PKI: Private Key Export failed during CA migration

I am currently lead a project for PKI migration from 2003 Servers to 2012 R2.

ISSUE: During migration one of CAs I observed an error when I tried to restore a Private Key saved on an old CA to the new CA.

 

The error said: Import private key: Active directory certificate services setup failed with the following error: Cannot find object or property. 0x80092004 (-2146885628 crypt_e_not_found)

RESOLUTION: I checked the machine local storage and found the old CA certificate there (without Private Key). The certificate was installed by GPO.  I deleted the certificate and retry Private Key import from CA installation wizard (where it failed). This time the cert was imported successfully.

Advertisements

SCCM 2012R2: Manage CentOS 7.0 Clients

 

My ITforum has a nice step-by-step: http://myitforum.com/myitforumwp/2014/10/16/step-by-step-instructions-on-how-to-install-a-system-center-2012-configuration-manager-client-on-a-centos-7-server/?utm_medium=twitter&utm_source=twitterfeed

SCCM: Updates published via SCUP fail with Error = 0x800b0109

System Center Update Publisher (SCUP) is a nice mechanism to deploy third-party updates via SCCM. SCUP implementation is well documented for example here by Kent Agerlund.

One of the requirements is allowing Update Client to install updates signed by “Trusted Publisher” in our case – SCUP.

Without that third-party update deployment will fail on “Preparing for installation step” and you can see above-mentioned error in “details” section of error in GUI and in WUAHandler.log

 

For Domain-joined machines it is pretty easy and can be done via GPO as described by Microsoft: here

but you cannot do that for workgroup/DMZ machines.

One of workarounds is creating a package with registry modifier and deploy it

or, you can use Compliance Settings introduced in SCCM 2012 (improved Desired Configuration Management from SCCM 2007) to let SCCM remediate the setting if machine is not compliant.

for that, first create the registry setting we plan to monitor on SCCM server (if it is not present)

a next, create a new Configuration item under Compliance Settings node:

leave default for Supported Platforms and create a setting to monitor (use Browse to navigate to the registry setting we created earlier)

Under Compliance Rule tab add an additional rule and allow remediation for it

You should have two in result:

finish new CI wizard, create a new Baseline and add the CI to it (alternatively you can add the new CI to one of your existing CIs)

Finish New Baseline wizard and deploy the Baseline to a collection (I use All Desktop and Server Clients)

Members of the collection should receive the new Baseline on next Machine Policy refresh

Test: on one of the Clients set registry setting to 0

Now, go to SCCM Client on that machine and re-evaluate the baseline

Client should find the non-compliancy and remediate it (since it was allowed in CI and Deployment). Check the registry settings – it should be 1 now:

Third-party updates should be installed successfully now.

SCOM: SNMP Configuration

Truesec company sends useful newsletters.

One of the latest (Sept 25th, 2014) contains an advice related to SNMP monitoring with SCOM (by Kare):

The right way of Network Monitoring in SCOM 2012R2

Monitoring Network devices in SCOM 2012R2 is plain simple but unfortunately have a kind of bad reputation. Let me try to clear things out.

You do NOT have to install any SNMP features from Microsoft nor start any SNMP trap service.

This is a common misunderstanding, and unfortunately even in a lot of blogs and books around state you should install SNMP = Don’t. Please just create a discovery and then your Microsoft Monitoring Service (Healthservice.exe) begin listening and using port UDP: 161, 162 (bi-dir) and ICMP as well. This work without installing anything else than SCOM 2012 R2.

Monitoring Netapp, HP and Dell with Windows SNMP

In some situations of HW monitoring the Monitor agent/Proxy only works with Microsoft Windows SNMP, then you need to install Microsoft SNMP on the box that communicate with Netapp/HP/Dell. In this case, either dedicate a Management Server to a Resource Pool and let this Pool take care of the HW SNMP or dedicate a “Machine” to act as a proxy. Otherwise, you end up having two SNMP/ICMP interfaces receiving information not exactly knowing who is taking care of what.

So two things to remember – Do not install any SNMP and if monitoring HW that needs Windows SNMP – keep it away from the Management Server or create a dedicated Resource Pool.

//Kare

MDT: Install Windows 10

 

Windows 10 installation miserably fails with MDT 2013 (dism is not compatible). An unsupported workaround is here