Removing a machine from AD Client Monitoring

[Shannon Morley]

Hi All,

Has anyone been able to successfully remove a machine from doing AD Client
Monitoring (without deleting the AD Client Monitoring MP)?

After overriding the object discovery for AD Client Monitoring Discovery to
add a server to perform AD Client Monitoring, the discovery runs for that
server and adds it to the AD Monitoring Client Computer Group.When you
delete the override, discovery no longer runs for that server, but there
appears to be no process to actually remove it from the AD Monitoring Client
Computer Group, so it remains enabled for AD Client Monitoring. You can't
manually alter the group membership because it is inside a sealed MP, and
creating a override to force that machine back to false state for the object
discovery doesn't make a difference.

Regards
Shannon.

[Peter Schmatz [MSFT]]

Hi Shannon,

This shouldn't happen. We need to look into this and get a lab repro setup

Thanks
Peter

Post by Shannon Morley
Hi All,
Has anyone been able to successfully remove a machine from doing AD Client
Monitoring (without deleting the AD Client Monitoring MP)?
After overriding the object discovery for AD Client Monitoring Discovery
to add a server to perform AD Client Monitoring, the discovery runs for
that server and adds it to the AD Monitoring Client Computer Group.When
you delete the override, discovery no longer runs for that server, but
there appears to be no process to actually remove it from the AD
Monitoring Client Computer Group, so it remains enabled for AD Client
Monitoring. You can't manually alter the group membership because it is
inside a sealed MP, and creating a override to force that machine back to
false state for the object discovery doesn't make a difference.
Regards
Shannon.

[Tarek Ismail]

Hello Shannon,

Really i can not get your problem in details but about configuring AD MP you
can check my Guide

Installing and configuring Active Directory Management Pack for Operations
Manager 2007
http://tarek-online.blogspot.com/2007/06/installing-and-configuring-active.html

also based on this guide we create a group to act as AD Client monitor Group
and use it for overrides and all overrides are saved on non Sealed MP named
Active Directory overrides Management Pack
I hope this can help you!

[GD]

Hi Tarek

Sadly your guide doesn't say anything about removing agents from client
monitoring which is the point of this question ;-)

Basically it looks like a bug - on the machines that I have enabled as "AD
Clients" there is a registry key created in HKLM \ Software \ Microsoft
Operations Manager \ 3.0 \ Modules \ {GUID} \ SID \ Script \ AD Management
Pack .. then two keys under there for AD Client Connectivity and Client PDC
Response. When you remove the override (to remove the machine from client
monitoring) the registry settings still remain. I guess the attribute looks
for this registry key ... and the group is based upon the existance of this
registry key.

So if you remove the override that enabled AD Client monitoring for the
group then the registry keys remain and it seems that there is no point in
deleting the registry keys as the discovery won't run anyway so the group
membership won't change. And if you remove the registry keys before removing
the override then Operations Manager will recreate the registry keys when
the discovery next runs. It's a classic chicken and egg situation ;-(

That's my take on this anyway ... lets hope for a workaround (or that I'm
wrong!).

Cheers

Graham

Post by Tarek Ismail
Hello Shannon,
Really i can not get your problem in details but about configuring AD MP
you can check my Guide
Installing and configuring Active Directory Management Pack for Operations
Manager 2007
http://tarek-online.blogspot.com/2007/06/installing-and-configuring-active.html
also based on this guide we create a group to act as AD Client monitor
Group and use it for overrides and all overrides are saved on non Sealed
MP named Active Directory overrides Management Pack
I hope this can help you!
--
Best Regards,
Tarek Ismail
System Center Operations manager 2007 in Egypt
http://tarek-online.blogspot.com/

[Tarek Ismail]

Hello GD,

As i get from the question , not to remove the MOM agent from client , and
don't want delete the MP , only remove the server from AD client monitor
discovery overrides.

the problem was to remove the server from the object discovery overrides,
to do this follow the following steps:
from authoring pane, choose object discoveries.
click AD client monitoring discovery , and choose properties.
on overrides tab , click view summury , for the discovery
all overrides for this discovery all listed.
choose the server and click delete.

regarding to other issue , i need to check this later.

Best Regards,
Tarek Ismail
System Center Operations manager 2007 in Egypt
http://tarek-online.blogspot.com/

[GD]

Hi Tarek

Have you tried this? I can replicate Shannons issue - the problem seems to
be that enabling client ad monitoring for a computer group (by setting an
enable override) creates registry settings on computers in the group (as per
my previous post). I assume it is these settings that the ad client
monitoring attribute looks for.

The problem seems to be that once you set an override to disable discovery
of an already discovered computer (or just remove the enable override for
the whole group as you mention), then discovery of that computer doesn't run
and so the group membership does not get updated. If you manually hack the
client ad registry settings out of the registry prior to setting the
disabled override on discovery then the discovery just recreates them. Hence
there doesn't seem to be a way of removing a computer from client ad
monitoring.

Hope I'm wrong ...

Cheers

Graham

Post by Tarek Ismail
Hello GD,
As i get from the question , not to remove the MOM agent from client , and
don't want delete the MP , only remove the server from AD client monitor
discovery overrides.
the problem was to remove the server from the object discovery overrides,
from authoring pane, choose object discoveries.
click AD client monitoring discovery , and choose properties.
on overrides tab , click view summury , for the discovery
all overrides for this discovery all listed.
choose the server and click delete.
regarding to other issue , i need to check this later.
Best Regards,
Tarek Ismail
System Center Operations manager 2007 in Egypt
http://tarek-online.blogspot.com/

[Tarek Ismail]

Hi Graham,

Regarding how to remove overrides , the steps is listed before.
Regarding the Agent still acting as AD client monitor , i notice this in my
LAB .

I am asking Two of our customer to check and update me with this issue to
confirm this behavior to be sure about this.
waiting others admins to update me in different enviroment.

Until this time it seems a bug!

[GD]

Hi Tarek
It certainly looks like a bug to me - lets hope MSFT can give us some
feedback on this.
Have Fun
Graham

Post by Tarek Ismail
Hi Graham,
Regarding how to remove overrides , the steps is listed before.
Regarding the Agent still acting as AD client monitor , i notice this in
my LAB .
I am asking Two of our customer to check and update me with this issue to
confirm this behavior to be sure about this.
waiting others admins to update me in different enviroment.
Until this time it seems a bug!
--
Best Regards,
Tarek Ismail
System Center Operations manager 2007 in Egypt
http://tarek-online.blogspot.com/

[GD]

Hi MSFT

Do we have an update on this ? It really does not seem possible to remove a
machine from the AD Client Monitoring group ...

Cheers

Graham

Post by GD
Hi Tarek
It certainly looks like a bug to me - lets hope MSFT can give us some
feedback on this.
Have Fun
Graham

Post by Tarek Ismail
Hi Graham,
Regarding how to remove overrides , the steps is listed before.
Regarding the Agent still acting as AD client monitor , i notice this in
my LAB .
I am asking Two of our customer to check and update me with this issue to
confirm this behavior to be sure about this.
waiting others admins to update me in different enviroment.
Until this time it seems a bug!
--
Best Regards,
Tarek Ismail
System Center Operations manager 2007 in Egypt
http://tarek-online.blogspot.com/

[Derek]

Just to add I am also seeing this issue

[Peter Schmatz [MSFT]]

Hi Shannon,

This is unfortuately a platform issue (the problem is that 'undiscovery'
fails once the discovery is disabled). We are looking for a solution in SP1.
The only workaround right now is to uninstall the AD Client Monitoring MP to
disable it.

Thanks
Peter

Post by Shannon Morley
Hi All,
Has anyone been able to successfully remove a machine from doing AD Client
Monitoring (without deleting the AD Client Monitoring MP)?
After overriding the object discovery for AD Client Monitoring Discovery
to add a server to perform AD Client Monitoring, the discovery runs for
that server and adds it to the AD Monitoring Client Computer Group.When
you delete the override, discovery no longer runs for that server, but
there appears to be no process to actually remove it from the AD
Monitoring Client Computer Group, so it remains enabled for AD Client
Monitoring. You can't manually alter the group membership because it is
inside a sealed MP, and creating a override to force that machine back to
false state for the object discovery doesn't make a difference.
Regards
Shannon.

[Peter Schmatz [MSFT]]

Hi Shannon,

Unfortunately this is a known problem, we are looking for a solution for
SP1. That is "forced undiscovery"

Thanks
Peter

Post by Shannon Morley
Hi All,
Has anyone been able to successfully remove a machine from doing AD Client
Monitoring (without deleting the AD Client Monitoring MP)?
After overriding the object discovery for AD Client Monitoring Discovery
to add a server to perform AD Client Monitoring, the discovery runs for
that server and adds it to the AD Monitoring Client Computer Group.When
you delete the override, discovery no longer runs for that server, but
there appears to be no process to actually remove it from the AD
Monitoring Client Computer Group, so it remains enabled for AD Client
Monitoring. You can't manually alter the group membership because it is
inside a sealed MP, and creating a override to force that machine back to
false state for the object discovery doesn't make a difference.
Regards
Shannon.