SCOM Agent install fails – Returncode 1603

My entire OpsMgr environment runs SCOM 2012 R2 UR1.
Occationally I come across Windows Servers that dont have any Agents installed – or so it seems.

A couple of days ago, this happened. I came across three servers without an agent, and started the Discorvery wizard.
All servers was discovered successfully, and I stared to push agents to them.
After a minute, they all failed, and the AgentInstall.log file on the Management Server returned with this funny little fucker.

————

MSI (s) (94:44) [11:41:02:856]: Product: Microsoft Monitoring Agent — Installation operation failed.

MSI (s) (94:44) [11:41:02:856]: Windows Installer installed the product. Product Name: Microsoft Monitoring Agent. Product Version: 7.1.10184.0. Product Language: 0. Manufacturer: Microsoft Corporation. Installation success or error status: 1603.

MSI (s) (94:44) [11:41:02:872]: Deferring clean up of packages/files, if any exist
MSI (s) (94:44) [11:41:02:872]: MainEngineThread is returning 1603
MSI (s) (94:64) [11:41:02:872]: No System Restore sequence number for this installation.
=== Logging stopped: 9/19/2014 11:41:02 ===
MSI (s) (94:64) [11:41:02:872]: User policy value ‘DisableRollback’ is 0
MSI (s) (94:64) [11:41:02:872]: Machine policy value ‘DisableRollback’ is 0
MSI (s) (94:64) [11:41:02:872]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (94:64) [11:41:02:872]: Note: 1: 1402 2: HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerRollbackScripts 3: 2
MSI (s) (94:64) [11:41:02:872]: Note: 1: 1402 2: HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerRollbackScripts 3: 2
MSI (s) (94:64) [11:41:02:872]: Note: 1: 1402 2: HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerInProgress 3: 2
MSI (s) (94:64) [11:41:02:872]: Note: 1: 1402 2: HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionInstallerInProgress 3: 2
MSI (s) (94:64) [11:41:02:872]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (s) (94:64) [11:41:02:872]: Restoring environment variables
MSI (s) (94:64) [11:41:02:872]: Destroying RemoteAPI object.
MSI (s) (94:2C) [11:41:02:872]: Custom Action Manager thread ending.
MSI (c) (4C:68) [11:41:02:872]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied. Counter after decrement: -1
MSI (c) (4C:68) [11:41:02:872]: MainEngineThread is returning 1603
=== Verbose logging stopped: 9/19/2014 11:41:02 ===

————

Turns out there was an old SCOM 2007 agent installed on all of them.
Apparently, while upgrading our environment from 2007 R5 til 2012 SP1, we missed these servers.
As the SCOM DB server and management group was created from scratch, we did not receive any events on servers trying to connect to the management group with an old OpsMgr Agent.

After manually uninstalling the 2007 agents, the 2012 agents was pushed successfully from the SCOM console.

Lesson learned.

– F

Output displayname and IP address for SCOMagents

Got bored – wrote this little thing to output FQDN and IPaddress for all Windows and UnixLinux agents in my lab environment.

Could be useful for some people maybe.
 

ipmo operationsmanager
$nixservers = get-scomclass -name "Microsoft.Unix.Computer" | Get-SCOMMonitoringObject
$winservers = Get-SCOMClass -name "Microsoft.Windows.Computer" | Get-SCOMMonitoringObject

   
    Write-host "-----------------------------------------------------------------"
    write-host "-------------------- Unix Computers and IPs ---------------------"
    Write-host "-----------------------------------------------------------------"
foreach ($nix in $nixservers) 

    {
        write-host ([System.Net.Dns]::GetHostAddresses($nix) | foreach {echo $nix - $_.IpAddressToString})
    }


    Write-host "-----------------------------------------------------------------"
    write-host "------------------- Windooze Computers and IPs ------------------"
    Write-host "-----------------------------------------------------------------"
foreach ($win in $winservers) 

    {
        write-host ([System.Net.Dns]::GetHostAddresses($win) | foreach {echo $win - $_.IpAddressToString})
    }

 
Thank god it’s Friday…

-F

Monitor Active/Passive Clustered Services… in SCOM?

I was playing around in Powershell the other day, and made this little thingy to help me monitor clustered Windows Services in an Active/Passive Windows Cluster solution.
The script checks if specific Windows Services are running or not, and determines which node is active in the cluster by using the get-wmiobject cmdlet.

There are many different uses for this, and can easily be modified to for example create events on the server you’re executing the script from.

This is also a really easy way to monitor Clustered Active/Passive services in Operations Manager, which is a REAL pain to do without making some overly complicated Service Monitors.
Why complicated you ask? Clusterservers do not have SCOM Agents installed,only the logical clusternode has agents. Read more about this here.
Alternatively you can do it like the pros do, and add intelligence to the monitors, described here.

Wow that was some sidetrack – enough fufflin’ around! Let’s look at this awesome script!

# Monitor Clustered Windows Services v 1.0
# www.fuffle.net

clear-host
$getcluster = Get-WmiObject win32_computersystem -computername {"ENTER LOGICAL CLUSTERNAME HERE"} | select-object name
$activenode = $getcluster.name
$cluservice = 'BTSSvc$SingleReceiveHost','BTSSvc$SingleReceiveHost32','BTSSvc$SingleSendHost','BTSSvc$SingleSendHost32','BTSSvc$SingleWcfSqlHost','w3svc','Btsaalsvc','ENTSSO','RuleEngineUpdateService'

# Alternativly you can list all servicenames in a file - uncomment line 10 and comment line 7
#$cluservice = get-content "C:tempservicelist.txt"

foreach ($node in $activenode)

{
$service = get-service -computername $activenode $cluservice | Select-Object Status,Name,displayname

# Check all services for state, then write out result
foreach ($s in $service)
    {
    # If services are in a "running" state
    if($service.status -eq "running")
    {write-host "The service" $s.displayname "is running on active clusternode" $getcluster.name"- All is well."}
        # If services are in a "stopped" state
        elseif($service.status -eq "stopped")
        {write-host "The service" $s.displayname "has stopped on active clusternode" $getcluster.name"- Some poo has hit the fan."}
            # If services are in a different state than "Running" or "Stopped"
            else
            {write-host "The service" $s.displayname "is returning with status" $service.status "- Investigate this on " $getcluster.name}
        } 
    } 

Feel free to contact me if you have any questions or remarks about the script. I am a Powershell newbie, and I have no doubt that there is some better way to do this sort of thing.

– F

Awesome SCOM 2012 tools!

Here’s a link to some awesome SCOM tools that we use often for our SCOM 2012 environment.
Thanks to Daniele for these new versions (SCOM 2012 compatible).

MPViewer 2.3 (View sealed and unsealed Management Packs, also has a very useful export-as-unsealed function).
Proxy Settings 1.2 (Select groups or multiple agents and enabledisable Proxysettings)
OverrideExplorer 3.6 (Understand witch overrides exist in a Management Group, provided with Type Based and Computer Based views)
OverrideCreator 1.5 (Multi-select a number of RulesDiscoveriesMonitors and disableenable overrides for these)

Link below:
http://blogs.msdn.com/b/dmuscett/archive/2012/02/19/boris-s-tools-updated.aspx

SCOM: Alert Task – Copy alert to clipboard

In our daily line of work, we sometimes need to show server admins and system managers alerts related to their infrastructure. Have you ever tried to copy/paste the Alert Details for an alert? It looks like crap, and contains alot of information the server admins and system managers couldn’t care less about.

To make this a little easier, we created an Alert Task which copies relevant information in the Alert Details to clipboard, namely Timeraised, PrincipalName, Name and Description.

1. Go to Authoring > Tasks.
2. Click «Create a New Task» in the  Tasks pane to the right.
3.  Choose «Alert Command Line» under the Console Tasks folder.
4. Select a management pack to use, or create a new one.
5. Select a Task name, and type in some description if necessary.

6. Type in the application location and parameters exactly as shown below. (The additional settings is not that important).
pic1

Application:
C:WindowsSystem32WindowsPowerShellv1.0powershell.exe

Parameters:
import-module operationsmanager;Get-scomalert -id $ID$ | fl Timeraised,PrincipalName,Name,Description | clip

7. Click Create, and you are done. Now you will find the Alert Task in the Task pane to the right in the Active Alerts view under Monitoring in the Operations Manager Console.

Sidenote: If you want to create a .txt file with the alert, just replace the pipe and clip (| clip) with >> C:tempalert.txt like so:

import-module operationsmanager;Get-scomalert -id $ID$ | fl Timeraised,PrincipalName,Name,Description >> C:tempalert.txt

-F