 Unix Privileged Account profile – This Run As profile and its associated UNIX or Linux credentials are used for activities that are protected by a higher level of security and therefore require an account that has higher privileges on the UNIX or Linux computer. This can be (but does not have to be) the root account. You will need to configure these profiles with the appropriate UNIX or Linux computer credentials for the management pack workflows that use them to function correctly. Accounts and Groups Over the lifetime of your Operations Manager deployment, you will potentially need many accounts and security groups. During Operations Manager Setup, you are only prompted for four. You need to consider additional accounts when planning out role-based security assignments, notifications, and alternate credentials to run processes. For guidance on planning role-based security assignments, see . Role-Based Security Accounts and Groups Operations Manager controls access to monitored groups, tasks, views, and administrative functions through the assignment of user accounts to roles. A role in Operations Manager is the combination of a profile type (operator, advanced operator, administrator) and a scope (what data the role has access to). Typically, Active Directory security groups are assigned to roles, and then individual accounts are assigned to those groups. Prior to deploying, plan out Active Directory security groups that can be added to these and any custom-created roles so that you can then add individual user accounts to the security groups. Operations Manager provides the following role definitions out-of-the-box. Role name Profile type Profile description Role scope Operations Manager Administrators: Created at setup; cannot be deleted; must contain one or more global groups Administrator Has full privileges to Operations Manager; no scoping of the Administrator profile is supported Full access to all Operations Manager data, services, administrative, and authoring tools Operations Manager Advanced Operators: Created at globally scoped; cannot be deleted Advanced Operator Has limited change access to Operations Manager configuration; ability to create overrides to rules; monitors for targets or groups of targets within the configured scope Access to all groups, views, and tasks currently present and those imported in the future
Warehouse SQL Server Authentication Account. Instead, create your own account and your own Run As Account and make the Run As Account a member of the Run As Profile, Data Warehouse SQL Server Authentication Account when configuring SQL Server Authentication. The following outlines the relationship of the various account credentials, Run As Accounts, and Run As Profiles for both Windows Integrated Authentication and SQL Server Authentication. Default: Windows Integrated Authentication Run As Profile: Data Warehouse Account Run As Account: Data Warehouse Action Account Credentials: Data Writer Account (specified during setup) Run As Profile: Data Warehouse SQL Server Authentication Account Run As Account: Data Warehouse SQL Server Authentication Account Credentials: Special account created by Operations Manager (do not change) Optional: SQL Server Authentication Run As Profile: Data Warehouse SQL Server Authentication Account Run As Account: A Run As Account you create. Credentials: An account you create. The System Center Data Access Service and Reporting Data Warehouse By default, the System Center Data Access service, which is responsible for reading data from the Reporting data warehouse and making it available in the Report Parameter Area, achieves Windows Integrated Authentication by running as the Data Access Service and Config Service account that was defined during setup of Operations Manager. If the Reporting data warehouse and the management server are separated by a boundary (for example, each resides in different domains with no trust), then Windows Integrated Authentication would not work. To work around this situation, the System Center Data Access service can connect to the Reporting data warehouse using SQL Server Authentication. To do this, create a new Run As Account (of Simple Account type) with the SQL account credential and make it a member of the Run As Profile called Reporting SDK SQL Server Authentication Account with the management server as the target computer. Important By default, the Run As Profile, Reporting SDK SQL Server Authentication Account was assigned a special account through the use of the Run As Account of the same name. Never make any changes to the account that is associated with the Run As Profile, Reporting SDK SQL Server Authentication Account. Instead, create your own account and your own Run As Account, and make the Run As Account a member of the Run As Profile, Reporting SDK SQL Server Authentication Account when configuring SQL Server Authentication.
gateway server 5723 ---> management server Yes (Setup) (Audit Collection Services forwarder) 51909 ---> management server Audit Collection Services collector Yes (Registry) Agentless Exception Monitoring data from client 51906 ---> management server Agentless Exception Monitoring file share Yes (Client Monitoring Wizard) Customer Experience Improvement Program data from client 51907 ---> management server (Customer Experience Improvement Program End) Point Yes (Client Monitoring Wizard) Operations console (reports) 80 ---> SQL Reporting Services No The Operations console uses Port 80 to connect to the SQL Reporting Services web site. Reporting server 1433 ---> Reporting data warehouse Yes management server (Audit Collection Services collector) 1433 ---> Audit Collection Services database Yes How to Configure the Operations Manager Database to Listen on a Specific TCP/IP Port Perform the following steps to configure a static port for the operational database:  Use the SQL Server Configuration Manager to disable dynamic port addressing, specify a static port, disable and stop the SQL Server Browser service, and then restart the SQL Server <Instance> service.  Edit the dbo.MT_ManagementGroup table with the static port number.  Edit the registry to configure the static port number on the management server.
CREATE TABLE #LTHashStrings (MessageStringId UNIQUEIDENTIFIER, LTValueLen INT, LTValueHash VARBINARY(32), MessageId INT NULL) CREATE CLUSTERED INDEX #LTHashStrings_CI ON #LTHashStrings(MessageStringId) CREATE NONCLUSTERED INDEX #LTHashStrings_NCI1 ON #LTHashStrings(LTValueLen, MessageId, LTValueHash) -- Create a temporary table for the orphaned PublisherStrings that you find. Orphaned PublisherStrings -- are rows in PublisherMessages corresponding events have already been groomed. They still -- have corresponding rows in LocalizedText. Do not add rows for PublisherMessages; they are not -- for duplicated messages. CREATE TABLE #OrphanedPublisherStrings (PublisherId UNIQUEIDENTIFIER, MessageStringId UNIQUEIDENTIFIER) CREATE CLUSTERED INDEX #OrphanedPublisherStrings_CI ON #OrphanedPublisherStrings(MessageStringId) -- Create a temporary so that you can determine whether a PublisherMessages row still -- has a corresponding event. These events do not have an index on the PublisherId, so do -- not query the EventAllView. If a PublisherId occurs multiple times in the event tables, -- it is only needed one time in the temp therefore, the unique clustered index -- must contain IGNORE_DUP_KEY. This the temporary table relatively small and saves -- time when you want to see the orphaned PublisherMessages. CREATE TABLE #EventAllPublishers (PublisherId UNIQUEIDENTIFIER) CREATE UNIQUE CLUSTERED INDEX #EventAllPublishers_CI ON #EventAllPublishers (PublisherId) WITH (IGNORE_DUP_KEY = ON)