Time Zone Redirection not working

Hi all!,

We are having a problem with the time zone redirection, we have a customers that are on different time zone than us and they are using a remote app system that's hosted on our server, whenever they use the program it should be saving data using their local time but it's using the same time as the server, we want to enable Allow Time Zone Redirection both on the server they are connecting to and on their local computers, but before we do that, we are trying to test it out on our side by changing the time on one computer and remoting to the server we have enabled the Time Zone redirection. this seems not to work, my question is can we be able to test this out on the local network, and if so how do we test it out?

PowerShell - Determine if an application and version is installed

I have a collection of computers that we regularly install an updated application to (msi) and would like to know if there a way to determine if a given application and file version is installed by referencing either the installed apps in control panel or file location.

Name
Version
Time installed
Date installed

DHeinz

Changed type Bill_Stewart Friday, December 30, 2016 8:31 PM
Moved by Bill_Stewart Friday, December 30, 2016 8:31 PM This is not "scripts on demand"

Reply:

Pre-written scripts are here: https://gallery.technet.microsoft.com/

\_(ツ)_/

------------------------------------
Reply:

Got SCCM?

------------------------------------
Reply:

see

gwmi win32_product| select -first 1| fl *

my blog: http://shserg.ru/

------------------------------------
Reply:

Win32_Product only lists applications installed with Windows Installer. Try this script instead:

Windows IT Pro: Auditing 32-Bit and 64-Bit Applications with PowerShell

-- Bill Stewart [Bill_Stewart]

------------------------------------
Reply:

Win32_Product only lists applications installed with Windows Installer

IIUC, that is what DRHeinz wants to get.

my blog: http://shserg.ru/

------------------------------------
Reply:

Correct; I wasn't saying otherwise. However, I am saying that reading from the registry is more flexible (and also faster).

-- Bill Stewart [Bill_Stewart]

------------------------------------

Is Server Core (2016) really worth it?

I'm about ready to create two new VMs for a new SQL 2016 AlwaysOn cluster, and I'm weighing the options as to whether or not I should create those VMs using the full Desktop Experience, or Server Core.

I'm not a huge fan of command-line only administration, and I suck at PowerShell, so I would feel much more comfortable with the Desktop Experience. But times are changing, and I'm willing to change with them, if the benefits outweigh the costs. However, I'm not entirely convinced that sacrificing the Desktop Experience I'm so used to is worth it just as yet. From my perspective, it's just going to slow me down, since I'll have to Google damn near every Powershell command I'll ever need to run. Good for me personally in the long run, I'll be learning Powershell, bad for my company, because it'll take me longer to troubleshoot and fix issues.

The primary reason why I'm interested in Server Core at all is the notion of less updates. I know Server Core requires less updates, but I'm less interested in the number of updates required, and more interested in the number of reboots required. Meaning, if I have to only apply 6 updates instead of 10, but I still need to reboot afterward, then I haven't actually gained anything. Especially given the new Windows Update model of only delivering one or two cumulative updates each month. It doesn't really help if I still have to reboot afterward.

What is your opinion of Windows Server Core (specifically 2016 if possible). Does it really result in fewer reboots? Are there other benefits that I'm not seeing?

Reply:

Great question. I'm facing the same pressure in my IT shop.

------------------------------------
Reply:

Given the very unenthusiastic response from this discussion, I'm leaning toward scratching Server Core off the list entirely. If it takes me longer to respond to issues because I'm not a Powershell wizard yet, and I have to apply updates/reboot my Server Core VMs just as often than the Full Desktop Experience VMs, then it really doesn't sound like I'm gaining anything. I'm thinking Nano for Hyper-V hosts (since that does sound like it's worth the effort), and Desktop Experience for everything else.

------------------------------------

Updating SharePoint list with external CSV File

I need to create a sync between an external CSV file with a SharePoint list. I am very limited within a SharePoint environment. I do not have access to the server, therefore, I cannot run Powershell scripts and cannot access Central Admin. Also, External Content Types have been disabled with the environment as well. I have been searching the web for weeks now regarding this matter. Any help/advise would be greatly appreciated!

Reply:

Hi,

If you want to run the script remotely your option will be to use CSOM. You can refer the below link that uses C# Client Side Object Model to upload data from CSV to SharePoint.

https://www.credera.com/blog/technology-insights/microsoft-solutions/using-csom-to-import-csv-files-into-lists-in-office-365sharepoint-online/

Thanks,

Priyan

Please Up Vote and Mark this as Answer if it helps.

------------------------------------

Stolen Computers

I'm a Systems Administrator and we've just had two PC's and two thin clients stolen. I'm trying to nail down when they were taken. The trouble is, I'm new here and the folks that came before me did an absolutely abysmal job on inventory. One stolen PC was powered off and removed from the Domain, so I don't expect to get much help with that. The other was powered on, on the domain and one of four different PC names.

What I'd like to find is a PowerShell command or other tool to give me the most recent uptime for a PC. Whichever of the four went offline over the weekend has got to be the right one. If I can figure out roughly when that machine went offline, it would help with the police investigation, etc. I could swear that there's a number of PowerShell commands that could help here. Might be that PowerShell doesn't help but some other sys admin tool does.

Thanks in advance for the help!

Changed type BonkersTheClown Monday, November 7, 2016 8:16 PM put in wrong

Win10 OSD with Pre-Provisioning and MBAM 2.5 SP1 fails

I'm having problems getting the 'new' Invoke-MBAMClientDeployment.ps1 script to run.

I'm using this article as a starting point:
https://technet.microsoft.com/itpro/mdop/mbam-v25/how-to-enable-bitlocker-by-using-mbam-as-part-of-a-windows-deploymentmbam-25?f=255&MSPPError=-2147217396

In this article it says that you can use the Invoke-MBAMClientDeployment during OS deployment using Config Manager. and that BitLocker Pre-Provisoining is supported.

I'm having difficulty getting this to work. Is what I'm trying to do supported? Has anyone get this to work yet?

The article gives some information around how to set up MDT, but there are very few details around how to specifically set this up for SCCM.

I'm using SCCM Current Branch 1602, deploying Windows 10 x64 1511 using an MDT integrated Task Sequence which also installs MBAM client 2.5 SP1.

To enable BitLocker Pre-Provisioning, I manually set a TS variable: OSDBitlockerMode = TPM

This enables the built in "Pre-Provision BitLocker" step to run and also enables the "IsBDEPreProvisioned" TS variable to True

I now run the SaveWinPETPMOwnerAuth.wsf just before the install of the Config Manager client (and therefore before the machine reboots) As long as the TPM is not owned, this step runs perfectly. I understand this is only necessary if I want to save the TPM password for upload to the MBAM database later on in the TS.

The OS deployment continues into full OS and I install the MBAM client, version 2.5 SP1. Immediateley after this I run the Invoke-MBAMClientDeployment.ps1 as a built in Powershell task using the Bypass execution policy and the following arguments:

-RecoveryServiceEndpoint "https://MBAMserver.domain.com/MBAMRecoveryAndHardwareService/CoreService.svc" -IgnoreEscrowOwnerAuthFailure

At this point the TS fails with:

Device \\?\Volume{109dc59f-0000-0000-0000-401f00000000}\ is already encrypted but not protected. The key protectors will be enabled.
Process completed with exit code 1

See complete log entries below.

If I disable the OSDBitlockerMode TS variable step, so that Pre-Provisioning does not occur, then encyrption succeeds during the Invoke-MBAMClientDeployment script, but with this approach, encryption takes much longer.

Thank you in advance
Phil

----------
BEGIN LOG
----------

!--------------------------------------------------------------------------------------------!
Expand a string: WinPEandFullOS
Executing command line: OSDRunPowerShellScript.exe

Running powershell script: 'C:\_SMSTaskSequence\WDPackage\Scripts\Invoke-MbamClientDeployment.ps1'(PkgID: LG30000C) with execution policy: 'Bypass'
The execution scope for running the powershell script is specified not to verify the signature of the scripts. This is unsafe and potentially risk running malicious scripts.
Sending warning status message
   Setting URL = http://SCCMServer.domain.com, Ports = 80,443, CRL = false
   Setting Server Certificates.
   Setting Authenticator.
Set authenticator in transport
   Setting Media Certificate.
Sending StatusMessage
Setting message signatures.
Setting the authenticator.
CLibSMSMessageWinHttpTransport::Send: URL: SCCMServer.domain.com:80 CCM_POST /ccm_system/request
Request was successful.
Powershell path: C:\Windows\System32\WindowsPowerShell\v1.0\
ResolveSource flags: 0x00000000
SMSTSPersistContent: . The content for package LG30000C will be persisted
The package LG30000C is found locally in the cache C:\_SMSTaskSequence\Packages\LG30000C
Resolved source to 'C:\_SMSTaskSequence\Packages\LG30000C'
Command line for extension .exe is "%1" %*
Set command line: Run Powershell script
Working dir 'C:\_SMSTaskSequence\Packages\LG30000C'
Executing command line: Run Powershell script
Checking prerequisites ...
Preparing TPM and escrowing owner-auth to https://MBAMServer.domain.com/MBAMRecoveryAndHardwareService/CoreService.svc ...
Adding TPM protector to OS volume ...
Escrowing OS volume recovery key to https://MBAMServer.domain.com/MBAMRecoveryAndHardwareService/CoreService.svc and starting encryption ...
Device \\?\Volume{109dc59f-0000-0000-0000-401f00000000}\ is already encrypted but not protected. The key protectors will be enabled.
Process completed with exit code 1
Failed to start encrypting volume
\\?\Volume{109dc59f-0000-0000-0000-401f00000000}\. HRESULT: 0x80070057
At C:\_SMSTaskSequence\WDPackage\Scripts\Invoke-MbamClientDeployment.ps1:856
char:9
+         Throw "Failed to start encrypting volume $DeviceId." + (GetMb ...

--------
END LOG
--------

Edited by Phil - Fujitsu Tuesday, June 28, 2016 12:37 PM

Reply:

Maybe try this:

http://www.kraftkennedy.com/mbam-bitlocker-pre-provisioning-osd/

Edited by Michael-CM Friday, November 4, 2016 9:41 AM

------------------------------------
Reply:

Phil - from my own experience I'm not impressed with the Invoke-MBAMClientDeployment script. Error code 1 is a the norm in most instances from what I have seen.

This thread has quite a bit of chat about it https://social.technet.microsoft.com/Forums/en-US/474f4b4b-6fe9-4fbb-a386-1141032f58f2/mbam-25-sp1-invokembamclientdeploymentps1-always-exits-with-error-code-1-in-a-task-sequence?forum=mdopmbam

Cheers Paul | http://sccmentor.com

------------------------------------
Reply:

Thanks for your reply.

I'm familiar with this post, and I even mention the use of these scripts in my posting, so I'm not clear how that info will help.

If you can give me some more information that would be useful.

Regards, Phil

------------------------------------
Reply:

I raised a call with Microsoft and they coyly said that there is a known problem with this script and pointed me at an older script here:

https://blogs.msdn.microsoft.com/alex_semi/2013/08/12/start-mbam-encryption-on-bitlocker-pre-provisioned-and-windows-to-go-drives

This one works fine. It is an update to the original David Hornbaker script from 2012.

------------------------------------

A stable Azure SDK should not rely on a preview of .net core tooling

https://twitter.com/AzureSupport/status/795477735569137664

Using the 'route print' Command in Windows 7 - Detailed Screen Captures

The 'route print' Command from an Administrative Command Prompt in Windows 7 provides a variety of useful information. Let's take a look at the output of a 'route print' Command to examine how the output data is grouped and to understand its logic.

Let's begin by simply issuing the following command:

route print

An Administrative Command Prompt output shows the following the following sections of the Command Output:

: Figure 1 - Issuing the 'route print' Command from an Administrative Command Prompt in Windows 7

Observing the output of the Command indicates there are 5 Major Sections. The Sections include:

Interface List
IPv4 Route Table
IPv4 Persistent Routes
IPv6 Route Table
IPv6 Persistent Routes

On this Workstation a single Physical Network Interface is visible and has been assigned a DHCP Address of '10.1.1.36'.

The IP Stack for this Workstation is as follows:

IP Address: 10.1.1.36
Subnet Mask: 255.255.255.0
Default Gateway: 10.1.1.1
DNS Server: 10.1.1.1
DHCP Server: 10.1.1.1
DNS Suffix: YYY.YYY.isp-provider.net

Most of the time our focus is upon the IPv4 Routing Table output. Here are the sections of the IPv4 Routing Table output for reference.

: Figure 2 - The IPv4 Route Table output listing the 'all networks' route through the Default Gateway.

The next IPv4 Routing Table entry indicates '10.1.1.36' (the Host Workstation' is a member of the '10.1.1.1/24' Network and would route packets out the '10.1.1.36' Interface.

: Figure 3 - The Workstation Host at '10.1.1.36' is a member of the '10.1.1.0/24' Network Subnet.

The next IPv4 Routing Table entry indicates '10.1.1.36' may receive a Broadcast from the '10.1.1.0/24' Network (as noted by the Subnet Mask of '255.255.255.255').

: Figure 4 - The Workstation Host at '10.1.1.36' can offer a Broadcast on the '10.1.1.0/24 Network' (as noted by the 255.255.255.255 Subnet Mask).

Another IPv4 Routing Table entry focused on Broadcast Addresses is the following. The Host Workstation at '10.1.1.36' may offer Network Broadcasts to the '10.1.1.0/24' Network.

: Figure 5 - The Workstation Host at '10.1.1.36' can receive Network Broadcasts from the '10.1.1.0/24' Network (as noted by the '10.1.1.255' Network Destination).

The next IPv4 Routing Table entries (3 of them) are focused on the Loopback Network Values of '127.0.0.0/8', '127.0.0.1/32' and the Loopback Network Address of '127.255.255.255/32' respectively. These Addresses provide Services to the Local Host (or Loopback Adapter). The Loopback Network Destination of '127.0.0.0' provides access to the Loopback Network through '127.0.0.1' the Loopback IP Address. The Loopback IP Address of '127.0.0.1/32' receives Limited Local Broadcast to the Loopback Network while the Loopback IP Address of '127.255.255.255/32' provides Limited Broadcast to the Loopback Network.

: Figure 6 - The Workstation Host at '10.1.1.36' uses 3 Addresses for Services to the 'Local Host'. All 3 Addresses incorporate the '127.x.x.x' format.

Next the Routing Table includes 2 specific entries for the Multicast Network (224.0.0.0/4) for both the 'Local Host' or Loopback Address of '127.0.0.1' and the Host IP Address of '10.1.1.36' that are '224.0.0.0/4' . These are used for Multicast Network functions.

: Figure 7 - The Workstation Host at '10.1.1.36' includes 2 Multicast Addresses (starting with '240.0.0.0') reserved for use through either the Loopback Address '127.0.0.1' or the Host IP Address '10.1.1.36'.

The last 2 Routing Table entries provides Services through Limited Broadcast Addresses. The Network Destination of '255.255.255.255/32' are the Limited Broadcast Address Ranges for both the Loopback Adapter '127.0.0.1' and the Host IP Address '10.1.1.36'.

: Figure 8 - The Workstation Host at '10.1.1.36' includes 2 Limited Broadcast IP Address Values to Service both the Loopback Network '127.0.0.1' and the Host IP Network '10.1.1.36'.

Finally, upon understanding the sections of the Windows 7 Routing Table there are additional functions available when using the 'route' Command. This Blog entry is focused solely on output from the 'route print' Command.

Summary: In this Blog entry focused on using the 'route print' Command from an Administrative Command Prompt in Windows 7. Each of the defined routes for a Workstation running Windows 7 Enterprise were reviewed for reference.

Lynn Lunik
Chief Security Architect
IT Pro Secure Corporation
and exchangesummit.net
blog <at> itprosecure.com

Reply:

Any chance of this getting updated with pictures fixed?

------------------------------------
Reply:

Pictures are still missing - can someone address this.

------------------------------------
Reply:

I thought, it is my browser issues of not seeing the images.
but as seen on the other comments, this not in my browser case.

Can someone check on this and repost the images if needed?

------------------------------------
Reply:

Please fix this. A comprehensive and correct explanation of routing needs to be maintained.

------------------------------------

Not a problem. Just something I'd like to share ..............

I ran into a strange situation..............

I have 2 laptops.

Laptop A is running Win 10 Home, version 1607 build 14393.351.

Laptop B is running Win 10 Pro Insider build 14959

Been a long time since I last enabled Home Group.
Decided to do it again.
Started with my laptop A > created Home Group > set up what to share > setup Private Network > marked down the password.
Opened Laptop B > Control Panel > Home Group > no option to "join home group" except Create a Home Group.
Double-checked the Time Zone, Time and Date between 2 laptops and they were identical.
Ran the Troubleshoot on laptop A ( I was told to do that on the computer that created the home group). No solution.
Ran Troubleshoot on Laptop B. No solution.
No way to have 2 laptops joined in home group.

Out of curiosity, I removed the home group from Laptop A.
Decided to start over but this time started with Laptop B > created Home Group > setup what to share, etc etc.
Opened laptop A > Control Panel > Home Group > "join home group" option was staring at me.

Now I have the 2 laptops joined in home group.

Why the 1st try using Laptop A failed and 2nd try using Laptop B succeeded ?

I am sharing this experience in case someone is thinking of creating home group.

Edited by david hk129 Saturday, November 5, 2016 2:41 AM
Changed type david hk129 Saturday, November 5, 2016 4:26 AM

Reply:

Home group,as in workgroup.To edit,open my computer/manage network drives.

------------------------------------
Reply:

Hi ,

Thanks for sharing your experience and solution here. I would like to introduce your experience and solution for other community members who have similar issues.

Best regards

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

------------------------------------

SCOM2012R2 - high count of omiagent processes on Linux (>100)

Hi all,

we just upgraded one of our SCOM environments from 2012 SP1 to 2012 R2 UR5. Now I found servers with a high count of omiagent processes and I just wanted to know if that is normal?!

Agent Version: 1.5.1-150 (Labeled_Build - 20150121L) running on Suse Linux Enterprise Server 11 SP2.

scomuser@justaserver:~> ps -ef |grep omi | wc -l  162    scomuser@anotherserver:~> ps -ef |grep omi | wc -l  271    Looks something like this:    scomuser 28725 18387 0 Mar15 ? 00:02:18 /opt/microsoft/scx/bin/omiagent 10 13 --destdir / --providerdir /opt/microsoft/scx/lib --idletimeout 90 --loglevel WARNING  scomuser 29188 18387 0 Mar15 ? 00:02:32 /opt/microsoft/scx/bin/omiagent 10 13 --destdir / --providerdir /opt/microsoft/scx/lib --idletimeout 90 --loglevel WARNING  scomuser 29298 18387 0 Mar14 ? 00:03:14 /opt/microsoft/scx/bin/omiagent 10 13 --destdir / --providerdir /opt/microsoft/scx/lib --idletimeout 90 --loglevel WARNING  ...

Reply:

Typically not normal. What happens if you stop the agent [scxadmin -stop]. Do all omiagents shutdown? If you restart the agent [scxadmin -start] do they all start back up again? Typically you should only see one or two omiagent daemons running at any given time but it is possible the agent is not shutting down properly and leaving instances in a hung state. Do you see any errors in the logs under /var/opt/microsoft/scx/logs?

I'm assuming you did not experience this when you were running SCOM 2012 SP1 correct? When converting the agents from SP1 to R2, did you do an upgrade or a new install of the agent? Just trying to get an idea of how I can repro this.

Thanks,

-Steve

------------------------------------
Reply:

Hi Steve,

after stopping the agent, only the active processes shut down (omiserver and two omiagents). The rest of the hundreds of processes stay in the process list. I have to kill them with "killall /opt/microsoft/scx/bin/omiagent". After starting the agent again, there are again only 3 processes. But I don't know yet for how long, I have to wait and check again.

I deleted all old logfiles now and will check later again if the problem occurs again. What I have seen so far is a lot of log entries in the omiserver.log like this one:

2015/03/16 16:13:28: WARNING: lost connection to agent running as [3733]
2015/03/16 16:28:32: WARNING: lost connection to agent running as [3733]
2015/03/16 16:58:31: WARNING: lost connection to agent running as [3733]

And in the omiagent.root.root.log

2015/03/16 16:13:28: ERROR: Error on read for socket 10: Connection reset by peer
2015/03/16 16:28:32: WARNING: _WriteV - Error on writev for socket 10: Broken pipe
2015/03/16 16:58:31: WARNING: _WriteV - Error on writev for socket 10: Broken pipe

I did not experience this with SCOM 2012 SP1, right. I updated the agents by pushing them through the console. It was not a new install. What I can check is to remove the agent on one of the servers completely and do a new install and see if the problem still occurs.

I will get back to you as soon as I have more information.

------------------------------------
Reply:

Hi,

after removing the RPM package from a server and doing a new install, up to now the problem did not appear again. I watched the behaviour now for about 5-6 hours, everything seems to work fine.

Maybe I can isolate this more...

------------------------------------
Reply:

It most likely has something to do with the upgrade process as SP1 uses the old Open Pegasus agents and R2 is now using the new OMI agents. My guess is something got hung in the upgrade process which caused the omiagent to hang and not exit properly. If you want to try to isolate it that is where I would start as it seems that doing a clean install instead of an upgrade works.

Regards,

-Steve

------------------------------------
Reply:

I've seen the same thing occur, however the frequency of the occurrence makes it hard to know when you resolve it as it can take days/weeks to reoccur. I can confirm this only appears to happen to a small number of servers and all were updated exactly the same way.

omiserver and omiagent logs both point to a break in connectivity like you mentioned

A work around would be simple, put in a process monitor, as up to 4 omiagents appears normal set this to alert at 5. Either have someone respond to the alert, or setup a recovery to ssh in/winrm and fix the issue.

I'm quite keen to hear if you find anything else out.

------------------------------------
Reply:

I have same issue and I'm working with MS for 3 weeks now on this

Looks like there is a bug in the agent and if the output returned back by the unix script/command is bigger than certain size you are seeing more and more omiagent processes.

I will update this thread as soon I have something from MS

------------------------------------
Reply:

Hopefully it takes less time than the support one we had for an issue with open Pegasus and its resource usage, after a couple of months they still had no idea and we finally updated to R2, only to eventually have this issue.

Its clear something is breaking the communication between agent processes, just not what, sadly tracing fills disks to quickly to try and capture this when it occurs

It's nice to know that updating to the latest agent wont resolve the issue. Updating Unix management packs is a pain, but that's another story.

------------------------------------
Reply:

We have verified the initial issues posted is being caused by using commands/scripts in custom monitors that return >64K of data. There is a 64K limit to any instance size handled by OMI, and the command/script invocations return a single instance of output. Thusly, only 64K of data for the total instance are supported, including StdOut+StdErr+ReturnCode. This is a bug in that we should not be leaving a dead omiagent process around when this happens. We intend to fix this bug but it should be noted that we are not planning to change the 64K instance size limit, so while our proposed fix would avoid the issue of numerous omiagent processes, it would not make the command/script monitors or rules functional if they are returning >64K of data.

If you are experiencing this issues, you should dig into your command/script workflows and see what they are returning and reduce the output to <64K.

Regards,

-Steve

------------------------------------
Reply:

Hi Steve,

Are you planning to have a way to customize the 64K limit?

how we will detect if the data is being truncated ?

Thanks,

Marius

------------------------------------
Reply:

And what happens if at most you are returning a single line to SCOM for any monitor/rule where you implement a custom script?

I don't imagine that will ever break 64k, even with an excessively large error message written to stdErr.

This I nice to know for some of the diagnostics I'm looking at implementing but currently we get nothing even remotely that large returned for any custom unix monitors/rules we have put in place as everything is designed for a single value or single line of output being returned only.

Would this also be an issue for winrm calls and values being returned, or is it purely script execution?

------------------------------------
Reply:

The reason I ask about winrm is some of these are quite large i.e. process monitoring on one of the servers that this occurs on returns 249,216 bytes when you enumerate the SCX_UnixProcess provider. If this is also limited I'm going to have lots of problems.

------------------------------------
Reply:

A mi me paso igual, lo que hice fue:

- Dar de baja el servicio de scx-cimd (service scx-cimd stop)

- kill a cada uno de los procesos de omiagent

- Reinciar el servicio de scx-cimd (service scx-cimd start)

- Subir el omiagent (omiagent --loglevel 0)

Con esto, el uso del CPU que estaba al 100% bajo a un 5% aproximadamente.

------------------------------------
Reply:

We have verified the initial issues posted is being caused by using commands/scripts in custom monitors that return >64K of data. There is a 64K limit to any instance size handled by OMI, and the command/script invocations return a single instance of output. Thusly, only 64K of data for the total instance are supported, including StdOut+StdErr+ReturnCode. This is a bug in that we should not be leaving a dead omiagent process around when this happens. We intend to fix this bug but it should be noted that we are not planning to change the 64K instance size limit, so while our proposed fix would avoid the issue of numerous omiagent processes, it would not make the command/script monitors or rules functional if they are returning >64K of data.

If you are experiencing this issues, you should dig into your command/script workflows and see what they are returning and reduce the output to <64K.

Regards,

-Steve

Hi Steve,

Is there any news on this matter?

Thanks

Tommy

------------------------------------
Reply:

I also found the only monitors that exceeded the 64k response were the built in ones, especially the process monitor. All of the ones I create return a one line string at most so don't trigger this limitation (ie all return a lot less than 1k)

Monitoring of processes always seems to be correct, we just seem to have these omiagent processes stall, and only sometimes, there in no guarantee of triggering this issue. To avoid wasted resources we simply monitor for this, otherwise you can get well over 100 of these omiagents hanging around in no time

A simple process monitor with a minimum of 0 and maximum of 5 omiagents will see you good for normal functionality, but alert as soon as you go above the maximum needed from my experience monitoring around 500 unix servers of various OS flavors and functionality

Then either an operator or a recovery task can address the issue (simply pkill the omiagent processes. The server process will create new ones and there seems to be no real negative impact overall. 99% of the time this addresses the issue and you'll see nothing more occur. There are the 1% that may just need time to settle down or further investigation. I had one do this Friday, it kept spawning more processes for 12 hours then simply started to behave again. I was expecting to have to investigate further today.

Regards

Dwayne

Edited by Dwayne Ryder Sunday, November 6, 2016 10:34 PM

------------------------------------
Reply:

Well there was bound to be someone using 2012 pre R2 still in 2015, and maybe even a year on.

The CIM agent is, to put in nicely, rubbish

It will go high cpu at the drop of a hat.

I would recommend updating to 2012R2 minimum so you get the omi provider. While it does give you the odd stray process it wont break your production environment in a matter of seconds.

If you can't upgrade simply nice the cim processes so they cant get more than a few percent of the cpu time at most. In this state you can now monitor for the agent using more than x % and generate monitoring alerts. Without nicing the process it will use so much cpu you cant monitor for its usage.

We had a Microsoft support case open for this just after R2 came out it pushed the business to approve the upgrade to R2, and associated risk, and it was not a smooth upgrade for us.

Given our non trivial environment (i.e. 29 monitoring servers) there were all sorts of things we needed to do to allow for us to upgrade successfully to R2 (builtin hard coded time limits caused the database upgrades to keep rolling back for instance, we had to change from the default maximum to 18 hours. Microsoft just said delete data from your database and did not supply the registry keys needed to allow for this to complete without loss of data, In fact we replicated the SQL cluster and the clean scripts took longer to run than it took us to find this registry key, change it and perform the upgrade successfully. A very disappointing support case.

Regards

Dwayne

------------------------------------

MIM2016 Troubleshooting: MIM Portal Performance Issue

FIM Community Information Center Article

Wiki Page: MIM2016 Troubleshooting: MIM Portal Performance Issue

Go to the FIM Community Information Center

Wim Beck | IS4U FIM/MIM Expert Blog: blog.is4u.be

If you found my post helpful, please give it a Helpful vote. If it answered your question, remember to mark it as an Answer. Thank you!

Changed type Peter GeelenMVP Sunday, November 6, 2016 8:06 PM

Reply:

What's the performance issue? Or are you announcing a wiki article?

Thanks!

Ed Price, Azure Development Customer Program Manager (Blog, Small Basic, Wiki Ninjas, Wiki)

Answer an interesting question? Create a wiki article about it!

------------------------------------
Reply:

Yes, its an announcement for the wiki article. The issue is in the consumption of resources by the Sharepoint Search component.

Wim Beck | IS4U FIM/MIM Expert Blog: blog.is4u.be

If you found my post helpful, please give it a Helpful vote. If it answered your question, remember to mark it as an Answer. Thank you!

------------------------------------

defender will not update

I have an HP laptop with Windows 8.1. Defender used to work but, with all the windows updates I can no longer update defender or use it. Why? Are you forcing me to purchase Mcafee or another of the sort?

Moved by Carey FrischMVP Saturday, November 5, 2016 2:03 AM Relocated to Proper Forum

Reply:

Open Event Viewer.
In the console tree, expand Applications and Services Logs, then Microsoft, then Windows, then Windows Defender.
Double-click on Operational.
In the details pane, view the list of individual events to find your event.
Click the event to see specific details about an event in the lower pane, under the General and Details tabs.

Things to check:

Date or time on your Windows 8 machine are correct.

Run a complete Windows Update then recheck Windows Defender update.

Sometimes incorrect Zone setting in Internet Explorer may be an issue. In that case reset IE to it's default settings.

Also keep in mind , if you are using a Proxy server, Windows Defender will not be able to update.

S.Sengupta, Windows Insider MVP

------------------------------------

Calling all SQL Server Gurus. November readers need feeding!

"An influential teacher, or popular expert"

Oh mighty reader, we need your enlightenment! Only YOU can show us… the TRUE WAY to code!

Win the dedication and adoration of generations to come, by giving something back to those less awesome.

Show your technical prowess, and divine knowledge of your craft.

Teach us good code from bad. Show us the way (or the work-around)

We can offer you the very best platform that you need to preach these good words.

Join us and lead this technical community in a whole new way, into a brighter future!

Become a TechNet Guru and you may find your own life also significantly enriched!

Win awards, interviews, invites, reviews, medals, friends, recognition points, high fives, hugs, smiles, and so much more!

All you have to do is add an article to TechNet Wiki from your own specialist field. Something that fits into one of the categories listed on the submissions page. Copy in your own blog posts, a forum solution, a white paper, or just something you had to solve for your own day's work today.

Drop us some nifty knowledge, or superb snippets, and become MICROSOFT TECHNOLOGY GURU OF THE MONTH!

This is an official Microsoft TechNet recognition, where people such as yourselves can truly get noticed!

HOW TO WIN

1) Please copy over your Microsoft technical solutions and revelations to TechNet Wiki.

2) Add a link to it on THIS WIKI COMPETITION PAGE (so we know you've contributed)

3) Every month, we will highlight your contributions, and select a "Guru of the Month" in each technology.

If you win, we will sing your praises in blogs and forums, similar to the weekly contributor awards. Once "on our radar" and making your mark, you will probably be interviewed for your greatness, and maybe eventually even invited into other inner TechNet/MSDN circles!

Winning this award in your favoured technology will help us learn the active members in each community.

Feel free to ask any questions below.

More about TechNet Guru Awards.

Thanks!

Kamlesh and...

Ed Price, Azure Development Customer Program Manager (Blog, Small Basic, Wiki Ninjas, Wiki)

Answer an interesting question? Create a wiki article about it!

Reply:

Ed, I understand your urgency ... I went to the site for the first time and was surprised to see the Featured Articles were from nearly a year ago ... the good new is ... Underdog is on his WAY!

SOTATS, Inc.

------------------------------------
Reply:

Good point! I was surprised as well - got the same result.

For every expert, there is an equal and opposite expert. - Becker's Law

My blog

My TechNet articles

------------------------------------

Calling all SharPoint Gurus. November readers need feeding!