If you have tried edit Company Knowledge you have most probable recived a popup telling you “Visual Studio Tools For Office runtime is not installed“. To cure this you can download Microsoft Visual Studio 2005 Tools for Office Second Edition Runtime here. 

After that you will recive a popup telling you “Failed to launch Microsoft Word. Please make sure Microsoft Word is installed. Here is the error message: {0}“. To cure that, install Microsoft Word. Then it should be possible for you to edit company knowledge. I needed a reboot both after Visual Studio tools setup and after Word setup.

As a template in your company knowledge articles I suggest that you follow a common structure, for example summary, configuration, cause, resolutions and additional information. Make sure you press SAVE in Word first and then switch over to the Company Knowledge box and press SAVE there too before you close Word.

In the “Windows Client Operating System Management Pack Guide for Operations Manager 2007” you can read about monitoring Business Critical Clients. But even if you import this management pack, and add your business critical workstation to the “All Business Critical Windows Critical” group you will not get an alert when the workstation are unreachable for example disconnected from the network.

If you look at the “Computer Not Reachable” monitor you will see a default override that disable it for Computer Clients. The same thing for the “Health Service Heartbeat Failure” monitor. If you then add your workstation to the for example All Business Critical Windows Client/All Business Critical Windows XP Clients” group and then create a override that enable “Generates Alert” for the two monitors for this group, you will get an alert if they are unreachable.

Today I saw a question about reponse on a logfile monitor, as there is no “Diagnostic and recovery” tab on a log file monitor. A solution to this is to use a rule instead. If you create a Alert Generating Rules/Event Based/Generic Text Log(Alert) rule, then right-click it and choose properties, you can add a response on the Configuration tab. You can for example add to run a command or a script.

Boris Yanushpolsky a member of the System Center Operations team at Microsoft has upload a new version of MPViewer to his blog. This tool can help you show the following contents of a management pack: Rules, Monitors, Views, Tasks, Console Tasks, and Reports. Download this tool here.

I couple of days ago I posted about ACS and failover. As I wrote there is no failover back to the first ACS collector. If your ACS forwarder failover to a second ACS collector your will have your ACS forwarder data in two databases, as there is a one-to-one relationship between ACS databases and ACS collectors. That will lead to a lot of extra work for you.

I have wrote a simple script to show you one way to get the ACS forwarder to return to the first ACS collector in the list. This script gets the ACS collector settings from the registry, then it test if it can ping the first ACS collector, and if it can, it will restart the ACS forwarder service. That will make the ACS forwarder return to the first ACS collector. If it cant ping the server, it will wait some time and then try again.

Even if your ACS forwarder will start send data to the second ACS collector as soon as your first ACS collector is back online your ACS forwarder will return and you will hopefully not have that much data in the second database.

You can setup a rule to trigger on event ID 4368 from Source AdtAgent in the Application log. The description should also include the name of your second ACS collector. Make the rule run the script as a response.

You can download the script here

Tonight I have been thinker with ACS forwarder failover. You can read more about Audit Collection Services (ACS) in prior posts, but the fundamental is that the agent can be a ACS Forwarder which forward security events to a ACS collector (management server). My thought what is happening if a ACS collector goes down? What will the ACS forwarder do?

When you enable Audit Collection on a machine, in the “Run Task – Enable Audit Collection” box, there is a Override button (if you have multiple ACS collectors). If you click that one you can manually input collector servers. If you input “opsmgracs01.contoso.local, opsmgracs02.contoso.local” bot of these machines will be written in your ACS forwarder registry as AdtServers. You can verify that in the registry at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\
Microsoft\AdtAgent\Parameters\AdtServers

If you disconnect the first machine, opsmgracs01, from the network you will get a event (ID 4369) in the event viewer at the ACS forwarder. This event tells you that the agent can not connect to any ACS collector, but a couple of seconds later you will see a event (ID 4368) telling you that the ACS forwarder is now connected to the other ACS collector, opsmgracs02.

I have been waiting around 30 minutes, after I reconnected the first ACS collector, and I have not seen a event telling me that the ACS forwarder has return back to the first ACS collect. You could control this with a extra script.

Summary: If you use the override button during enable audit collection you can setup multiple ACS collectors for your ACS forwarder. Remeber that if the agent failover, you will have ACS data in two different databases.