So I’ve got a little SCOM 2012 lab. One DC, two database servers, four management servers, one Exchange 2010 and one soon to be SharePoint 2010 server.
The summary of what I was experiencing was that when I configured AD integration using the wizard in the SCOM console, nothing was populated into AD even an hour later, and no manually installed agents are automatically assigned as a result, even after properly using the Mom AD Admin EXE to prepare active directory.
The end result was the client can’t find a policy in AD as shown below.
Event 2011: The Health Service did not find any policy in Active Directory
In active directory users and computers, none of my management servers were populating underneath the Operations Management \ Mario, and each of them should have their own corresponding containers and AD groups if all is working properly.
I tried several things with no luck:
- Verifying I had properly run the MOMADAdmin.exe with the proper switches: MOMADAdmin.exe <ManagementGroupName> <MOMAdminSecurityGroup> < RunAsAccount> <Domain>
- Completely loosening permissions on the OperationsManager container and child objects (Sidebar: NEVER EVER DO THIS, read this article to see why)
- Selecting a different runas account and profile ensure full domain admin rights
- Restarting client agents, servers and DCs
- Verified my LDAP inclusion query was valid by using Active Directory Users and Computers advanced search
- Telling my laptop “You look fat compared to the new macbooks” to hurt its feelings.
None of the above worked. After letting it bake overnight, a call with Microsoft the following morning and a refresh of ADUC indeed verified that you should plan on waiting at least 24 hours for that to be updated in AD with 2012, a change from 1 hour since 2007. When I came in the next morning, everything was working as shown below. You can look for the operations manager event 11470 on the management servers to verify successful publishing to AD.
Here are some good articles on AD integration with SCOM as a bonus. Hooray for bonuses!
AD Integration Considerations– My quick summary of this article is: don’t use AD integration unless you’re really sure you need to. Why not just use the command line if you’re going to bake it into your base images? Really the only time you need this is if you have multiple separate management groups in the same large domain.
Integrating Active Directory and Operations Manager
Understanding How AD Integration Works with OpsMgr 2007