PKI Certificate Management Pack Update V1.0.1.15

After having had very helpful feedback by various users, I was able to incorporate some enhancement requests for the PKI Certificate Management Pack.

Version will deal correctly specific certificates that have somewhat unusual ‘Issued to’ and ‘Issued By’ properties. Furthermore it will only monitor CA certificates if they haven’t been superseded. Download from You need to register but registration is free.

Changes in version
  • Improved discovery of Issued to and Issued by properties: Will use Subject Alternative Name if certificate doesn’t have a subject and will correctly extract the subject if CN= isn’t encountered on the first line of the subject string.
  • Additional certificate property: CA Version (based on extension szOID_CERTSRV_CA_VERSION). If this property holds a value, that certificate is a Windows CA one.
  • Does no longer discover superseded CA certificates. Evaluation is based on the CA Version property. Additional override to change that behavior if required.
  • Monitors will not mark superseded CA certificates as expired if their discovery is enabled.
  • Expose script timeout as an overridable parameter
  • Changed alert priority to ‘Low’.
  • Broke upgrade path to avoid potential agent stale issues when upgrading from V or earlier.

Please study the included release notes and the MP guide carefully, especially when you’re planning to update from a previous version. I did deliberately break upgrade compatibility after some users had reported stale agent conditions during test cycles. You will need to remove any previous version of the MP from your Management Group before importing the latest one.

Geeky background information

The issues after upgrades were caused by moving the overridable timing parameters from the certificate object workflows to the parent certificate store’s properties. This left already discovered certificate objects’ workflows without any timing information until their parents were re-discovered and got their default timing properties added. During my own test all the agents recovered after that and re-enabled the certificate workflows.

Other users had less luck and ended up with a partly stale agent population that could only be corrected by removing the MP from the Management Group. To avoid issues I simply decided to break the upgrade path and force everyone upgrading to remove the previous MP. Breaking was easy by the way. It only took altering the caption of a property on a public class.

I do apologize for having to make go through the process of removing the MP (and it’s override MPs) before being able to upgrade. On the other hand I wouldn’t want anyone to experience stale agent conditions due to that.

Lesson learned: There are indeed rare conditions under which an MP author may write an upgradeable MP that would pass MPVerify and will import without complaints but still causing upgrade issues on the Management Group. Watch out for those! Test, test, test – then test once more.


SQL Server DB Mirroring MP Update

When I published the original release of the SQL Server DB Mirroring Management Pack, I promised that I would provide support for SQL Server 2005 if demand justified the effort. I am almost certain that you have an idea of what follows now: The latest version of the MP does support mirrored databases on SQL Server 2005, SQL Server 2008 and SQL Server 2008 R2.

All improvements over the first release include:

  • SQL Server 2005 database mirror supported
  • tested compatibility with SQL MP 6.1.314.36 (SQL 2008 R2 support)
  • timing improvements in script workflows
  • allow mirror group display name to be configured via Desired Configuration XML file
  • fix alert parameter replacement failures seen occasionally after initial discovery
  • an override pack to make discovery faster in non production environments only

Before importing this management pack I strongly encourage you to carefully read the guide contained in the download. Some features will only work when all prerequisites have been met!

Get the SQL Server DB Mirroring MP from (Version


This update wouldn’t have been possible without the assistance of Dirk Decher who has kindly provided an extended testing environment and taken the time to share his ideas around DB mirroring monitoring with me. And last but not least: I was thrilled to learn that this MP has won the gold medal at the System Center Influencers Program Management Pack Extension Contest 2010. Some of you guys know how much effort goes into writing an MP. A reward like that makes up for some of those many late and wee hours spent tracking down that XPath failure. Do check out the other participant’s entries as well. Some true gems are amongst them.


SQL Server DB Mirroring Management Pack

My latest addition to the community MP catalog augments the SQL Server MP with database mirroring discovery and monitoring. The SQL Server DB Mirroring Management Pack helps you by:

  • discovering db mirror roles and objects on SQL 2008 DB engines
  • automatically creating service components per mirrored database (consider them mini DADs)
  • probe based monitoring of the mirrored DB state with alerting should the mirror no longer run synchronized or loose its witness
  • optionally checking the mirror mode and db roles against a Desired Configuration setting (alerts when the mirror roles are swapped etc.)
  • delivering mirror inventory and availability reports


DB Mirroring Relationships and Health Roll Up

The Management Pack comes with a comprehensive guide which is a must read. The pack will only work as expected if some prerequisites are met. The guide also discusses how to enable Desired Configuration monitoring for your DB mirrors.

 Get the SQL Server DB Mirroring MP from (Version

The download also contains an override MP for the SQL Server Extension MP published on OpsMgr Jam. The extension MP already features useful event and performance collection rules that help monitoring an SQL DB mirror but as it does not contain any discoveries, they are targeting any SQL server. My override MP helps by adjusting their targeting so that those rules are only active on SQL Engines that host mirrored DBs.

2010 Management Pack Extension Contest

South Africa 2010 is about to take off and even on planet SCOM we currently have a great tournament:

The System Center Influencers program has sponsored the Management Pack Extension Contest. Entered Management Packs should extend one of the product’s pack with

  • reporting
  • diagram or service level
  • Visio or Dashboard
  • by tuning it

My own MP does certainly extend the SQL Server Management Pack and it does fit more or less into three of the contest categories. The deadline for entries is June 30, 2010. So why don’t you upload your own entries to compete with me?

Updates to Management Packs

It has been quiet on this blog for a long time. With the community efforts luckily having rapidly picked up grounds, there is much less newly discovered to write about. As I rather not repost knowledge found by other folks, I haven’t had much to place up here lately.

However; I do greatly appreciate feedback, especially on my published Management Packs. Knowing what needs and headaches other OpsMgr users have, gives me a chance to improve the packs. So there are updates for the following MPs:

Adobe Flash Media Server

Version works with FMS 3.5 and OpsMgr 2007 R2. Download from this blog.

PKI Certificate Validation

Version allows improved customization of monitoring frequencies and now contains an example MP that shows how additional certificate stores may be discovered. Download from

Untrusted Active Directory Domain Discovery

Version of that extension Management Pack is compatible with the current product MP 6.0.7065.0. Download from this blog.

PKI Certificate Verification Management Pack

PKI certificates are used to provide SSL encryption for web sites, to secure cross-server traffic (for example to join security gateways or agents in untrusted domains on OpsMgr), to guarantee the identity of the sender of a message and so on. What all certificates have in common is that their destiny often means to be forgotten after having been requested and installed. Until a certificate becomes invalid that was vital to a service. Mostly because it has expired.

To avoid service interruptions or embarrassment due to SSL warning messages displayed to users, the PKI Certificate Verification Management Pack was born. It discovers certificates and certificate revocation lists stored locally on computers and alerts you when:

  – a certificate’s lifetime is about to expire (by default 21 days in advance)
  – a certificate’s lifetime has ended
  – a certificate has become invalid because of a different reason
  – a CRL has not been updated in a timely manner

The MP also includes a series of inventory reports, which help keeping up with all those certificates in your environment. You will find more details in the comprehensive MP guide.


Certificate Verification Screen Shot

The MP and the guide are available for download at the site:

Download from MP Catalog

I wrote the MP in close collaboration with Pete Zerger and Jaime Correia of the SCC community. Without their help and the support of everyone testing the MP, it wouldn’t be here today.

MP Creation Zen

And there’s more! For everyone interested in learning how to author MPs: Have a look at the 6 part series MP Creation Zen. The articles will walk you through the process of writing an MP, carefully clarifying everything you need to know. Whenever possible, all authoring examples are explained using the new and much improved OpsMgr 2007 R2 Authoring Console, telling you how the PKI Certificate Verification MP was written. I recommend the documents to everyone planning to write a Management Pack by themselves without being application developers.

Minor update to the Scheduled Task MP (Version

August 12, 2014 – link to latest update:…pack-1-2-0-500/ ‎


I have just uploaded an update to the Scheduled Task Management Pack. Under certain circumstances the discovery of Windows 2003 tasks failed. The new version fixes the bug in the discovery script.

I do recommend everyone who is currently using version to upgrade to Simply download the new version here and update the management pack by importing

Many thanks to Aengus and Mark for making me aware of this bug.

Windows Scheduled Task MP now supports localized OS

Having thought about enabling the Scheduled Task Management Pack for non English operating system versions for some time, I finally found the time to update it. The new release (Version works with the following OS languages:

OS Languages Remarks
Windows Server 2008 any .
Windows Server 2003 English,
discovery will not work on other languages


The update is available here: Scheduled Task Management Pack understands 7 languages.

The reason why only 7 languages are currently supported on Server 2003 is that in order to discover and manage the tasks, the output of the ‘schtasks.exe’ command needs to be parsed. That output unfortunately varies between different languages. I decided to include support for those languages I have at least a basic knowledge of (very basic for 3 of them). If you need other languages to be added let me know.

Like a little language quiz? Here’s what Scheduled Tasks are called on other OS languages. Can you tell which expression is in what language?

tareas programadas / geplande taken / operazione pianificata / tâche planifiée  / tarefas agendadas / geplante Tasks

On Windows Server 2008 parsing ‘schtasks.exe’ is not required as Microsoft has included COM object with the OS that allows managing the tasks using scripts and that is language independent.

Many thanks to Romain Girot who’s helped a lot by testing the localization support accurately and patiently.