I came across a problem attempting to install the SCSM prerequisite "Authorization Manager Hotfix" when installing SCSM on Server 2008 R2 with SP1. It said that it is not applicable, but it still shows a warning.
IT IS NOT NEEDED. What is my source? Well, unfortunately, a comment made by Travis Wright. But it is good enough for me, and it seems to work fine without it.
I quote "The Authorization Manager hotfix is not required on Win2k8 R2 SP1"
Source: Look in the comments section
http://blogs.technet.com/b/servicemanager/archive/2011/03/04/service-manager-2010-sp1-now-supports-windows-server-2008-r2-windows-7-sp1-and-sql-server-2008-sp2.aspx
Monday, June 13, 2011
Sunday, June 12, 2011
Service Manager role based security scoping
The below post isn't real new, but it is highly informational. A lot of questions tend to arise around security scoping, and I found a great post, which I wanted to duplicate. The below text was taken from http://scug.be/blogs/scsm/archive/2010/03/21/service-manager-role-based-security-scoping.aspx.
An important aspect in the overall configuration of the Service Manager environment is providing access to the SCSM environment to perform operations. This in a controlled way, so End Users, Operators, Resolvers, Change Owners… can easily access SCSM and perform the their tasks in a controlled environment.
With Role based security scoping in SCSM there is the possibility to configure a controlled environment for different service roles. A SCSM role profile is a configuration set to define access to objects, views in the console, operations they can perform and members of the role (AD User/Group). SCSM components of a User role are:
The following example “runs” through the creation of the Mail incident resolver role.
Example info:
Example step-by-step for the email incident resolver user profile:
I hope this gives you an idea how to configure role based security scoping for your environment.
Have fun!
Kurt
An important aspect in the overall configuration of the Service Manager environment is providing access to the SCSM environment to perform operations. This in a controlled way, so End Users, Operators, Resolvers, Change Owners… can easily access SCSM and perform the their tasks in a controlled environment.
With Role based security scoping in SCSM there is the possibility to configure a controlled environment for different service roles. A SCSM role profile is a configuration set to define access to objects, views in the console, operations they can perform and members of the role (AD User/Group). SCSM components of a User role are:
- The security scope: Is the security boundary in SCSM. Boundaries can be set on Group/queue, Class, Property & relationships.
- UI filter scope: This filter is for defining what an operator can see in the SCSM console. Limiting the options visible in the console improves the usability. UI filters can be set on console tasks, templates and views.
- User role profile: SCSM includes some predefined user profiles who include a set of allowed operations with a class/property/relationship scope over objects.
- User Assignment: The members of the user role in SCSM. This can be set for users or groups. (Always recommended to use groups)
The following example “runs” through the creation of the Mail incident resolver role.
Example info:
- Only incidents from the “Email problem" category need to be visible for the role.
- The mgmt console Views access is limited.
- User roles can be controlled with AD security group.
Preparing the Security Scope
As specified above, Security Scope for a user profile can be specified on different levels. This preparation step goes through the creation of the group and the incident queue for further use in the user profile creation.Create a group in SCSM
Creating a group in the SCSM console is a straightforward task. In this example the- In the Service Manager console, click Library, expand Library, and then click Groups.
- In the Tasks pane, click Create Group.
- On the Before You Begin page, click Next.
- On the General page, do the following:
- Provide a name for the group, such as Email Servers.
- In the Description text box, type a description for the group.
- Under Management pack, make sure that an unsealed management pack is selected. In our example we store the information in a dedicated custom mgmt pack.
- Click Next.
- On the Included Members page, click Add.
- In the Select Objects dialog box, select a class such as “Windows Computer”. (Groups can includes members of the same class or from different classes.)
- In our example select all the Exchange servers in the organization.
- Click OK, click Next
- On the Dynamic members page, click Next.
- On the Subgroups page, click Next.
- On the Excluded Members page, click Next.
- On the Summary page, confirm the group settings that you made, and then click Create.
- On the Completion page, make sure that you receive the following confirmation message, and then click Close.
Create the incident queue
Next step in the preparation of the User Role profile configuration is to create a Queue for incidents.- In the Library pane, expand Library, and then click Queues.
- In the Tasks pane, click Create Queue.
- On the Before You Begin page, click Next.
- On the General page,
- type a name in the Queue name box. (In our example, Mail incidents Queue)
- Work item type box, in the Select a Class dialog box, select a class. In our case “Incident”, and then click OK.
- In the Management pack list, select the same “roles” mgmt pack that is used to create the group. (keeping the thing together)
- Click Next.
- On the Criteria page, build the criteria that you want to use to filter work items for the queue, and then click Next.
- In our example, select the Classification Category property in the “Available Properties” area, click Add.
- In the list, select Email Problems, and then click Next.
- (more the one criteria can be specified on this page)
- On the Summary page, click Create to create the queue.
- On the Completion page, click Close.
Create a User role Profile in SCSM
Group and queue are created in the SCSM console, the User Role Profile creation can start. Groups and queues are two configuration items of a User Profile. Mgmt Pack access, Views, templates & tasks are other configuration items in the wizard. If there is a need to limit access to these items then this information needs to be available before the creation of the profile.Example step-by-step for the email incident resolver user profile:
- In the Administration pane of the SCSM console, expand Security, and then selectUser Roles.
- In the Tasks pane under User Roles, select Create User Role, and then select the user role profile.
- In our example we select the Incident Resolver role.
- On the Before You Begin page, click Next.
- On the General page, enter a name and description for this user role, and then clickNext.
- Important Info: on the general page of each predefined role there is a clear description of the rights of the selected role profile.
- On the Management Packs page, select the management packs that contain the data that you want to assigned access to. In our example “select all” and click Next.
- On the Queues page, select the Queues that this user role will have access to, and click Next. Here we use the just created Queue for our Email Incident Resolvers role.
- On the Groups page, select the Groups that this user role will have access to, and clickNext. Here we use the just created Group for our Email Incident Resolvers role.
- On the Tasks page, select the Tasks that this user role will have access to, and clickNext. In our example I don’t limit the available tasks.
- On the Views page, select the Views that this user role will have access to, and clickNext. In our example I want to limit the view in the mgmt console and selected only items from Incident management and configuration management.
- On the Form Templates page, select the Templates that this user role will have access to, and click Next. In our example I don’t limit the available templates.
- On the Users page, click Add, and use the Select Users or Groups dialog box to select users and user groups from Active Directory Domain Services for this user role, and click Next.
- On the Summary page, review settings and click Create.
- On the Completion page, click Close.
To validate the creation of a user role
- In the Service Manager console, verify that the newly created user role appears in the middle pane.
- Log on to the Service Manager console as one of the users assigned to the user role.
- Verify the access in the mgmt console
- Verify the Views in the mgmt console
This is just an example how you can setup a user profile. There are a lot of different roles with different configuration items that can be set in SCSM, all depends on the requirements of the environment. Keep in mind that each additional role profile that is created will have an additional load on the server.
- Only the “Work Items” and “Configuration Items” pane are visible for the user. “Work Items” pane is limited by the Views filter in the configuration of the profile.
- Only Incidents from the Email queue are visible in the console
- Read-only access to the configuration items in the console
I hope this gives you an idea how to configure role based security scoping for your environment.
Have fun!
Kurt
Thursday, May 26, 2011
WebFront for Service Manager « Gridpro
gridpro has created a web front end for Service Manager. It is set to be released May 2011. Check it out.
Wednesday, May 25, 2011
BOOK: System Center Service Manager 2010: Unleashed
System Center Service Manager 2010 is available for pre-order on Amazon. Get it now!
Friday, May 20, 2011
Saturday, May 7, 2011
Move the database in Service Manager 2010
2010-10-16 16:30:00Stefan Allansson
Move the database in Service Manager 2010
If you want to move the SQL database for SCSM to another SQL server, you can do like this:
Start with taking backup of your SCSM database on the first SQL server.
In SQL server Manager, right click the Service Manager database and choose Tasks\Backup.
Default choices are ok.
In SQL server Manager, right click the Service Manager database and choose Tasks\Backup.
Default choices are ok.
Copy the database backup file to your new SQL server. You can put the file where you want on the server. Open the SQL Manager on the new SQL server and right click “Databases” and choose Restore Database. Fill in the database name and choose “from device” and specify the location for the backup file that you have copied to the new SQL server.
Next step is to do some changes in the registry on the Service Manager Management Server.
Change the “DatabaseServerName” to your new SQL server under:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\System Center\2010\Common\Database
Change the “DatabaseServerName” to your new SQL server under:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\System Center\2010\Common\Database
If you have changed the name on your database when you restored it on the new server you have to change the “DatabaseName” in the registry. Restart the service “System Center Data Access Service” on the Service Manager Management Server and then open the SCSM console.
Now your Console is connected to your new SQL server.
Now your Console is connected to your new SQL server.
Friday, March 18, 2011
Tuesday, March 1, 2011
Sunday, February 13, 2011
Strange issues with the SCSM Mangement Server
I sometimes find strange issues with the SCSM management server. For example, my connectors have not synchronized in several days. Performing a manual synchronization does nothing. When I look in the event log, there are no errors, but there is a sync start/end immediately.
I have found that a restart of all the SCSM services will clear this up. If services restarts do not work, a server restart usually does work.
I have found that a restart of all the SCSM services will clear this up. If services restarts do not work, a server restart usually does work.
Friday, February 11, 2011
Thursday, February 10, 2011
Tuesday, February 8, 2011
Export all unsealed MPs
http://www.scsm.se/?p=227
| Here’s a little powershell script that I use for exporting all unsealed MPs. It’s really useful to run once in a while so you have a backup of all unsealed MPs. The script will create a new folder with the current date and store all MPs in that folder. Change the $OutPutDir variable to a folder of your choice. [powershell] Add-PSSnapin SMCMDLetSnapIn $OutPutDir = “C:\Unsealed MPs\” $UnsealedMPs = Get-SCSMManagementPack | ?{ ! $_.Sealed } $CurrentDate = Get-Date $CurrentDate = $CurrentDate.ToShortDateString() $CompletePath = ($OutPutDir + $CurrentDate) if ( ! (test-path $CompletePath)) { $output = New-Item -Type Directory -Name $CurrentDate -Path $OutPutDir } $UnsealedMPs | %{ ” Exporting: {0}” -f $_.Name $_ | Export-SCSMManagementPack -directory “$CompletePath” } [/powershell] |
Sunday, February 6, 2011
SharePoint Surveys with SCSM
http://blogs.technet.com/b/servicemanager/archive/2009/12/08/incident-resolution-satisfaction-surveys-on-sharepoint.aspx
SCSM Portal is Slow - I got a suggestion from Travis Wright
I got some more information from one of our devs today. Try this:
- Open IIS
- Select the Application Pools view
- Select the SM_AppPool application pool (unless your portal is using a different app pool for some reason)
- Click the Advanced Settings... link in the Actions pane on the right (or in the context menu)
- Scroll down to the bottom to the Recycling section
- Change the Regular Time Interval (minutes) option to 0 (never recycle)
That will make sure the portal doesnt just recycle the app pool and require a rebuild just because a certain amount of time has passed.
Wednesday, February 2, 2011
Monday, January 31, 2011
Enabling Users to Take Action from Email Using Web Pages/Web Services
Travis Wright [MSFT]
25 Jan 2011 2:22 PM
• 4
This is a guest blog post from a Microsoft Consulting Services Senior Consultant – Andreas Rynes. He has become a Service Manager expert lately and has come up with a really innovative solution I wanted to share with you all. The scenario that Andreas writes about in this blog post is a way to enable an end user to receive an email notification when his incident is resolved and then to click a link to either reactivate or close the incident. The link passes the work item ID on the query string and the web page the user is directed to by clicking on the link either updates the incident status to closed or active depending on the link the user clicked. The exciting thing about this is not just this particular solution but the pattern which can be followed to enable many other types of scenarios for SCSM. Some other scenarios I could see working with this pattern are: change request approval/reject, going to a web page to provide additional information about an incident, viewing the status of a change request, etc.
This solution is similar to some of these that we have already published if you are interested in looking at other examples of doing this kind of thing:
Incident Resolution Satisfaction Surveys on SharePoint
Automatically Sending Notifications to Reviewers
Inserting links to Review/Manual Activities in notifications
Thanks for writing this up Andreas and sharing with the community!
====================================================================================================================
During a SCSM session with my customer, while we gathering requirements for their implementation of SCSM, they asked me for the following requirement: whenever an incident is resolved by an analyst the affected end user should be notified with an email. This is nothing special and can be done easily with SCSM workflow features out of the box. So I thought: “yes, of course”, but then they continue with their requirements, that this email should include an option to close or reactivate an incident. The idea behind that requirement is that the end user is the one that can decide if the topic described within the incident was resolved or needs further attention by an analyst.
So the solution is not that complex, but it needs some very different parts to fulfill the requirement. First you need to use the SDK from Service Manager to define methods to close and activate an incident, the second part is the mail template, which can be defined within the Service Manager console and the third part is the workflow that triggers the notification, also managed within the console.
Part I – Visual Studio
1) First I’ve created a solution within Visual Studio. I’ve decided to create a Web Service to implement the functionality for the simple reason that a web service gives you the flexibility to use it both from a web and rich client application.
Start Visual Studio, click on File – New – Web Site … and choose ASP.NET Web Service and give it a meaningful name like SCSMIncidentService
VS creates a template for a asmx web service with three important files called service.cs, service.asmx and a web.config file. I won’t go into detail about SOA architecture or web services and how to implement that within Visual Studio. So I just mention all the details needed for this specific solution.
1) Now go on and remove the already generated first web method “HelloWorld” and implement the SCSM functionality.
2) After that you need to add references to the SDK, for that switch to the Solution Explorer, click on the right mouse button at the project and choose Add Referenceand go to the tab Browse and go to the Service Manager installation folder (normally on C:\Program Files\Microsoft System Center\Service Manager 2010\SDK Binaries and choose all three files there.
3) Then add these using statements in the service.cs file by adding the following lines at the very top:
using Microsoft.EnterpriseManagement;
using Microsoft.EnterpriseManagement.Configuration;
using Microsoft.EnterpriseManagement.Common;
You can also add another namespace, System.Configuration (as shown in the screenshot). I’ll describe later why we could use this one as well.
4) We first start implementing a constructor for the service that initiates all the required classes like the ManagementGroup with either an FQDN or localhost (I’m hosting that service on the same server as the Service Manager Data Access Service) of the Service Manager.
In the second line you’ll see the usage of ConfigurationSettings.AppSettings, which is why we add the System.Configuration namespace to the service. This uses the AppSettings section of the web.config file to gather the Version and PublicKeyToken for the Management Pack. The advantage of using the web.config is that you don’t have to hardcode those values in the code and with every change you would have to re-compile it everytime. If you put those values in the web.config you can just change the xml file.
Then we need the ManagementPack for the Incident class and the enumeration of the status of incidents. We put all these in the constructor of the service class.
5) Then we are going forward to implement the two web methods, I’ve called them CloseIncident and ActivateIncident. Those methods accept the ID from the incident (e.g. IR10) and a string for the current user, who called the method. That mechanism is needed to avoid closing or activating incidents by accident from other users (I’ll describe that feature in a moment). Both methods call another private method called UpdateIncident. That method does the real work and accepts three parameters - those two from the Webmethods and another one that defines if the incident needs to be closed or activated.
6) UpdateIncident has some more lines, but not that much. It initiates another MP that hosts a TypeProjection. This is required to get the Affected User (as this is not part of the Incident class, but is a relationship to a user instance) to compare it with the actual user (we’ll get the user from the security principial context of the webpage).
From that MP we initiate the TypeProjection and with the help of a criteria string that defines the search criteria for the TypeProjection (in this case the incident class is the seed of the TypeProjection) we can use GetObjectProjectionReader to receive the specific incident. If the incident with the specified ID was not found then the method return false. If there is a record found we use a ManagementPackRelationship instance to get the Affected User. Then we compare it with the activeUser string and make sure that the incident is not closed already (because from an ITIL process view a closed incident should not be re-activated again).
The real work is done within two lines of code, set the status to the string that is passed in the UpdateIncident method (close or active) and overwrite the instance.
7) The last thing we need to clarify for the service is the CreateIncidentCriteriaXml method that just returns the criteria that is needed to receive the correct incident. For that we just use a simple expression that uses the ID attribute of the WorkItem as the left part and the searchString as the right part and the equal operator.
So with that, we’ve finished the service.
8) You would be able to test that asmx service already, just press F5. You will get an interface in the browser to test your two webmethod.
Next, we need to create two aspx websites that calls the service and give the user some sort of feedback, if the call was successful or not.
After adding those aspx webpages to your solution go and add a method to each of both, one for activateIncident and one for closeIncident. There are two parameters that we need to get to call the service, the ID of the incident and the name of the current user. For the first parameter we just crawl the QueryString (so we have to set the ID in the URL in the email template later) and for the current user we call the WindowsIdentity.GetCurrent() method. Then initiate the service and call one method per each aspx webpage.
9) After that you’re absolutely free to design the webpage and customize it that it fits your needs and UI definitions and requirements. In my case I’ve just added some positive text if the method returns 0 or some negative text for the value 1.
Part II – eMail Template
Now it’s time to create the email template
Before you create the email template, the second part of our solution, it’s time to configure the notification channels within the SCSM console. Go to Administration – Notifications – Channels and choose the e-Mail Notification Channel and double click it or click on Properties in the task pane. There you need to configure your SMTP server, a return email address and enable the e-mail notification.
After that click on the templates within Administration – Notifications to create your new template.
i) General
Give the template a name and describe it. The most important part on that first page of the wizard is to choose the correct target class, which is Incident in this case and put it in your own management pack.
ii) Template Design
In the Template Design tab you can design your mail, if it’s old-style text email or a HTML formatted mail, the mail subject and the body. For me, I’ve decided to generate an HTML-formatted mail with some fancy stuff like images and different font-styles. The result could looks like this or even better if you like:
You can define your own CSS styles and arrange the text and images where you want them to be. The best way it works for me was using an editor outside of the console and create the entire look and feel there. Then the HTML source can just be copy/pasted into Service Manager’s notification template wizard textbox.
You can see more information about how to create notification templates in this blog post:
http://blogs.technet.com/servicemanager/archive/2009/09/28/creating-notification-templates-in-system-center-service-manager.aspx
The most importing thing is the URL of those two hyperlinks, as we defined two webpages we need to use those and add the incident ID with ?ID=IR10 (we need to replace that in the console with dynamic data from the incident)
Then just paste the complete HTML code to the console template wizard and replace the dynamic text parts with those items from the incident instance with theInsert… button (don’t try to just type the value in – that won’t work. Use the Insert… button).
From there you can choose the attributes from the incident and related entities, which are then placed within the template (both body and subject field). For example you have to replace the URL with <a href="http://atssm/ServiceManagerSample/CloseIncident.aspx?ID=$Context/Property[Type='CustomSystem_WorkItem_Library!System.WorkItem']/Id$">Incident wieder eröffnen</a> (Please note that you have to customize the URL to your own webserver and webapplication!)
The result looks like the screenshot below:
After that you’re done with the template, just click on Next for the Summary tab and finish the wizard.
Part III – Workflow
Now we have the web services/site pages and the email template, now we need the workflow that triggers the entire solution.
Open the console and go to the workflow configuration view that can be found under Administration – Workflow – Configuration. There are some already defined workflow configurations that can be used and we go with the Incident Event Workflow Configuration. After selecting that entry click on Properties in the task pane.
Now you can setup a new workflow that runs whenever an Incident is updated or created.
So click on Add and fill out the Workflow Information that are asked, take care to choose “When an incident is updated” in our case and choose also the correct Management Pack (it makes sense to choose the same as for the template, so that the solution is built in one single MP). And of course, enabling the workflow with the checkbox makes a lot of sense here J
Now we have to define the criteria when the workflow should be triggered. For now we just said whenever an incident is updates (which would be true, if someone just updates a description or any other field on the incident form). So we need to define that this should run only if the Status is changed to Resolved.
So keep the “Changed from” empty as this is not important to us, but add the Status in the “Changed To” tab and enter resolved to the textbox next to it.
So now it’s time to tell the workflow configuration what to do, when it is triggered. In our solution we’d like to Select People to Notify. So in the specific tab make sure the checkbox Enable notification is set and choose Affected User in the ComboBox and choose the new created mail template a couple of minutes before. And don’t forget to click the Add button (I did this from time to time J).
After that setup we are all set and done. Finish the wizard and see if the window for the Incident Event Workflows is updated with your new workflow definition.
Now it’s time to test the complete solution by resolving an incident in the console. Make sure that you have an incident that has an Affected User filled out and that this user has an email-address in the Active Directory and in the Service Manager database, otherwise there will no email be generated. If that’s a test lab environment like it was in my case, you can enter an email address in the CMBD on the user entity form, but make sure that you disable the AD Connector for a test, as it might overwrite the email-address with a blank value again J
In my template, I’m using also the Resolution Category and Comments from the analyst, so I put some more or less useful text in those fields and resolve the incident.
A couple of seconds later the email is generated and showing the correct values from the incident and the option to close or re-activate the incident with a simple click on the specific link.
The user gets a response that his/her incident was closed now (or re-activated) with the HTML page I designed before.
The source files for this solution are attached.
EMailIncidentSample.zip
Subscribe to:
Posts (Atom)