sccm wmi queries (wql) for building collections containing only all servers or all workstations

If you want to build a collection in SCCM for “All Servers” or “All Workstations” here are two WMI queries you can use.

All Servers

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SYSTEM on SMS_G_System_SYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_G_System_SYSTEM.SystemRole = “Server”

All Workstations/Desktops

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System inner join SMS_G_System_SYSTEM on SMS_G_System_SYSTEM.ResourceId = SMS_R_System.ResourceId where SMS_G_System_SYSTEM.SystemRole = “Workstation”


scom 2012 do not send closed alert if resolved within sending delay of new alert

Over the last couple weeks I have learned that SCOM 2012 is utterly retarded.  It’s way too noisy and creating overrides or disabling notifications is a confusing experience.  Simple features like scheduling a reoccurring or granular (between such and such hours) maintenance mode and creating a group to exclude another existing group or OU are non-existent.  The layout and UI are just downright un-intuitive and over-complicated for a solution who’s main function is to alert you to a problem and help you fix it quickly.  I really hate this product.  The thing that sent me over the edge this morning was the simple fact that if I create a subscription and have a send delay on the alerts, the New alerts won’t get sent if things work themselves out within the delay but the Closed alerts still get sent and there is no simple way to fix this.  Time to start looking for something else.

filtering out the noise in scom

I’ve decided to tackle SCOM 2012 at my new employer.  It was installed by a previous SysAdmin but basically left out of the box with ALL alerts on EVERYTHING constantly spamming the inboxes of the rest of the team.  I am very sick of these emails.

SCOM is interesting in that by default you really do get alerts for everything.  Even stupid crap you don’t care about like an occasional spike in CPU usage or some service configured with the SYSTEM account or disk latency warnings in the middle of the night during backups.  I have zero experience with SCOM but I can already tell you this is going to be one hell of a love/hate relationship.  I found one article that has already GREATLY helped in reducing the amount of notifications.

SCOM has three severity levels for the alerts included in Management Packs: Information, Warning, and Critical.  It also has three priority levels:  Low, Medium, and High.  Each alert is assigned a priority level and most alerts, unless they are REALLY bad, are assigned medium out of the box in MP’s.  Stuff like a system down though will have be a Critical/High alert by default.  What you can do is create a subscription for only High priority Critical alerts and this will right away reduce the noise from SCOM.  You can then use the SCOM console to see all alerts and tweak individual alerts by adding an override to change the priority to High if it’s something you want to be notified on.  More to come as I play around with SCOM more but make sure you check out the article by Kevin Holman to get started.

quick and easy fim r2 upgrade guide

As I pointed out in my last post, Microsoft has some conflicting documentation on TechNet.  Here is a quick guide that should get you a safe upgrade:

  1. Backup everything.  Databases, configs, and bare metal/complete backup of your servers/VMs just incase.  (Side note: Checkout PHD Virtual for good, cheap VMware backup software).
  2. Make sure you are on build 3606 at the very least on both your FIM Service and Synchronization Server.
  3. One of the TechNet guides recommends setting the Recovery type on both databases to Simple so go ahead and do that if they aren’t already.  You can skip this step if you know what you’re doing and want Full on the FIMService database.
  4. Upgrade your Synchronization Server.
  5. Download SharePoint 2010 Foundation, launch it, install Pre-Req’s, and then install it on your Portal Server.
  6. Run the following query on the FIMService database to enable the SQL Broker which is required for the upgrade.  ”alter database FIMService set enable_broker with rollback immediate;”
  7. Upgrade your Service and Portal Server.

free online training for forefront identity manager 2010

I’m currently working on implementing Microsoft’s identity management solution, Forefront Identity Manager 2010, and came across this TechNet page with a free “course” for FIM 2010.  Upon further inspection (check out the PDF names) it looks to be the exact material for the MS official course 50382A.