The All TECHNICAL Blog : DCM Solution

DCM Solution Troubleshooting Steps

Sai Kodi — Fri, 23 Feb 2007 03:09:00 GMT

Here are some troubleshooting steps that you might want to perform for a successful DCM deployment / execution: 1. Install DCM Solution and ensure that all the files were deployed and the DCM Solution database created. 1. Create an SMS package / program...(read more)

DCM File System Data Source Properties

Sai Kodi — Fri, 23 Feb 2007 03:01:00 GMT

Hello, I have got several requests regarding the File System data source properties and what they mean. Hence I decided to post the info in here... Here you go... File System Data Source Properties: Name -> name for the data source Absolute Path ->...(read more)

DCM v 2.0 Download Updated

Sai Kodi — Thu, 26 Oct 2006 17:42:00 GMT

Overview

Microsoft Systems Management Server (SMS) 2003 Desired Configuration Monitoring (DCM) 2.0 now supports configuration monitoring of desktops and servers. The accelerator allows the user to define desired hardware, operating system, and application configuration settings in multiple configuration data sources. Then, using the supplied auditing engine, DCM compares desired settings with actual settings and finally reports configuration compliance.

DCM 2.0 includes a redesigned user interface (UI) to reduce the time needed for defining Configuration Items. The new user interface supports complex rule definition with the Advanced View and adds a wizard-based simplified UI for defining simple rules as the Standard View. The new UI also includes common rule templates and enables users to define common rules specific to their organizations. In addition, CI rules can now be viewed and edited in a table view.

Notes

DCM 2.0 was updated and re-released on October 25, 2006, to address a known issue when parsing complex XPath query expressions generated using DCM 1.0. See the updated Release Notes for more details. If you have experienced any problems with DCM 2.0 rendering query expressions defined in DCM 1.0, I encourage you to download this updated version. Please see the updated Release Notes for more details.

Choose the SMS_DCM2.0_for_DotNet1.1.zip download package if you are using .NET Framework 1.1. Choose the SMS_DCM2.0_for_DotNet2.0.zip download package if you are using .NET Framework 2.0. With either DCM package, you also should download the Configuration_Items.zip and SMS_Reports.zip packages. You can select the files you want to download from the list on this page.

Send questions or feedback to us directly at CISfdbk@microsoft.com.

DCMSolution Database not created during installation

Sai Kodi — Fri, 29 Sep 2006 23:56:00 GMT

There was a known issue in Desired Configuration Monitoring (DCM) Solution Accelerator v 1.0 where the DCMSolution database was not created during installation in specific cases. The issue occurred because the v 1.0 installer retrieved SQL information from a different registry path. However it happens only when the default data / log file locations is altered after SQL Server is installed.

This issue has been fixed in the DCM v 2.0 releases. I am outlining how DCM installer detects the data / log folders for creating the DCMSolution database.

For SQL Server Default Instance:

The DCMSolution installer first retrieves the value of "DefaultData" under the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\MSSQLServer". If it exists and is not blank, it goes with this path. This value is populated if you alter the data / log file locations after the SQL Server was installed.
If the “DefaultData” value is blank, then it gets the value of "SQLPath" under the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSQLServer\Setup". This is the default SQL location that you provide at the time of installing SQL Server.

For SQL Server Named Instance:

The DCMSolution installer first retrieves the value of "DefaultData" under the registry key " HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\<InstanceName>\MSSQLServer". If it exists and is not blank, it goes with this path. This value is populated if you alter the data / log file locations after the SQL Server was installed.
If the DefaultData value is blank, then it gets the value of "SQLPath" under the registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\<InstanceName>\Setup". This is the default SQL location that you provide at the time of installing SQL Server.

The above is true for SQL Server 2000 SP3 and above. If you are facing a problem where the DCMSolution database is not being created at install time, you should check these registry locations and verify that the physical paths pointed to by these registry values exist on the physical server. Let me know if you have further questions.

Thanks,

Sai Kodi

XMLToDCMTransfer DTS package requires 3 mandatory files for proper execution

Sai Kodi — Thu, 28 Sep 2006 09:49:00 GMT

In DCM v 2.0, the functionality of the XMLToDCMTransfer DTS package has been altered. In the current version (v 2.0), the DTS package requires the following three files to be present in the DCM UI folder for successful execution:

DCM.xsd
DCMXMLValidator.exe
<machinename>_Mapping.xml (at least one mapping file is required)

The DCM.xsd and DCMXMLValidator.exe are deployed when the DCM Author component is selected at the time of installation. The mapping file is created when you save a DCM CI using the DCM Authoring Tool.

If you do not have the DCM UI folder and any of these three files in the DCM UI folder (because you did not select DCM Author component during installation), then you should create the DCM UI folder manually and copy the required files to the folder before attempting to execute the XMLToDCMTransfer DTS package.

Feel free to post any appropriate questions.

Thanks,

Sai Kodi

Now Available: SMS 2003 Desired Configuration Monitoring Version 2.0

Sai Kodi — Mon, 18 Sep 2006 17:42:00 GMT

DCM v2.0 automates the configuration management audits between desired or defined configuration settings and actual configuration settings. DCM accomplishes this by allowing the user to define desired hardware, operating system and application configuration settings in multiple configuration data sources and then using the supplied auditing engine, DCM compares desired settings with actual settings and then reports configuration compliance. SMS 2003 Desired Configuration Monitoring (DCM) Version 2.0 now supports configuration monitoring of desktops and servers.

DCM Version 2.0 continues to monitor configuration settings in the Microsoft Active Directory, Window Management Instrumentation (WMI), Metabase, file system, and registry and extends DCM Version 1.0 by adding support for the SQL Server data source, Windows desktop, x64 and .Net Framework 2.0. DCM Version 2.0 also adds predefined baseline Configuration Items for many Microsoft products and customizable SMS web reports.

As a highlight to the solution update, DCM Version 2.0 includes a redesigned user interface (UI) to reduce the time needed for defining Configuration Items. The new user interface supports complex rule definition with the Advanced View and adds a wizard-based simplified UI for defining simple rules as the Standard View. The new UI also includes common rule templates and enables users to define common rules specific to their organizations. In addition, CI rules can now be viewed and edited in a table format. These changes dramatically reduce the time needed to define and edit Configuration Items when using DCM.

Microsoft Systems Management Server (SMS) 2003 Desired Configuration Monitoring (DCM) is a functional extension to SMS 2003 to provide system configuration definition and monitoring functionality. This solution was designed to provide a framework today to begin exploring the power of DCM prior to the release of System Center Configuration Manager (ConfigMgr) 2007. ConfigMgr 2007 will offer a fully integrated and supported implementation of these capabilities.

DCM was developed in collaboration with the Microsoft Operations and Exchange Centers of Excellence and is applied internally at Microsoft. Microsoft IT uses SMS 2003 DCM to monitor Exchange and Windows Core Services (AD, DNS, DHCP, and WINS) configurations. The core set of baseline configurations available with the DCM Version 2.0 solution are intended to help users get started with DCM. Microsoft Services offers a complete implementation service for DCM using configuration management best practices and includes expanded Configuration Items for core Microsoft products. For details about Microsoft Services offerings using DCM, please contact opsleads@microsoft.com.

You can download DCM v 2.0 here: http://go.microsoft.com/fwlink/?LinkId=72132.

New 3rd Party Offerings for DCM

Sai Kodi — Wed, 19 Jul 2006 19:50:00 GMT

Alpha Tech Solutions has recently released training for SMS 2003 DCM and they also offer an automatic rule generator to help create configuration manifests. I have not yet used or tested the rule generator tool, but I have seen the training and it combines useful audio and video instruction across multiple scenarios for using the DCM solution.

Below are quotes from the Alpha Tech Solutions website (http://www.alpha-tech-solutions.com).

1. Desired Configuration Monitoring Training

Alpha Tech Solutions computer based training provides you with in-depth step by step instructions on solutions, concepts and best practices that are supported by Alpha Tech leading edge solutions. …

The SMS 2003 Desired Configuration Monitoring Training will take you though the installation and deployment of the solution and provide you with valuable knowledge on how to create configuration manifests. Included in the training are real world scenarios and samples that you can use for configuration monitoring.

2. ATS Rule Generator

This time saving solution allows you to generate rules for configuration settings in a DCM configuration manifest by capturing them from a given “ideal” machine. The ATS Rule Generator will create configuration rules on the fly for any xml file generated by Microsoft’s Desired Configuration Monitoring Product.

In April, Configuresoft also released “ECM Management Extensions for DCM.”

Below is a quote from the Configuresoft website (http://www.configuresoft.com/Products/dcm.aspx).

Compliance expertise for Microsoft management frameworks

Enterprise Configuration Manager Management Extensions for DCM (ECMMX) allow Microsoft® SMS users to quickly and easily monitor and manage system compliance for both Windows and non-Windows platforms from a familiar interface. Working in partnership with Microsoft to extend the System Center management framework, Configuresoft provides compliance reporting and control for heterogeneous environments. ECMMX seamlessly integrates with existing Windows® server management tools, making extensive compliance information visible and instantly available. ECM prioritizes and continuously validates the state of system compliance via its Compliance Toolkits, which feature rule-based templates, reports and dashboards that plug into ECM.

Sample DCM Manifests Available!

Sai Kodi — Wed, 12 Apr 2006 01:18:00 GMT

Visit http://connect.microsoft.com to register for the DCM Configuration Manifest Beta program! This program has been established to test and validate sample configuration files for Microsoft Internet Security and Acceleration Server 2004, Microsoft Windows Server 2003 and Microsoft Exchange Server 2003. These manifests will help get you started with the DCM solution and save time in creating the initial configuration manifests required to use the DCM solution in your environment. Each manifest can be edited by the DCM authoring tool to meet your specific needs. Visit Microsoft Connect and register today!

To find the program on connect, follow these steps:

Go to connect site, http://connect.microsoft.com/

Sign in using your VALID passport account.
Find the Microsoft SMS 2003 Desired Configuration Monitoring: Configuration Manifest Program in the available programs section.
Then apply to join this program.
After that you should be able to download the package.

Thanks!

Windows Server Deployment Automation Survey

Sai Kodi — Wed, 12 Apr 2006 00:52:00 GMT

The Solutions for Infrastructure and Management team in the Core Infrastructure Solutions group wants to better understand customer needs around installation and configuration for Longhorn server deployment. We would appreciate it if you would complete a short survey on this topic. Your feedback will be a critical factor in the design of the solution. http://connect.microsoft.com

The Role of DTS packages in DCM Solution

Sai Kodi — Tue, 04 Apr 2006 20:59:00 GMT

The Desired Configuration Monitoring Solution Accelerator (DCM Solution) comes with two DTS Packages: SMSToDCMTransfer and XMLToDCMTransfer. The reports are rendered based on data available in the DCMSolution database. The two DTS Packages transfer data from the SMS Database and the XML mapping file respectively to the DCM Solution database.

· SMSToDCMTransfer

The SMSToDCMTransfer DTS package transfers the data from the SMS database to the DCM Solution database. This DTS package is scheduled to run every 8 hours.

· XMLToDCMTransfer

The XMLToDCMTransfer DTS package transfers data from the servername_mapping.xml file to the DCM Solution database. Before running the XMLToDCMTransfer DTS package, the servername_mapping file needs to be copied from the DCM UI folder (where the UI is installed) to the DCM installation folder. Usually the DCM installation folder is c:\Program Files\Microsoft\DCM Solution (unless changed during installation). The servername_mapping.xml file is created in the DCM UI folder. After the xml file is copied to the installation location, XMLToDCMTransfer DTS package can be executed. If the servername_mapping.xml file is not found at the location (installation folder), the DTS package continues execution and does not complain. Whenever DCM Author UI saves a manifest, the manifest details are written to the servername_mapping.xml file located in the DCM UI folder.

Thanks!

Check if a Registry value Exists using the Desired Configuration Monitoring Solution

Sai Kodi — Tue, 21 Mar 2006 08:13:00 GMT

The Desired Configuration Monitoring Solution (DCM Solution) ignores any rules under a Setting if the Setting does not exist. Let us take the case where you are trying to figure out the data of a registry value and do a compliance check on the same. If the registry value does not exist at all, it might be alarming to you. However, the DCM Solution does not warn you if the registry value was missing. But then what happens to the rule you created to check for the registry value? Well, it’s pretty simple. The rule is ignored. The DCM engine has been written in such a way, that it ignores any rules under a Setting if the Setting were not found. This is by design.

So, it is a best practice to always check for the existence of the setting before checking for its compliance. That way, you can be sure that if the registry value was not found, you would be alerted! Now, how do you check for the Existence of a Registry value? That’s a good question! You should have come across a function called Exists in the Query Builder screen while creating an Active Rule under a WMI data source / Setting pair. However, that is completely specific to checking for existence of hot fixes in the WMI. Using that, you cannot check for Registry Value Existence. You would need to create a Count Rule to check for the Existence. This is how you would do it:

Create a Registry data source as follows:

Name: Reg DS

Hive Name: HKEY_LOCAL_MACHINE

Key Name: SOFTWARE\Microsoft\Windows\CurrentVersion

Create a Setting under the Registry data source as follows:

Registry Value: ProductId

Create an Active Rule to check if the Registry Value Exists!

Rule Name: CheckForExistence

Query Expression: count(ProductId)='0' (Click Build Rule Query -> In the Query Builder screen, select the count function from the functions dropdown. In the Expression dropdown, select the setting which is ProductId)

Event Description: The Registry value - ProductID does not exist!

Event ID: 123

Severity: Error

The Rule you created above would alert you if the DCM Engine does not find the Registry value under the specified registry key. All you are trying to do here is get a handle to the registry value. And then check how many handles you got to the registry value. Ideally, if the registry value exists, it should be 1. But if the setting does not exist, it will be 0 and that’s what the Query Expression above enforces.

I have attached a sample manifest here for your reference. Thanks!

Files required to execute the Desired Configuration Monitoring (DCM) Engine

Sai Kodi — Sat, 18 Mar 2006 20:06:00 GMT

The DCM Engine (also called the DCM Command Line Wrapper), DCMCmd.exe, requires the following supporting files for its execution:

· BPA.Common.dll

· BPA.ConfigCollector.dll

· BPA.NetworkCollector.dll

· BPA.UserInterface.DLL

· DCMIssueProcessor.dll

· Utility.DLL

· DCM.MOF

In addition to this, it requires an input configuration file and an output file. If you plan to copy over these files to a machine and execute the DCM engine, be sure to copy all these files. In addition to these files, there is a .bat file (RunDCM.bat) provided. This bat file has the complete syntax of the DCM Command Line Wrapper. You can also choose to execute the DCM Engine using the RunDCM.bat file by supplying the input and output configuration file names. For more information on the syntax / usage of the DCM Engine, please refer to the previously posted article.

Thanks!

Version Control of Manifests used with the Desired Configuration Monitoring Solution

Sai Kodi — Sat, 18 Mar 2006 07:12:00 GMT

It has become a common concern about how to maintain different versions of manifests used with the Desired Configuration Monitoring Solution (DCM Solution). The current version of the DCM Solution does not provide a way to store version numbers within the manifest or report on the version number (in the out of compliance or in compliance reports).

However, there is a workaround which you can probably employ to keep track of your manifests for source control / versioning reasons. After editing a manifest for changes, and saving the same, you can provide the version no as part of the file name itself. For example, instead of naming a manifest ServerRole.xml, name it ServerRole_1-0-1.xml. The next time you edit the manifest, increment the version number appropriately and call the manifest ServerRole_1-0-2.xml. That should help identify the version of a manifest for source control reasons and also will help you figure out which version of a manifest resulted in the out of compliance while viewing reports.

It might also be helpful to see if an earlier version of the manifest was out of compliance but the most recent version is in-compliance while viewing the DCM Reports. This is just a recommended way of tracking your manifest versions which might come in handy and quick to implement. Thanks!

Check if a File Exists using the Desired Configuration Monitoring Solution

Sai Kodi — Fri, 17 Mar 2006 09:22:00 GMT

The Desired Configuration Monitoring Solution (DCM Solution) ignores any rules under a Setting if the Setting does not exist. Let us take the case where you are trying to figure out the version of a file and do a compliance check on the same. If the file does not exist at all, it might be alarming to you. However, the DCM Solution does not warn you if the file was missing. But then what happens to the rule you created to check for the version of the file? Well, pretty simple. The rule is ignored. The DCM engine has been written in such a way, that it ignores any rules under a Setting if the Setting were not found. This is by design.

For more details on this behavior, please refer to this earlier posting.

So, it would be a good idea to always check for the existence of the file in addition to checking for any other properties of the file. That way, you can be sure that if the file was not found, you would be alerted! Now, how do you check for the File Existence? That’s a good question! You should have come across a function called Exists in the Query Builder screen while creating an Active Rule under a WMI data source / Setting pair. However, that is completely specific to checking for existence of hot fixes in the WMI. Using that, you cannot check for File Existence. You would need to create a Count Rule to check for the File Existence. This is how you would do it:

Create a File System data source as follows:

Name: FS DS

Absolute Path: c:\sample.txt

Create a Setting under the File System data source as follows:

File Type: Last Modified Time (select this property from the drop down because it will apply to all kinds of files)

Create an Active Rule to check if the File Exists!

Rule Name: CheckFileExistence

Query Expression: count(LastModifiedTime)='0' (Click Build Rule Query -> In the Query Builder screen, select the count function from the functions dropdown. In the Expression dropdown, select the setting which is LastModifiedTime.)

Event Description: The File Sample.txt does not exist

Event ID: 123

Severity: Error

The Rule you created above would alert you if the DCM Engine does not find the file. All you are trying to do here is get a handle to the file. And then check how many handles you got to the file. Ideally, if the file exists, it should be 1. But if the file does not exist, it will be 0 and that’s what the Query Expression above enforces.

I have attached a sample manifest here for your reference. Thanks!

Now Available - Beta Program for SMS 2003 DCM Configuration Manifests

Sai Kodi — Sat, 18 Feb 2006 04:26:00 GMT

Visit http://connect.microsoft.com to register for the DCM Configuration Manifest Beta program! This program has been established to test and validate sample configuration files for Microsoft Internet Security and Acceleration Server 2004, Microsoft Windows Server 2003 and Microsoft Exchange Server 2003. These manifests will help get you started with the DCM solution and save time in creating the initial configuration manifests required to use the DCM solution in your environment. Each manifest can be edited by the DCM authoring tool to meet your specific needs. Visit Microsoft Connect and register today!