Category: System Center Essentials



Security bulletin indicates SP1 is being released to wsus this coming patch Tuesday!!

http://support.microsoft.com/kb/894199


This is going to follow alot of the stuff already described in a previous post I made, I’m just going to update it with some tweaks for the latest version of Adobe Reader.  This assumes you have the Adobe Customization Wizard X installed.  If not, download it.  It’s version specific, so the Customization Wizard 9 will not work with this version.

First download Adobe Reader X from ftp://ftp.adobe.com/pub/adobe/reader/win/10.x/10.0.1/en_US/

Then extract the installation files from the exe.  The path indicates I put the downloaded exe file in c:.   The command is c:\adberdr1001_en_us.exe -nos_o”c:\readerx” -nos_ne  This runs the installer to extract the files but not actually install the program.  The files are now in c:\readerx.  Note: there is a space between .exe and -nos_o, but no space between -nos_o and “c:\readerx”, then another space between “c:\readerx” and -nos_ne.

Now that you have your files, open the msi in the customization wizard and go through the options to customize the installation the way you want.  Don’t panic that it claims the installer will remove old versions of reader and acrobat, it only removes old versions of reader and doesn’t touch acrobat, the way we want it.  Once you have the install the way you want, generate a transform from within the wizard and save it with all your other install files in c:\readerx

Copy this entire folder to a network share and go into SCE and create a new package. You’ll need to specify that you want files and folders, and not just the setup file, so the second option.  Select your readerx folder on the network share, then the acroread.msi file.

When it asks for installation parameters you’ll put in:  TRANSFORMS=”\\server\sharename\<yourmstfilename>.mst”  The installer is inherently silent and you specify this option in the customization wizard.  So /qn is not needed, in fact, it’ll error out if you put this in.  So if you want to try it before you deploy it, I’ll give you my command line so you can see what the whole thing looks like.  c:\windows\system32\msiexec.exe /i \\server\share\acroread.msi TRANSFORMS=”\\server\share\acroread.mst” /qn  – note this is the command line, DONT put this is sce and expect it to run.

There you have it!  The installer will remove old versions of Reader, leave Acrobat alone, install Reader X, and you’ll sleep a little better!  There are more advanced options for configuring update behavior, icon management, and locking down certain security options, but that’s a case-by-case basis and I won’t post that here, it you want to do this, let me know, I’ll help you as best I can.

Tim


I’m going to copy and paste most of this from the SCE Forums on TechNet.   I normally wouldn’t post isolated instances of problems, but when I was helping this other person, I found that his conditions existed in my environment as well, so it could very well be the case for everyone.

Issue #1:

When we discover systems in our domain, clients that are located in our Administrative office (same location as the SCE server) are contacted by SCE and we can see the installed software, number of hard drives, etc.  Systems that are not in our Administrative office (remote sites, same domain) are displayed, but do not have software inventory and lists zero hard drives.

If I log into the remote site systems, configure Windows Update to automatically update the system, and perform “Check for Updates”, within a few minutes SCE will start displaying information about that remote system.  If I don’t go through these steps, SCE will not display the number of hard drives or the installed software, etc.

Questions – Is this an issue with WSUS? Once these clients are talking to SCE, will they truly continue to communicate and receive updates from the SCE server?  Is there something we can do to correct this behavior before we discover any more clients?

Issue #2:

In the Computers workspace, on the All Windows Computers pane, if I double click on a client system (Win 7) I can view the CPU performance, but there are no performance counters available to view under Processor Queue Length or Memory Usage.  On servers, I see performance counters for CPU, Processor Queue Length and Memory Usage.

Questions – Similar to Issue #1, is this a WSUS issue?  Is there something I need to configure to collect or view the Processor Queue Length and Memory Usage data for the client systems, or is this data not available?

Issue #3:

In the Monitoring workspace, if I expand the Microsoft Windows Client tree and look under Performance, Windows Client OS Performance, there are no performance counters that can be selected/viewed under any of the options (Disk Capacity, Disk Performance, Disk Utilization, Memory Utilization (Page File), Memory Utilization (Physical), Network Adapter Utilization or Processor Performance).

Under the Microsoft Windows Server | Performance, there are performance counters for Disk Capacity, Memory Utilization (Page File), Network Adapter Utilization [Bytes Total/Sec] and Processor Performance.  There are NO performance counters for Disk Performance, Disk Utilization, Memory Utilization (Physical) and Network Adapter Utilization [Bytes Received/Sec and Bytes Sent/Sec].

My Reply:

Issue #1 probably isn’t related to an actual WSUS problem, but more of a wsus/client problem where the client more than likely hadn’t received the certificate generated from the installation, which is then relayed via group policy.

Issues# 2+3 – Keep in mind, the problem exists with Windows 7 clients (and presumably Vista as well).  XP Clients work fine

Looking at the performance counters for any random Win7 client, doesn’t display any graph data, but will show the counters for that particular client.  Checking the box next to the counter doesn’t change the display behavior within SCE.  When you right-click the counter and select properties, the target is “Windows XP Operating System”, which obviously doesn’t apply since as I mentioned this is a windows 7 box.  When I look at the same information for a windows xp box, graph data is displayed properly.  So I went into the Authoring pane and scoped my search to “windows xp client operating system” and “windows 7 client operating system”, most of the rules for xp are enabled, but windows 7 rules are disabled.  Find the windows 7 rule “System Processor Queue Length” and  “Memory Available Megabytes”, and do an override to enable them.  SCE will then notify you client of an enabled rule and modify the configuration to start gathering performance data.

Conclusion:

It’s a matter of rules not enabled by default, or inadvertently disabled through another rule.  Fortunately, from what I can tell, the rule names stay the same for the most part, it’s just a matter of scoping you rules to the correct category.  Why Windows 7 rules aren’t enabled by default I can’t really say, but it’s easy enough to enable them now that you know what you’re looking for.


While I’m on the subject of deployment, along with Adobe, I get “How can I deploy Java”?

This one is even easier.

In this example I’ll use Java 6 Update 22.

Download the offline installer.  In this case the filename is jre-6u22-windows-i586-s.exe, and save it to your network share.

Go into SCE and create a new software package, point to the file above that you saved on your network share.  The additional installation parameters are “/s”  no quotes, it’s that easy.  This will install java silently and one less thing you have to worry about.


I get questions about this all the time….”How do I deploy Adobe Reader using SCE2010″?

It’s quite easy actually.

What you’ll need:

An offline version of the installer from Adobe – all versions of installers are here

Adobe Customization Wizard for the version you’re trying to deploy (yes, they ARE different, so get the right one)  The latest customization wizard for Reader X is here.  If you’re deploying Reader 9, get the Customization Wizard for version 9.

You have to transform the MSI with the customization wizard.  This provides for options pertaining to default pdf viewer, silent installs, remove old versions, etc.  Once you get it the way you want, the program creates an MST file.  At the top or the customization wizard you’ll actually see transformed by “nameofyourmstfile”.  Great, save those files to your network share where all your other deployment files are.

Go into system center and create a new package, point to the msi file, usually Acroread.msi by default.  Once you get to the additional installation parameters page you’ll put in  ALLUSERS=True TRANSFORMS=\\server\share\yourmstfile.mst   Remember if your mst path name has spaces in it, you MUST enclose the whole path in quotes or it will stop at the first space you have in the path name.  Deploy to a test group and make changes to the mst file as necessary.


Using System Center Essentials 2010 with SQL 2008R2 databases.

For those of you using SCE2010, you may (or may not) have found that SQL 2008R2 doesn’t play nicely, particularly in the area of drill-trough parameters with software/hardware summary reports.

I’ve created a fix for this and have had other colleagues test this with 100% success.  Keep in mind this is ONLY for SQL 2008R2.
You’ll need to modify the software summary report to do this.

Edit the report in Report Builder 3.0

You need to edit the Textbox properties of textbox8, not the placeholder properties. You can identify the box because it has “[ApplicationName]” written in blue.

So right click on the textbox, go to Text Box Properties.

Select “Action” on the left, you should see “Go to report” and then the report name is your software inventory report.

Under “Use these parameters to run the report” you’ll see Name: ComputerTargetId and the value is an expression.

Click the fx button to open the expression.

Delete =Code.GetObjectList(“” + Code.CurrentObjectList + “”)

and put in =LookupSet(Fields!ApplicationName.Value + “,” + Fields!ApplicationVersion.Value,Fields!ApplicationName.Value + “,” + Fields!ApplicationVersion.Value,Fields!ComputerTargetId.Value, “SUSDB”)

Save the report back to your report server and try running a software summary report, then click on a software title and make sure it takes you to the inventory report.

Please post if this doesn’t make sense or it’s not working or you need help, etc.

Disclaimer: This is MY fix, not an official fix from Microsoft. It’s been tested and confirmed to work in different environments, but I’m not responsible if it doesn’t work in yours or somehow corrupts your install or DB. This fix is also assuming your databases are using the default names created/installed by System Center Essentials 2010.


I cannot claim responsibility for this but I found it to be extremely useful.  Basically a management pack that creates client groups by using the PROCESSOR_ARCHITECTURE key within Windows.  Thanks to Brian at Unidev.  Here’s the original post.

Unfortunately System Center Essentials doesn’t come with computer groups that are based on whether or not Windows is installed as 32-bit or 64-bit.  This would be extremely helpful in pushing software that is targeted for those specific platforms.  Below is the management pack xml I came up with.  You can save this XML as “Platform.Based.Computer.Groups.xml” and import via the console.  It uses the PROCESSOR_ARCHITECTURE registry key to make the determination of a 32-bit vs. 64-bit OS.  This creates 6 groups, 3 sets each split into x86 and x64:  Windows <platform> Computer Group, Windows Client <platform> Computer Group, Windows Server <platform> Computer Group.  To create the management pack by scratch, you can follow this outline:

  1. Create a new attribute for the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE registry key value, targeting Windows Computer, Windows Client, and Windows Server.  Yes this means you create 3 attributes.
  2. Create new groups for each platform.  The rule for the x64 groups is the value of this key must equal “amd64”.  The rule for the x86 groups is this key doesn’t equal “amd64”.  More explanation can be found here (note the management agent/service runs native to the platform).  For the Windows <platform> Group, make sure you use the Windows Computer_Extended class.  For the Windows Client <platform> Computer Group, make sure you use the Windows Client_Extended class.  For the Windows Server <platform> Computer Group, make sure you use the Windows Server_Extended class.
  3. Wait for the agents to set the new attribute.

Here is the Exported Management Pack.  Note this was created using System Center Essentials 2010.  I believe this would work under 2007, but different version numbers would need to be used.

<?xml version=”1.0″ encoding=”utf-8″?><ManagementPack ContentReadable=”true” xmlns:xsd=”http://www.w3.org/2001/XMLSchema” xmlns:xsl=”http://www.w3.org/1999/XSL/Transform”>
<Manifest>
<Identity>
<ID>Platform.Based.Computer.Groups</ID>
<Version>1.0.0.0</Version>
</Identity>
<Name>Platform Based Computer Groups</Name>
<References>
<Reference Alias=”MicrosoftWindowsLibrary6172210″>
<ID>Microsoft.Windows.Library</ID>
<Version>6.1.7221.0</Version>
<PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
</Reference>
<Reference Alias=”MicrosoftSystemCenterInstanceGroupLibrary6172210″>
<ID>Microsoft.SystemCenter.InstanceGroup.Library</ID>
<Version>6.1.7221.0</Version>
<PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
</Reference>
<Reference Alias=”SystemCenter”>
<ID>Microsoft.SystemCenter.Library</ID>
<Version>6.1.7221.0</Version>
<PublicKeyToken>31bf3856ad364e35</PublicKeyToken>
</Reference>
</References>
</Manifest>
<TypeDefinitions>
<EntityTypes>
<ClassTypes>
<ClassType ID=”Type79bcd4b047114bf38057cccfefc23b3f” Accessibility=”Public” Abstract=”false” Base=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Client.Computer” Hosted=”false” Singleton=”false”>
<Property ID=”AttributeDiscoveryGeneratedByUI8a18081aa8fd43f5b3b793fe2fd7d6db” Type=”string” Key=”false” CaseSensitive=”false” Length=”256″ MinLength=”0″ />
</ClassType>
<ClassType ID=”UINameSpacecb1cfa7fb7b44d699bba170cc1d1e5a8.Group” Accessibility=”Public” Abstract=”false” Base=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroup” Hosted=”false” Singleton=”true” />
<ClassType ID=”UINameSpace9c461cdabc464754901456d880b76d42.Group” Accessibility=”Public” Abstract=”false” Base=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroup” Hosted=”false” Singleton=”true” />
<ClassType ID=”Typec1ddf4898a8c45759b68eb55084f063d” Accessibility=”Public” Abstract=”false” Base=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Server.Computer” Hosted=”false” Singleton=”false”>
<Property ID=”AttributeDiscoveryGeneratedByUI770ab3335bf348469cad1fc8ffa25ba4″ Type=”string” Key=”false” CaseSensitive=”false” Length=”256″ MinLength=”0″ />
</ClassType>
<ClassType ID=”Type2259d37e77334b7394a4bdb268a58764″ Accessibility=”Public” Abstract=”false” Base=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer” Hosted=”false” Singleton=”false”>
<Property ID=”AttributeDiscoveryGeneratedByUI55895447f20b4390bc2657c1f92bd2b5″ Type=”string” Key=”false” CaseSensitive=”false” Length=”256″ MinLength=”0″ />
</ClassType>
<ClassType ID=”UINameSpaced65a8b5eba8a497a817d94b078aa4764.Group” Accessibility=”Public” Abstract=”false” Base=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroup” Hosted=”false” Singleton=”true” />
<ClassType ID=”UINameSpacece010ba3a104449096bd2cbbd8257088.Group” Accessibility=”Public” Abstract=”false” Base=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroup” Hosted=”false” Singleton=”true” />
<ClassType ID=”UINameSpacef41b5a7897114ccbac3203997fd5f064.Group” Accessibility=”Public” Abstract=”false” Base=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroup” Hosted=”false” Singleton=”true” />
<ClassType ID=”UINameSpaceb86ace359759416ca46f5aaa1ba33949.Group” Accessibility=”Public” Abstract=”false” Base=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroup” Hosted=”false” Singleton=”true” />
</ClassTypes>
</EntityTypes>
</TypeDefinitions>
<Monitoring>
<Discoveries>
<Discovery ID=”AttributeDiscoveryGeneratedByUIcf48023b73e54e8dae3405dd1ff63ae4″ Enabled=”true” Target=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Client.Computer” ConfirmDelivery=”false” Remotable=”true” Priority=”Normal”>
<Category>PerformanceCollection</Category>
<DiscoveryTypes>
<DiscoveryClass TypeID=”Type79bcd4b047114bf38057cccfefc23b3f”>
<Property TypeID=”Type79bcd4b047114bf38057cccfefc23b3f” PropertyID=”AttributeDiscoveryGeneratedByUI8a18081aa8fd43f5b3b793fe2fd7d6db” />
</DiscoveryClass>
</DiscoveryTypes>
<DataSource ID=”AttributeDiscoveryGeneratedByUI538c41746aa249058ff191fc55335053″ TypeID=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.RegistryDiscoverySingleProvider”>
<ComputerName>$Target/Property[Type=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer”]/NetworkName$</ComputerName>
<AttributeName>AttributeDiscoveryRule7a8459cae84842f082b2f7da5b2fa27a</AttributeName>
<Path>SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE</Path>
<PathType>1</PathType>
<AttributeType>1</AttributeType>
<Frequency>3600</Frequency>
<ClassId>$MPElement[Name=”Type79bcd4b047114bf38057cccfefc23b3f”]$</ClassId>
<InstanceSettings>
<Settings>
<Setting>
<Name>$MPElement[Name=”Type79bcd4b047114bf38057cccfefc23b3f”]/AttributeDiscoveryGeneratedByUI8a18081aa8fd43f5b3b793fe2fd7d6db$</Name>
<Value>$Data/Values/AttributeDiscoveryRule7a8459cae84842f082b2f7da5b2fa27a$</Value>
</Setting>
<Setting>
<Name>$MPElement[Name=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer”]/PrincipalName$</Name>
<Value>$Target/Property[Type=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer”]/PrincipalName$</Value>
</Setting>
</Settings>
</InstanceSettings>
</DataSource>
</Discovery>
<Discovery ID=”UINameSpacecb1cfa7fb7b44d699bba170cc1d1e5a8.Group.DiscoveryRule” Enabled=”true” Target=”UINameSpacecb1cfa7fb7b44d699bba170cc1d1e5a8.Group” ConfirmDelivery=”false” Remotable=”true” Priority=”Normal”>
<Category>Discovery</Category>
<DiscoveryTypes>
<DiscoveryRelationship TypeID=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities” />
</DiscoveryTypes>
<DataSource ID=”GroupPopulationDataSource” TypeID=”SystemCenter!Microsoft.SystemCenter.GroupPopulator”>
<RuleId>$MPElement$</RuleId>
<GroupInstanceId>$MPElement[Name=”UINameSpacecb1cfa7fb7b44d699bba170cc1d1e5a8.Group”]$</GroupInstanceId>
<MembershipRules>
<MembershipRule>
<MonitoringClass>$MPElement[Name=”Type79bcd4b047114bf38057cccfefc23b3f”]$</MonitoringClass>
<RelationshipClass>$MPElement[Name=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities”]$</RelationshipClass>
<Expression>
<SimpleExpression>
<ValueExpression>
<Property>$MPElement[Name=”Type79bcd4b047114bf38057cccfefc23b3f”]/AttributeDiscoveryGeneratedByUI8a18081aa8fd43f5b3b793fe2fd7d6db$</Property>
</ValueExpression>
<Operator>NotEqual</Operator>
<ValueExpression>
<Value>amd64</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</MembershipRule>
</MembershipRules>
</DataSource>
</Discovery>
<Discovery ID=”UINameSpace9c461cdabc464754901456d880b76d42.Group.DiscoveryRule” Enabled=”true” Target=”UINameSpace9c461cdabc464754901456d880b76d42.Group” ConfirmDelivery=”false” Remotable=”true” Priority=”Normal”>
<Category>Discovery</Category>
<DiscoveryTypes>
<DiscoveryRelationship TypeID=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities” />
</DiscoveryTypes>
<DataSource ID=”GroupPopulationDataSource” TypeID=”SystemCenter!Microsoft.SystemCenter.GroupPopulator”>
<RuleId>$MPElement$</RuleId>
<GroupInstanceId>$MPElement[Name=”UINameSpace9c461cdabc464754901456d880b76d42.Group”]$</GroupInstanceId>
<MembershipRules>
<MembershipRule>
<MonitoringClass>$MPElement[Name=”Type79bcd4b047114bf38057cccfefc23b3f”]$</MonitoringClass>
<RelationshipClass>$MPElement[Name=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities”]$</RelationshipClass>
<Expression>
<SimpleExpression>
<ValueExpression>
<Property>$MPElement[Name=”Type79bcd4b047114bf38057cccfefc23b3f”]/AttributeDiscoveryGeneratedByUI8a18081aa8fd43f5b3b793fe2fd7d6db$</Property>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>amd64</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</MembershipRule>
</MembershipRules>
</DataSource>
</Discovery>
<Discovery ID=”AttributeDiscoveryGeneratedByUIc35946fd1e9246bb91ff701b971134c9″ Enabled=”true” Target=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Server.Computer” ConfirmDelivery=”false” Remotable=”true” Priority=”Normal”>
<Category>PerformanceCollection</Category>
<DiscoveryTypes>
<DiscoveryClass TypeID=”Typec1ddf4898a8c45759b68eb55084f063d”>
<Property TypeID=”Typec1ddf4898a8c45759b68eb55084f063d” PropertyID=”AttributeDiscoveryGeneratedByUI770ab3335bf348469cad1fc8ffa25ba4″ />
</DiscoveryClass>
</DiscoveryTypes>
<DataSource ID=”AttributeDiscoveryGeneratedByUI553f00ed2fbd4b4d8bf516bad763fa75″ TypeID=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.RegistryDiscoverySingleProvider”>
<ComputerName>$Target/Property[Type=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer”]/NetworkName$</ComputerName>
<AttributeName>AttributeDiscoveryRulec017456d384b4bb9860dac5b91dcf8c2</AttributeName>
<Path>SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE</Path>
<PathType>1</PathType>
<AttributeType>1</AttributeType>
<Frequency>3600</Frequency>
<ClassId>$MPElement[Name=”Typec1ddf4898a8c45759b68eb55084f063d”]$</ClassId>
<InstanceSettings>
<Settings>
<Setting>
<Name>$MPElement[Name=”Typec1ddf4898a8c45759b68eb55084f063d”]/AttributeDiscoveryGeneratedByUI770ab3335bf348469cad1fc8ffa25ba4$</Name>
<Value>$Data/Values/AttributeDiscoveryRulec017456d384b4bb9860dac5b91dcf8c2$</Value>
</Setting>
<Setting>
<Name>$MPElement[Name=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer”]/PrincipalName$</Name>
<Value>$Target/Property[Type=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer”]/PrincipalName$</Value>
</Setting>
</Settings>
</InstanceSettings>
</DataSource>
</Discovery>
<Discovery ID=”AttributeDiscoveryGeneratedByUI4fcdb3368e174252a02253a63dc5373b” Enabled=”true” Target=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer” ConfirmDelivery=”false” Remotable=”true” Priority=”Normal”>
<Category>PerformanceCollection</Category>
<DiscoveryTypes>
<DiscoveryClass TypeID=”Type2259d37e77334b7394a4bdb268a58764″>
<Property TypeID=”Type2259d37e77334b7394a4bdb268a58764″ PropertyID=”AttributeDiscoveryGeneratedByUI55895447f20b4390bc2657c1f92bd2b5″ />
</DiscoveryClass>
</DiscoveryTypes>
<DataSource ID=”AttributeDiscoveryGeneratedByUI2cc5aaef5b8c4e849fe5af1833a0115f” TypeID=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.RegistryDiscoverySingleProvider”>
<ComputerName>$Target/Property[Type=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer”]/NetworkName$</ComputerName>
<AttributeName>AttributeDiscoveryRule95424e49ca10467eb12d4611633759c5</AttributeName>
<Path>SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE</Path>
<PathType>1</PathType>
<AttributeType>1</AttributeType>
<Frequency>3600</Frequency>
<ClassId>$MPElement[Name=”Type2259d37e77334b7394a4bdb268a58764″]$</ClassId>
<InstanceSettings>
<Settings>
<Setting>
<Name>$MPElement[Name=”Type2259d37e77334b7394a4bdb268a58764″]/AttributeDiscoveryGeneratedByUI55895447f20b4390bc2657c1f92bd2b5$</Name>
<Value>$Data/Values/AttributeDiscoveryRule95424e49ca10467eb12d4611633759c5$</Value>
</Setting>
<Setting>
<Name>$MPElement[Name=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer”]/PrincipalName$</Name>
<Value>$Target/Property[Type=”MicrosoftWindowsLibrary6172210!Microsoft.Windows.Computer”]/PrincipalName$</Value>
</Setting>
</Settings>
</InstanceSettings>
</DataSource>
</Discovery>
<Discovery ID=”UINameSpaced65a8b5eba8a497a817d94b078aa4764.Group.DiscoveryRule” Enabled=”true” Target=”UINameSpaced65a8b5eba8a497a817d94b078aa4764.Group” ConfirmDelivery=”false” Remotable=”true” Priority=”Normal”>
<Category>Discovery</Category>
<DiscoveryTypes>
<DiscoveryRelationship TypeID=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities” />
</DiscoveryTypes>
<DataSource ID=”GroupPopulationDataSource” TypeID=”SystemCenter!Microsoft.SystemCenter.GroupPopulator”>
<RuleId>$MPElement$</RuleId>
<GroupInstanceId>$MPElement[Name=”UINameSpaced65a8b5eba8a497a817d94b078aa4764.Group”]$</GroupInstanceId>
<MembershipRules>
<MembershipRule>
<MonitoringClass>$MPElement[Name=”Typec1ddf4898a8c45759b68eb55084f063d”]$</MonitoringClass>
<RelationshipClass>$MPElement[Name=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities”]$</RelationshipClass>
<Expression>
<SimpleExpression>
<ValueExpression>
<Property>$MPElement[Name=”Typec1ddf4898a8c45759b68eb55084f063d”]/AttributeDiscoveryGeneratedByUI770ab3335bf348469cad1fc8ffa25ba4$</Property>
</ValueExpression>
<Operator>NotEqual</Operator>
<ValueExpression>
<Value>amd64</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</MembershipRule>
</MembershipRules>
</DataSource>
</Discovery>
<Discovery ID=”UINameSpacece010ba3a104449096bd2cbbd8257088.Group.DiscoveryRule” Enabled=”true” Target=”UINameSpacece010ba3a104449096bd2cbbd8257088.Group” ConfirmDelivery=”false” Remotable=”true” Priority=”Normal”>
<Category>Discovery</Category>
<DiscoveryTypes>
<DiscoveryRelationship TypeID=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities” />
</DiscoveryTypes>
<DataSource ID=”GroupPopulationDataSource” TypeID=”SystemCenter!Microsoft.SystemCenter.GroupPopulator”>
<RuleId>$MPElement$</RuleId>
<GroupInstanceId>$MPElement[Name=”UINameSpacece010ba3a104449096bd2cbbd8257088.Group”]$</GroupInstanceId>
<MembershipRules>
<MembershipRule>
<MonitoringClass>$MPElement[Name=”Typec1ddf4898a8c45759b68eb55084f063d”]$</MonitoringClass>
<RelationshipClass>$MPElement[Name=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities”]$</RelationshipClass>
<Expression>
<SimpleExpression>
<ValueExpression>
<Property>$MPElement[Name=”Typec1ddf4898a8c45759b68eb55084f063d”]/AttributeDiscoveryGeneratedByUI770ab3335bf348469cad1fc8ffa25ba4$</Property>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>amd64</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</MembershipRule>
</MembershipRules>
</DataSource>
</Discovery>
<Discovery ID=”UINameSpacef41b5a7897114ccbac3203997fd5f064.Group.DiscoveryRule” Enabled=”true” Target=”UINameSpacef41b5a7897114ccbac3203997fd5f064.Group” ConfirmDelivery=”false” Remotable=”true” Priority=”Normal”>
<Category>Discovery</Category>
<DiscoveryTypes>
<DiscoveryRelationship TypeID=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities” />
</DiscoveryTypes>
<DataSource ID=”GroupPopulationDataSource” TypeID=”SystemCenter!Microsoft.SystemCenter.GroupPopulator”>
<RuleId>$MPElement$</RuleId>
<GroupInstanceId>$MPElement[Name=”UINameSpacef41b5a7897114ccbac3203997fd5f064.Group”]$</GroupInstanceId>
<MembershipRules>
<MembershipRule>
<MonitoringClass>$MPElement[Name=”Type2259d37e77334b7394a4bdb268a58764″]$</MonitoringClass>
<RelationshipClass>$MPElement[Name=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities”]$</RelationshipClass>
<Expression>
<SimpleExpression>
<ValueExpression>
<Property>$MPElement[Name=”Type2259d37e77334b7394a4bdb268a58764″]/AttributeDiscoveryGeneratedByUI55895447f20b4390bc2657c1f92bd2b5$</Property>
</ValueExpression>
<Operator>NotEqual</Operator>
<ValueExpression>
<Value>amd64</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</MembershipRule>
</MembershipRules>
</DataSource>
</Discovery>
<Discovery ID=”UINameSpaceb86ace359759416ca46f5aaa1ba33949.Group.DiscoveryRule” Enabled=”true” Target=”UINameSpaceb86ace359759416ca46f5aaa1ba33949.Group” ConfirmDelivery=”false” Remotable=”true” Priority=”Normal”>
<Category>Discovery</Category>
<DiscoveryTypes>
<DiscoveryRelationship TypeID=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities” />
</DiscoveryTypes>
<DataSource ID=”GroupPopulationDataSource” TypeID=”SystemCenter!Microsoft.SystemCenter.GroupPopulator”>
<RuleId>$MPElement$</RuleId>
<GroupInstanceId>$MPElement[Name=”UINameSpaceb86ace359759416ca46f5aaa1ba33949.Group”]$</GroupInstanceId>
<MembershipRules>
<MembershipRule>
<MonitoringClass>$MPElement[Name=”Type2259d37e77334b7394a4bdb268a58764″]$</MonitoringClass>
<RelationshipClass>$MPElement[Name=”MicrosoftSystemCenterInstanceGroupLibrary6172210!Microsoft.SystemCenter.InstanceGroupContainsEntities”]$</RelationshipClass>
<Expression>
<SimpleExpression>
<ValueExpression>
<Property>$MPElement[Name=”Type2259d37e77334b7394a4bdb268a58764″]/AttributeDiscoveryGeneratedByUI55895447f20b4390bc2657c1f92bd2b5$</Property>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>amd64</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</MembershipRule>
</MembershipRules>
</DataSource>
</Discovery>
</Discoveries>
</Monitoring>
<Presentation>
<Folders>
<Folder ID=”Folder_3a3150e06af04efc93e10ce2cbdb67a5″ Accessibility=”Public” ParentFolder=”SystemCenter!Microsoft.SystemCenter.Monitoring.ViewFolder.Root” />
</Folders>
</Presentation>
<LanguagePacks>
<LanguagePack ID=”ENU” IsDefault=”false”>
<DisplayStrings>
<DisplayString ElementID=”Platform.Based.Computer.Groups”>
<Name>Platform Based Computer Groups</Name>
</DisplayString>
<DisplayString ElementID=”Folder_3a3150e06af04efc93e10ce2cbdb67a5″>
<Name>Platform Based Computer Groups</Name>
</DisplayString>
<DisplayString ElementID=”AttributeDiscoveryGeneratedByUIcf48023b73e54e8dae3405dd1ff63ae4″>
<Name>Process ArchitectureDiscovery</Name>
</DisplayString>
<DisplayString ElementID=”Type79bcd4b047114bf38057cccfefc23b3f”>
<Name>Windows Client_Extended</Name>
</DisplayString>
<DisplayString ElementID=”Type79bcd4b047114bf38057cccfefc23b3f” SubElementID=”AttributeDiscoveryGeneratedByUI8a18081aa8fd43f5b3b793fe2fd7d6db”>
<Name>Process Architecture</Name>
<Description>Determines 32-bit or 64-bit version of windows based on the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE</Description>
</DisplayString>
<DisplayString ElementID=”UINameSpacecb1cfa7fb7b44d699bba170cc1d1e5a8.Group”>
<Name>Windows Client x86 Computer Group</Name>
</DisplayString>
<DisplayString ElementID=”UINameSpacecb1cfa7fb7b44d699bba170cc1d1e5a8.Group.DiscoveryRule”>
<Name>Populate Windows Client x86 Computer Group</Name>
<Description>This discovery rule populates the group ‘Windows Client x86 Computer Group’</Description>
</DisplayString>
<DisplayString ElementID=”UINameSpace9c461cdabc464754901456d880b76d42.Group”>
<Name>Windows Client x64 Computer Group</Name>
</DisplayString>
<DisplayString ElementID=”UINameSpace9c461cdabc464754901456d880b76d42.Group.DiscoveryRule”>
<Name>Populate Windows Client x64 Computer Group</Name>
<Description>This discovery rule populates the group ‘Windows Client x64 Computer Group’</Description>
</DisplayString>
<DisplayString ElementID=”AttributeDiscoveryGeneratedByUIc35946fd1e9246bb91ff701b971134c9″>
<Name>Process ArchitectureDiscovery</Name>
</DisplayString>
<DisplayString ElementID=”Typec1ddf4898a8c45759b68eb55084f063d”>
<Name>Windows Server_Extended</Name>
</DisplayString>
<DisplayString ElementID=”Typec1ddf4898a8c45759b68eb55084f063d” SubElementID=”AttributeDiscoveryGeneratedByUI770ab3335bf348469cad1fc8ffa25ba4″>
<Name>Process Architecture</Name>
<Description>Determines 32-bit or 64-bit version of windows based on the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE</Description>
</DisplayString>
<DisplayString ElementID=”AttributeDiscoveryGeneratedByUI4fcdb3368e174252a02253a63dc5373b”>
<Name>Process ArchitectureDiscovery</Name>
</DisplayString>
<DisplayString ElementID=”Type2259d37e77334b7394a4bdb268a58764″>
<Name>Windows Computer_Extended</Name>
</DisplayString>
<DisplayString ElementID=”Type2259d37e77334b7394a4bdb268a58764″ SubElementID=”AttributeDiscoveryGeneratedByUI55895447f20b4390bc2657c1f92bd2b5″>
<Name>Process Architecture</Name>
<Description>Determines 32-bit or 64-bit version of windows based on the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE</Description>
</DisplayString>
<DisplayString ElementID=”UINameSpaced65a8b5eba8a497a817d94b078aa4764.Group”>
<Name>Windows Server x86 Computer Group</Name>
<Description />
</DisplayString>
<DisplayString ElementID=”UINameSpaced65a8b5eba8a497a817d94b078aa4764.Group.DiscoveryRule”>
<Name>Populate Windows Server x86 Computer Group</Name>
<Description>This discovery rule populates the group ‘Windows Server x86 Computer Group’</Description>
</DisplayString>
<DisplayString ElementID=”UINameSpacece010ba3a104449096bd2cbbd8257088.Group”>
<Name>Windows Server x64 Computer Group</Name>
</DisplayString>
<DisplayString ElementID=”UINameSpacece010ba3a104449096bd2cbbd8257088.Group.DiscoveryRule”>
<Name>Populate Windows Server x64 Computer Group</Name>
<Description>This discovery rule populates the group ‘Windows Server x64 Computer Group’</Description>
</DisplayString>
<DisplayString ElementID=”UINameSpacef41b5a7897114ccbac3203997fd5f064.Group”>
<Name>Windows x86 Computer Group</Name>
</DisplayString>
<DisplayString ElementID=”UINameSpacef41b5a7897114ccbac3203997fd5f064.Group.DiscoveryRule”>
<Name>Populate Windows x86 Computer Group</Name>
<Description>This discovery rule populates the group ‘Windows x86 Computer Group’</Description>
</DisplayString>
<DisplayString ElementID=”UINameSpaceb86ace359759416ca46f5aaa1ba33949.Group”>
<Name>Windows x64 Computer Group</Name>
</DisplayString>
<DisplayString ElementID=”UINameSpaceb86ace359759416ca46f5aaa1ba33949.Group.DiscoveryRule”>
<Name>Populate Windows x64 Computer Group</Name>
<Description>This discovery rule populates the group ‘Windows x64 Computer Group’</Description>
</DisplayString>
</DisplayStrings>
</LanguagePack>
</LanguagePacks>
</ManagementPack>


Go into authoring and go to monitors.  Scope the list to Windows Servers ( the more I think about it, I may revise this to apply only to dc’s since they’re the ones that notate a computer account creation).

Create a new Unit Monitor the monitor type will be Windows Events->Simple Event Detection-> Timer Reset.  I chose this because I want it to log an alert but not remain in a warning state ( i hate yellow and red marks all over my gui =) )

Leave the management pack at default.

Name the monitor whatever you like, give it a description if you want and the parent monitor I set to Security.  – seems appropriate

Log name is Security

Event ID equals 645 and Event Source equals Security.

Leave the timer default at 15 seconds, again all we want to do is generate an alert, not annoy us to death.

Monitor conditions shouldn’t need to change, it’ll warn when the event is raised and go back to healthy after the timer expires.

The alert settings, you want to check the box to generate an alert, when it’s in a health state, and uncheck automatically resolve the alert, (otherwise it auto-resolves and unless you catch it in the 15 seconds, you won’t know what happened).

Name the alert, priority, severity and description however you want.  you’re done with creating the monitor.

The only thing you have left to do is look at the properties of the monitor, and add a recovery task (the auto-discovery) and you’re done.  You can get some ideas about how the discovery script works by going to Authoring->Tasks and search for discovery  you may have to rescope your search to include Root Management Server, then you’ll see Essential Computer Discovery task and can view the properties to see how it works.


Scenario: you have pc’s reporting in, and when you look at a hardware inventory, your Intel Core 2 Duo pc’s are showing up as PIII Xeon’s (sounds weird but it does happen).

Solution: Contrary to popular belief, this is NOT a SCE problem, but a problem that has been recognized and addressed by Microsoft. The WMI call does exactly what it should however, the processor is incorrectly identified. The hotfix is here. Keep in mind, this is a request-only hotfix, and only effects XP and Server 2003 machines.


Old news, but for the folks who don’t know about it, here it is.