Here are some notes from what I did when I installed a new agent in a workgroup\/untrusted environment with Operations Manager 2007 R2. In this example my CA server is named DC01 and my agent is named DMZ-a01. These steps presuppose that the other side, a gateway server or a management server, is already configure correct. In this scenario I had a gateway server between the management server and the agent.<\/p>\n
Remember to configure your management group to allow manually installed agent (Administration\/Settings\/Security).<\/p>\n
1. From the agent, browse to http:\/\/dc01\/certsrv
\n2. Add http:\/\/dc01 to your trusted sites in IE
\n3. If you get a error saying that the CA must be configured to use HTTPS authentication or ActiveX can’t be loaded, change the security settings for trusted sites zone, enable Initialize and script ActiveX controls not marked as safe for scripting. Then reload the page
\n3. Download a CA certificate, certificate chain, or CRL
\n4. Download CA Certificate chain
\n5. Once the cert is downloaded, open a MMC with the Certificates (Local Computer) snap-in and import the certificate under Trusted Root Certification Authorities<\/p>\n
The next step is to request and install the proper certificate from the root CA server.<\/p>\n
1. From the agent browse to http:\/\/dc01\/certsrv
\n2. Request a certificate
\n3. Advanced certificate request
\n4. Create and submit a request to this CA
\n5. If you get a error saying that the CA must be configured to use HTTPS authentication, change the security settings for trusted sites zone, enable Initialize and script ActiveX controls not marked as safe for scripting. Then reload the page
\n6. On the Advanced Certificate Request page input
\nName, needs to be FQDN of the machine, for example dmz-a01
\nType of certificate needed: Other
\nOID: 1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2
\nCSP: Microsoft Enhanced Cryptographic Provider v1.0
\nCheck Mark keys as exportable
\nName: needs to be FQDN of the machine, for example dmz-a01
\n7. Submit the request
\n8. On your root CA (DC01), open the Certification Authority console, issue the certificate under pending requests
\n9. On the machine that request a certificate (DMZ-a01), browse to http:\/\/dc01\/certsrv
\n10. View the status of a pending certificate request
\n11. Install the certificate by clicking on it
\n12. Open a MMC with the Certificates snap-in, for \u00e2\u20ac\u0153my user account\u00e2\u20ac\u009d. Under Personal certificates, export the certificate including the private key.
\n13. Open a MMC with the Certificates snap-in, for \u00e2\u20ac\u0153local computer\u00e2\u20ac\u009d. Import the certificate under personal certificates.<\/p>\n
Next step is to install the agent software. You need to copy the MOMCertImport.exe and the suitable agent folder (for example AMD64) from the installation source to your agent machine. Run the agent setup, input the FQDN of the management server and the name of the management group. Select a action account, if you unsure, select local system and click next. When the installation of the agent is complete, run MOMCertImport.exe and import the certificate. Then restart the System Center Management service (HealthService).<\/p>\n
Your agent should now show up under pending management in the Operations Manager console. Approve it and you are done! <\/p>\n
There is a tool, certificate generation wizard, that you can download here<\/a>, it can make untrusted agent scenarios easier.<\/p>\n","protected":false},"excerpt":{"rendered":" Here are some notes from what I did when I installed a new agent in a workgroup\/untrusted environment with Operations Manager 2007 R2. In this example my CA server is named DC01 and my agent is named DMZ-a01. These steps presuppose that the other side, a gateway server or a management server, is already configure … Continue reading