>/certsrv or https://<certificateserver>/certsrv > click Request a certificate.
- Copy the NewCertificate.cer file to the workgroup computer > run the following command to install the certificate into the Local Computer Personal store certreq -accept NewCertificate.cer
Thanks to the following pages for the above information:
- http://support.microsoft.com/kb/947691
- http://blogs.technet.com/b/momteam/archive/2008/06/02/obtaining-certificates-for-ops-mgr.aspx
- http://www.bpmi.nl/blog/?p=1124
- http://skaraaslan.blogspot.com.au/2012/04/monitoring-non-domain-members-workgroup.html
Export the private key from the the management server and on the workgroup computer
- Click Start, click Run, type cmd, and then press ENTER.
- Type in certutil.exe -privatekey -exportpfx <Subject Name of certificate> <filename>.pfx nochain
- Type in a password twice to confirm.
The next thing that you will need to do is manually install the agent on the workgroup computer
- The MOMAgent.msi agent can be found on the management server C:\Program Files\System Center 2012\Operations Manager\Server\AgentManagement\amd64. Make sure you have access to this directory from the Server Core workgroup server.
- The following example shows a fresh installation of an agent and uses the Local System for the Action Account. When installing the agent on a computer that needs to connect to the gateway server, under Management Server, rather than specifying the name of your management server, specify the name of the gateway server. So you’ll need name resolution in the form of hosts files if no DNS works outside your organisation.
msiexec.exe /i \\path\Directory\MOMAgent.msi USE_SETTINGS_FROM_AD=0 MANAGEMENT_GROUP=<MG_Name> MANAGEMENT_SERVER_DNS=<MSDNSName> ACTIONS_USE_COMPUTER_ACCOUNT=1 USE_MANUALLY_SPECIFIED_SETTINGS=1 SET_ACTIONS_ACCOUNT=1
Use the Momcertimport tool to import the certificate on each, management server and workgroup computer
The Momcertimport tool is used to enter the serial number of the specific certificate in the registry. You must follow these steps on the management server and on the workgroup computer. Make sure that the Operations Manager agent is installed on the workgroup computer. Otherwise, you will receive an error when you run the Momcertimport tool.
- Click Start >click Run.
- In the Open field, type cmd > click OK.
- Type the following command, and then press ENTER:
MOMCertImport.exe <filename>.pfx
The MOMCertImport.exe tool can be found in the Support Tools folder of the Operations Manager installation media.
- Restart the OpsMgr Health service (aka System Center Management). Don’t forget to do this on the management server and the workgroup computer.
- sc stop HealthService
- sc start HealthService
To uninstall the agent, should you need to, run the following command:
- msiexec.exe /x <path>\MOMAgent.msi
Marc Kean 
Good answer back in return of this difficulty with
firm arguments and explaining the whole thing
on the topic of that.
You can certainly see your expertise in the work you
write. The arena hopes for more passionate writers like you who aren’t afraid to mention how they believe. Always go after your heart.
Very good post! We are linking to this great content on our site.
Keep up the good writing.
This is really interesting, You are a very skilled blogger.
I’ve joined your rss feed and look forward to seeking more of your great post. Also, I’ve shared your website in my social networks!
Hello there! I know this is kind of off topic but
I was wondering if you knew where I could find a captcha
plugin for my comment form? I’m using the same blog platform as yours and I’m having problems finding one?
Thanks a lot!
Hello there! This blog post couldn’t be written much better! Looking through this post reminds me of my previous roommate! He constantly kept preaching about this. I will forward this article to him. Fairly certain he’s going to
have a great read. Thank you for sharing!
Hi,
I’m having some troubles to validate the certificates and communicate with the Operations Manager Server, even when I follow the steps, always receive the following ID Errors in Event Viewer: 21006, 21016 and 20071 on the Workgroup server. Could you please give me some help about my issue? Thanks! Great post by the way… :)
When you request the certificate, try changing the CN, if you used a FQDN before use a hostname instead vice versa. ________________________________
I relish, lead to I found just what I used to be having a look for.
You’ve ended my four day long hunt! God Bless you man. Have a great day. Bye
This innovative new smoking substitute, not only
simulate cigarette smoke however as well the warmth associated with dragging off
a ordinary cigarette, as a result adding to the emotional habit without addition the harmful substances which contain verified to reason cancerous, as well as carbon monoxide, nitrogen dioxide, hydrocyanic acid, arsenic, and
hydragyrum. The secondary effects are basically the same as nicotine withdrawal,
which often involve wooziness, sleepiness, mild to severe headaches, mood swings, mild hallucinations, and melancholy.
Like many products before it, the electronic cigarette seems to have become
stronger since the health organisations urged caution, claiming not
enough testing had been done to prove them safe.
Thanks for finally talking about >Installing SCOM 2012 agent on a non-domain workgroup
Windows Server Core computer using the command line | Marc Kean <Liked it!
You should be a part of a contest for one of the most useful websites on the web.
I will highly recommend this website!
Can I just say what a comfort to find someone that genuinely
understands what they aare talking about over the internet.
You actually understtand how to bring an issue to light and make it important.
More people need too look at this aand understand this side of your story.
It’s surprising you aren’t mmore popular given that you most certainly
have the gift.
My programmer is trying to convince me to move
to .net from PHP. I have always disliked the idea because of the costs.
But he’s tryiong none the less. I’ve been using
WordPress on a number of websites for about a year and am nervous about switching to another platform.
I have heard great things about blogengine.net.
Is there a way I can transfer all my wordpress posts into it?
Any kind of help would be greatly appreciated!
And even iff it hhad been available, it would have cost you a couple of healthy limbs.
Most webinar companies propvide the finest tools you could ever
find for online seminar purposes. Conclusion Be sure to deliver your speeches to the bes
of your ability.
Znajdziesz 19 artykuły spożywcze że stało się uważany trzeba mieć
produktów w twoje zamrażarka i spiżarnia, i tak będzie, Funkcja niesamowite rzeczy dla zdrowia i wytrzymałość jak grupa wiekowa.
Zamieść to prosto i przedstawienia to gdzieś na swoje miejsce zamieszkania zachować sobie przypomniał zostać dostarczany: owoce morza,
mleczarnia, kale, orzechy, oliwek oliwek niezbędny, brokuły,
owsiane, żywność, awokado, granat sok pomidory, tofu, jogurt,
czerwonawo kolorowe cebula czerwona, czosnek, fasola
i soczewica! To może wydawać się takie jak sporo jeszcze jest minimalne co
można zrobić na własną rękę i największe
wyniki możesz dostarczają pośrednictwem Danie Przygotowanie inicjatywy!
fotograf ślubny Toruń Wielki idea dla zdrowy starzenie jest do Zobacz swoje lekarz stale.
Lekarz stanowi dokładnie to samo gol gdy – utrzymanie Ciało w zdrowie.
Przez podejmowania wysiłku do uzyskania regularne wymeldowanie Ups, mogą Państwo zazwyczaj wychwytywania małych Problemy zdrowotne dobrze przed się wielkich ogromne
problemy zdrowotne. Ponadto, jest to ważne rutynowe
typowe oczy i Egzaminy ustne Testy zbyt. fotografia reklamowa Toruń
To może być w żaden sposób późno zatrzymać palenia
dla tak, że można powolny starzenie. Palenia nie po prostu
podnosi zwiększa ryzyko raka płuc, to jest związane z szereg rodzaje raka
odmian raka, choroby sercowo-choroba wieńcowa, oraz zmniejszyła Skuteczność przeciwko problemy
zdrowotne. Naturalnie, Ponadto ma fatalny wynik na pory naskórka i skóry.
Przez Stop smoking, starzenie może być że może i a może i będziesz rozwiń Twój sposób życia długość.
fotograf ślubny Toruń Jedna z wielu istotnych wskazówki do utrzymanie siebie świeże będzie szczęśliwy.
całe ciało reaguje do stres i to również stres przyczyny fizycznych
szkody. Więc tak, że można nadal młody a także zdrowy System, życie codzienne powinien być wypełniona
rzeczy, adorować i pozbyć się wszystkie te inne wyzwania.
Używać wykonywania i relaks zachować młodzieńczy
i nauczyć się docenić dobre Punkty w życiu codziennym.
fotograf ślubny Toruń Aspiryna codziennie zachowa
lekarz wyjazd, a także pomóc zminimalizować ryzyko
zdarzenie sercowe przez dłuższy codzienności.
W amerykańskie Serce Powiązania teraz zaleca minimalna – dawka Aspirin dla pacjentów którzy mogą mieć opętany przeszłość zatrzymanie
akcji serca, są ciężki ryzyka sesje dla zatrzymanie akcji serca, i
tych, które mieć nieprzewidywalne angina. konsultacyjne ze swoimi
lekarza dowiedzieć się, doprowadzić długotrwałe życie.
fotografia reklamowa Toruń W żaden sposób
nie naprawdę używać opalania balsam gdy jesteś w wielkim pośpiechu, po prostu dlatego,
że to niezmiennie przyczyny tragedia! To naprawdę jest
jeden splendor pozycja trzeba zainwestować trochę czasu z bo
skończyć szuka dziwaczne, więc czyste opalania
balsam łokcie ponad stawy kolanowe i . ft i peeling ręce dokładnie aby uniknąć smug.
Użyj swojego krem dużym wyprzedzeniem z zasypianiem zapobiegać Cały Pech praca i dobrze
przed czasem dla każdego wydarzenie specjalne, w przypadku,!
fotografia ślubna Toruń Znajdziesz 19 spożywcze że
stało się uważany musi mieć elementy w twoje
lodówka rodzina i spiżarnia, a oni mogą praca magia aby poprawić swoje zdrowie i
energii jak może wiek. Napisz to dół i przedstawienia to gdzieś na
swoje miejsce zamieszkania aby pomóc utrzymać sobie przypomniał zostać dostarczany: ryby, produkty mleczne,
szpinak, migdały, oliwa z oliwek extra virgin niezbędny, brokuły, owsiane,
mączka z nasion lnu, awokado, granat soki rośliny
pomidora, tofu, jogurt, czerwonawo kolorowe cebule, ząbek czosnku, rośliny strączkowe
i soczewica! Mogłoby się wydawać, podobnie do wielu ale minimalne co
można zrobić sami i wyników możesz generowanie z
twojego kolacja przygotowanie wysiłki! fotografia ślubna Toruń
Jeśli nadal palenia, przestają teraz! Używanie tytoniu rzadko dobre dla Ciebie, jeszcze
jest więcej ważne Przystanek gdy starzejemy. Palenie papierosów rozbija kolagenu Twojej skóry powodując rapid zmarszczki.
Używanie tytoniu też natychmiast podłączony do poprawić Niebezpieczny trudności i rak,
jak również ryzyka tylko rosnąć z życia. Daj się teraz, nie wiem co rzeczywisty
wiek, pomoc Ciało używać zdrowy proces starzenia.
fotografia ślubna Toruń Jeśli uznane sekret do ochrony przed starzenie,
rozważenia na bieżąco i pieniędzy mógłbyś zapisać na sztuczek, płyny i kremy.
Jednak, istnieje tajne to zapobiega nam starzeje.
Alternatywnie, starzenie skutecznie staje Celem wiele ludzi.
Zarządzanie dobrego samopoczucia i spojrzenie twoje największe może być TAD mniej trudne po
zintegrować kilka zaleceń, na przykład
wersji w poniższych punktach, w codzienne styl życia.
fotograf ślubny Toruń wolne rodniki są uszkodzenia po towarów kształcie jak
twój budowa ciała nawróceni jedzenie i O2 do energii.
Głównie dlatego, że chroni przed osoby wolne
rodniki, witaminy przeciwutleniacze może pomóc jesteś uchwyt konsekwencje
z starzenie. Rodzaje przeciwutleniacze są owoce, warzywa świeże, i zboża.
Borówki, jeżyny, brokuły, szpinak|i zielony szpinak
Kapusta są zwłaszcza ciemniejsze żywność zwykle mają lepiej Ilość przeciwutleniacze, witaminy.
WOW just what I was searching for. Came here by searching for
kohls5coupon
Right away I am ready to do my breakfast, when having my breakfast coming
over again to read more news.
Hello Dear, are you truly visiting this website on a regular basis, if so then you
will definitely obtain fastidious know-how.
My spouswe and I stumbled over here coming frtom a different web page and thought I should check things out.
I like what I see so i am just foplowing you.
Look forward to looking over your web page forr a second time.
Why visitors still make use of to read news papers when in this
technological world everything is accessible on web?
mantap gan perkembangan teknologi sekarang, , klw kita gak ikuti bisa ketinggalan kereta , Aerith
[…] же настраивал мониторинг, основываясь на другом гайде, который показался мне более […]