Beta 1 of Ops Mgr 2007 R2 has been released to the connect website. You can download the beta there and start evaluating it. On the system center team blog there is a good post about R2 and all the news. Below you can see and read about some of the news in R2. One of the first things I noticed is how fast everything in the console is.

When you import new management packs you can select “Download Management Packs”. With that you can import directly from the system center ops mgr 2007 catalog. The wizard will show you which MPs are in the catalog and if they are newer then the version you have installed.

 

When you right-click an alert you get the option to create a notification based on that alert. It looks almost as the “create rule wizard” in Outlook. There are a number of criteria and conditions you can use when creating a new subscription. 

 

 

Under the Authoring workspace there are a number of new management pack templates, including a couple of Linux and UNIX machines.

 

There are also a number of new objects under management pack objects, for example Service Level Tracking. Service Level Tracking enables you to follow the performance and availability objects/services in your environment. You can create monitors to monitor your commitments, service level objective goals.

 

Under the administration workspace there is a number of news. One of the important features of R2 is support for Unix and Linux servers. When you run the discovery wizard you can now choose to discover Unix and Linux computers. When creating smtp notification channels you can select importance for your notification.

 

On the R2 beta CD there is a new version of the Authoring Console too.

If you want to change the default web console view there are at least two ways to do it:

1. Start the web console, find the view that you want to open first, for example “Contoso Alerts”. Then create a new shortcut to http://WebConsoleServer:51908/default.aspx?ViewName=Contoso Alerts
2. The second way is a little bit more complicated. Start the web console, navigate to the view, right click in the navigation tree and select “view source”. The in the source, search for the name of the view and you will find the “onNodeClicked code” on the same line, for example 4cb2t5a7-b4b4-2621-2e7b-e346ag52f2ed22. You will also need the ViewType, you can find that next to the “onNodeClicked code”.Then create a new shortcut to http://webconsoleserver:51908/default.aspx?ViewID=8db1f5a7-f3f3-2646-6c6b-e34672f7ed98&ViewType=AlertView , insert the ViewType and onNodeClicked code.

Microsoft Audit Connection Service (ACS) is a new function in SCOM 2007 that can collect logs from machines. All logs are saved in a special Audit Collection database. You can then run reports against the database to see trends and do security analyzes. You can also for example trace a user activity over many systems.

Operations Manager (Ops Mgr) comes with a number of ACS reports but most of them only work with Windows Server 2003. I have customers who have upgrade to Windows Server 2008 and now experience that ACS no longer is working. That is due to ACS reports are looking for Windows Server 2003 events. For example the “Usage _-_User_Logon” report is looking for event ID 540 and 528, but in Windows Server 2008 the logon events are ID 4624 and 4648.

Another problem with ACS reports is that you can’t schedule them with relates dates, for example “last week first day” and “last week last day”.

To create a new report to show all logons (event ID 4624) for a domain user, last seven days, you can use the build in SQL Report Builder. These presuppose that you have ACS installed correct. You can read how to deploy ACS here.

1. Start the Operations Manager 2007 console and navigate to the Reporting workspace, click “Design a new report”
2. In “Microsoft Report Builder” select Audit as source of data for your report, select table report layout and click OK
3. Click and add a title, for example “Contoso – Domain User Logon
4. From “Fields” drag and drop “Logon Time” to the table
5. From “Fields” drag and drop “Target User” to the table
6. From “Fields” drag and drop “Event Machine” to the table
7. From “Fields” drag and drop  “String 13” to the table
8. From “Fields” drag and drop “String 02” to the table
9. From “Fields” drag and drop “String 12” to the table
10. From “Fields” drag and drop “String 03” to the table
11. Click “Fields” in the tools menu
12. In the “Filter Data” window, from “Fields” drag and drop “Event ID” to the “Dv Alls with” box. Select event ID 4624 in the drop down menu
13. In the “Filter Data” window, from the “Fields” drag and drop “Logon Time” to the “Dv Alls with” box. Select “Logon Time on or after 7 days ago” and “Logon Time on or before today”
14. In the “Filter Data” window, from the “Fields” drag and drop “Target Domain” to the “Dv Alls with” box. Select “Target Domain equals ”
15. In the “Filter Data” window, from the “Fields” drag and drop “Target User” to the “Dv Alls with” box. Right-click “Target User” and select “Prompt”.If you don’t add a filter to this formula you will get a drop-down menu with all usernames to select from. (Right-click “Target User” and select “Edit As Formula”, double click “Parameter: Target User”, expand, add a simple filter, for example a empty filter)
16. Rename the table cells, to for example
    Event Machine to “Computer (Logon on to)
    String13 = Auth Package
    String02 = Logon Type
    String12 = Logon Process
    String03 = Computer (Logon on from)
17. When you are happy with your new report you can test run it with the “Run Report” button. You can then save the report to your report server on the File menu.

It can also be nice with an information box both what this report does and what all different logon types mean. Also insert a filter description to your report from the Insert menu.

Useful Links
Description of security events in Windows Vista and in Windows Server 2008, link
Audit Category: Logon/Logoff (Vista and Windows Server 2008), link