Step-by-step installation guide for monitoring untrusted servers using Operations Manager Most of the time through Operations Manager, you may require to monitor servers and clients that are located outside of the Active Directory environment. These servers and clients may be located in the DMZ as workgroup machines, or maybe you have a number of completely different Active Directory domains and forests that have no relation with each other but need to be monitored by a central Operation Monitor implementation. The Operations Manager agents support two types of authentication method, Kerberos or certificate based authentication. In order to monitor servers and clients located outside the Operations Manager s native Active Directory domain, you will need to configure certificate authentication using either an internal Certificate Authority or through a 3rd party Certificate Authority. Following are the high-level overview of tasks involved in monitoring servers and clients located outside Active Directory domain. Check communication port availability Download the Trusted Root (CA) certificate Import the Trusted Root (CA) certificate Create a certificate template Request a certificate from the enterprise CA Import the certificate into SCOM Manual installation of agents and importing the SCOM certificate to the servers to be monitored Approve agents in SCOM console Agent communication port availability: The SCOM agent uses TCP Ports 5723 and 5724 (both ways) to communicate with root management server. To test the port access between agent server and root management server, you may Log on to the agent server and from command prompt, type Telnet <Management Server> 5723 If you get a cursor at the top left corner then the port is open, any other errors indicate that the port is still closed. 1
Download the Trusted Root (CA) Certificate: The trusted root certificate must be installed on the RMS, MS, Gateway server or DMZ/untrusted domain servers. To download the trusted root certificate, Log on to the computer where you want to install a certificate and connect to the Certificate Enrolment URL on the certificate Authority Server. For example, http://<caservername>/certsrv In case the server in DMZ or untrusted domain cannot reach the certificate Authority Server, you may download the Root (CA) Certificate to any server which has access to the Certificate Enrolment URL on the certificate Authority Server. Then copy the certificate using removable media and imports the same to desired server in DMZ or untrusted domain. On the Welcome page, click Download a CA Certificate, certificate chain, or CRL. On the Download a CA Certificate, Certificate Chain, or CRL page, under Encoding method, click Base 64, and then click Download CA certificate chain. 2
In the File Download dialog box, click Save Then save the certificate with a relevant name such as rootcert to the C:\ drive of your computer. 3
When the download has finished, close Internet Explorer. Import the Trusted Root (CA) certificate: Logon to the server (RMS, MS, Gateway server or DMZ/untrusted domain servers), click Start, and then click Run. In the Run dialog box, type mmc, and then click OK. 4
In the Console1 window, click File, and then click Add/Remove Snap-in. In the Add or Remove Snap-in dialog box, under the available snap-ins, select Certificates, and then click Add. 5
In the Certificates snap-in dialog box, select Computer account, and then click Next. In the Select Computer dialog box, ensure that Local computer: (the computer this console is running on) is selected, and then click Finish. 6
In the Add or Remove Snap-in dialog box, click OK. In the Console1 window, expand Certificates (Local Computer), then expand Trusted Root Certification Authorities, and then click Certificates. 7
Right-click Certificates, select All Tasks, and then click Import. 8
A Certificate Import Wizard opens. In the Certificate Import Wizard window, click Next On the File to Import page, click Browse and select the location where you downloaded the CA certificate file, for example, c:\rootcert.cer, select the file, and then click Open. 9
If the server in DMZ or untrusted domain cannot reach the certificate Authority Server, make sure you copy the root CA certificate from the server where you downloaded the same using the previous step. On the certificate store page, select Place all certificates in the following store and ensure that Trusted Root Certification Authorities appears in the Certificate store box, and then click Next. On the Completing the Certificate Import Wizard page, click Finish to complete the process. At this point you should now have the Trusted Root CA certificate downloaded and installed onto your server. You may verify the same from the local certificate store. 10
Create a certificate template: To create certificate template, you need to access the Certification authority console. Follow the below steps to access Certification authority console. Logon to the Server running Enterprise CA. From the desktop, click Start, point to Programs, point to Administrative Tools, and then click Certification Authority. 11
Under Certification authority (Local), Expand the <Servername-CA name>, right-click Certificate Templates, and then click Manage to open the Certificate Templates Console. 12
From the Certificate Templates console, in the results pane, right-click IPSec (Offline request), and then click Duplicate Template Select either Windows Server 2003 Enterprise or Windows Server 2008 Enterprise as the minimum supported CA type from the window. 13
In the Properties of New Template dialog box, on the General tab, under the Template display name: type a new name for this template (for example, Opsmgr Template). Also set the validity and renewal periods for the certificate if required. 14
On the Request Handling tab, set the Minimum Key Size and select the Allow private key to be exported check box. If you have a specific cryptographic service provider that falls in line with your business policies, you may change the same by clicking on the CSPs box. That will open the CSP Selection window to change the cryptographic service provider. Otherwise leave the default settings. 15
On the Extensions tab, under Extensions included in this template: select Application Policies, and then click Edit In the Edit Application Policies Extension box, click IP security IKE intermediate, and then click Remove. 16
Click Add, and in the Application policies list, hold down the CTRL key to multi-select items from the list, click Client Authentication and Server Authentication, and then click OK In the Edit Application Policies Extension dialog box, click OK 17
On the Security tab, ensure that the Authenticated Users group has Read and Enroll permissions, and then click OK to complete 18
If you are using Windows Server 2008 R2 Certificate Authority, The Computer object for the Certificate Authority must have Read and Enroll permissions within the Security tab. Following additional steps need to be completed in order to meet the additional security requirements in Windows Server 2008 R2 Certificate Authority. Select the Add button from the screen above and then click on the Object Types button from the next screen that pops up. 19
This will open the Object Types window from which you will select the box beside Computers as shown below and then click on OK In the Select Users, Computers, Service Accounts or Groups window, type the name of your Certificate Authority server and then click OK 20
Notice the Certificate Authority computer listed under the Security tab. Select the Certificate Authority computer name and then select the Read and Enroll permissions. Once you have selected the correct permissions for the Authenticated Users and Certificate Authority Computer accounts, click OK to close the Opsmgr Template properties window. Since we have the Opsmgr Template created and configured with the correct permissions, we need to add that template into the Certificate Authority Templates folder in order to be available for the clients to use it. 21
From the Certification Authority snap-in, right-click the Certificate Templates folder, point to New, and then click Certification Template to Issue. From the Enable Certificate Templates box, select the certificate template that you created, and then click OK 22
Notice that the new Opsmgr Template is appeared in the result pane of Certificate Templates. This will now enable the new Opsmgr Template to be used when requesting future certificates for Operation Manager through the Certificate Authority Web Browser enrolment tool. Request a certificate from the enterprise CA: Log on to the server (RMS, MS, Gateway server or untrusted domain servers) where you want to request a certificate. Or you can request the certificate for untrusted servers from your management server and once installed, export the same and import to the respective servers. Pay extra attention while giving the correct FQDN or host name (is server is member of workgroup) while requesting the certificate for untrusted servers. If you are planning to request the operations manager certificate directly from the untrusted server, make sure that you can ping the Operations Manager Server using FQDN from the untrusted domain/dmz or Gateway server and vice versa. To achieve this, you may need to use static host entries on the local computers but it is important that this step is completed before moving onto the next steps. Also make sure the enterprise root CA certificate is installed on the requesting server. 23
Start Internet Explorer, and connect to the Certificate Enrolment URL on the Certificate Authority server, for example, http://<caservername>/certsrv. On the Microsoft Active Directory Certificate Services Welcome page, click Request a certificate. On the Request a Certificate page, click Or, submit an advanced certificate request. On the Advanced Certificate Request page, click Create and submit a request to this CA. 24
Since the Certificate Authority is running on windows 2008 R2, The browser will prompt you to use secured authentication using HTTPS. A simple step by step procedure to enable Secure Sockets Layer (SSL) on IIS7 is available in the following link: /2010/06/23/configuring-secure-sockets-layer-iniis/ Once the SSL configuration completed successfully, you may connect to the Certificate Enrolment URL using https://<caservername>/certsrv. On the Advanced Certificate Request page, click Create and submit a request to this CA. 25
Click on Yes to the Web Access Confirmation to continue. Under the Certificate Template, pull down the list and select Opsmgr Template. Then enter the Fully Qualified Domain Name (FQDN) of the requesting server into the Name field. 26
From the same window, scroll down to the end and ensure that the Mark Keys as exportable option is selected, choose your key size (or leave at the default of 2048) and then again enter the FQDN of your requesting server into the Friendly Name field at the end of the page. 27
Once you have entered all of the information required and are happy to proceed, click the Submit button at the bottom of the page to complete the request. Click on Yes to the Web Access Confirmation to continue. 28
Click on the Install this certificate link to install the certificate onto your requesting server. You will see a window to confirm the new certificate has been successfully installed. Although the above screen states that the new certificate has been installed onto your computer, when you open the local certificate store, you will not find the certificate under Local computer and you might think that the import was not successful. No need to worry, this is because the certificate template creation within Windows Server 2008 R2 doesn t have provision to specify where exactly the certificate will be stored. When you click Install This Certificate, it automatically installs the new certificate into the Current User instead of Local Computer. 29
In this situation, all we need to do is to export this certificate from the Current User store and import it into the Local Computer store to enable SCOM to use it for authentication of the computer. Go to Start and then click Run. In the Run dialog box, type mmc, and then click OK. In the Console1 window, click File, and then click Add/Remove Snap-in. In the Add or Remove Snap-in dialog box, under the available snap-ins, select Certificates, and then click Add. 30
In the Certificates snap-in dialog box, select My user account, and then click Next. Expand Certificates Current Users and then expand Personal and click Certificates. 31
Select the newly created certificate and then Right-click on the certificate and select All Tasks and then the Export. Click through the Certificate Export Wizard to export the certificate. 32
On the Export Private Key page, select Yes, export the private key then click next. 33
Leave the Export file Format to.fpx (default) and then click Next. On the Password page, type a password (you should remember this password for installing this certificate in the future). 34
Specify the name and location of the certificate to export and click Next to continue. Complete the certificate export wizard by clicking Finish. Close the mmc. Now you should be able to see the exported certificate (ScomCertificate.fpx) file on the root of your C:\ drive. 35
Next, we should import this certificate into our Certificates Local Computer store using the Certificates MMC snap-in again. Go to Start and then click Run. In the Run dialog box, type mmc, and then click OK. In the Console1 window, click File, and then click Add/Remove Snap-in. In the Add or Remove Snap-in dialog box, under the available snap-ins, select Certificates, and then click Add. In the Certificates snap-in dialog box, select Computer account, and then click Next. Expand certificates (Local Computer) and then Right Click on Personal, then select All Tasks, and then click on Import. 36
Click through the Certificate Import Wizard to import the certificate. On the File Import page, locate the exported file on the C:\ drive and click Next 37
On the Password page, type the password assigned to the file while exporting. Leave rest of the settings default and click Next. 38
Make sure that under Place all certificates in the following store shows Personal Click Finish to complete the certificate import wizard. 39
All is well the following screen shows the certificate is valid and is in the proper location. This completes the certificate request using the Operations Manager Certificate Template and the certificate export-import into your Windows Server Local Computer Certificates store. 40