Boe Prox is currently a senior systems administrator with BAE Systems. He has been in the IT industry since 2003, and he has been working with Windows PowerShell<\/a> since 2009. Boe looks to script whatever he can, whenever he can. He is also a moderator on the Hey, Scripting Guy! Forum<\/a>. Check out his current projects published on CodePlex: PoshWSUS<\/a> and PoshPAIG<\/a>. Here’s Boe…<\/p>\n Recently, I was asked to write a script to run against our new SCOM servers that would automate the SCOM agent installation for servers that are being joined to the domain and provide a report on those that successfully installed and also for those that failed to install. This way our SCOM administrators have a report of new systems that are managed by the agents, and they will also have a way to troubleshoot and, if required, manually install the agents on the systems that report failures.<\/p>\n Although I was not completely familiar with SCOM like the SCOM admins are, I do know my way around Windows PowerShell, and I was able to put something together that would meet all of the requirements. So without further ado, let us dive into the script that I wrote, which is also available on the Script Repository: SCOM Agent Installation and Reporting Script<\/a>.<\/p>\n Our goal for this script is to query Active Directory for all servers, query SCOM for all currently monitored servers on the network, and then filter out all of the systems that are in Active Directory so we only have unmanaged servers to work with. We can then attempt to discover those servers (a requirement before we can push an agent installation), filter out failed discoveries so only the successes remain, and finally attempt the installation of the agent on the rest of the servers. Lastly, we need to generate a report that lists Successful Installations<\/b>, Failed Installations<\/b>, and Failed Discoveries<\/b>, and email it to the system administrators. Simple enough with Windows PowerShell!<\/p>\n For this script to run properly and do what we need it to do, we need to make sure that we can connect to Active Directory to gather all of the servers. We also need to ensure that we are running the script from a server that has the SCOM snap-in available. You can find this by running the following command.<\/p>\n Get-PSSnapin –Registered<\/p>\n You should see the following item listed with everything else: Microsoft.EnterpriseManagement.OperationsManager.Client <\/b><\/p>\n This means that the SCOM snap-in is installed, and we can run this script from the server without worrying about it failing.<\/p>\n Let us take a look at the first parts of the script.<\/p>\n $VerbosePreference = ‘continue’<\/p>\n Function Get-Server {<\/p>\n $strCategory = “computer”<\/p>\n $strOS = “Windows*Server*”<\/p>\n $objSearcher = [adsisearcher]””<\/p>\n $objSearcher.Filter = (“(&(objectCategory=$strCategory)(OperatingSystem=$strOS))”)<\/p>\n $objSearcher.pagesize = 10<\/p>\n $objsearcher.sizelimit = 5000<\/p>\n $objSearcher.PropertiesToLoad.Add(“dnshostname”) | Out-Null<\/p>\n $objSearcher.Sort.PropertyName = “dnshostname”<\/p>\n $colResults = $objSearcher.FindAll()<\/p>\n foreach ($objResult in $colResults) {<\/p>\n $objComputer = $objResult.Properties<\/p>\n $objComputer.dnshostname<\/p>\n }<\/p>\n }<\/p>\n Here, I set up the VerbosePreference to “Continue” so I can track what the script is doing and where it is, in case something goes wrong. It is always good to include some sort of verbose\/debug output in your scripts, so that not only you, but whoever uses your script will know what is going on during its use. Using my Get-Server<\/b> function is a quick and simple way to pull a list of servers from Active Directory, and I add the DNSHostName<\/b> attribute that I can use in my comparison later on. I chose the DNSHostName<\/b> attribute because it matches up with the data that I will later receive when performing the SCOM query.<\/p>\n ###User Defined Parameters<\/p>\n Write-Verbose (“[{0}] Reviewing user defined parameters” -f (Get-Date))<\/p>\n #SCOM Management Server<\/p>\n $SCOMMgmtServer = ‘SCOMMGMT.rivendell.com’<\/p>\n #SCOM RMS Server<\/p>\n $SCOMRMS = “SCOMMGMT.rivendell.com”<\/p>\n #Systems to Exempt from SCOM<\/p>\n $Exempt = @(Get-Content Exempt.txt)<\/p>\n $Emailparams = @{<\/p>\n To = ‘boeprox@rivendell.com’<\/p>\n From = ‘SCOMAgentAudit@rivendell.com’<\/p>\n SMTPServer =’Exch.rivendell.com’<\/p>\n Subject = “SCOM Agent Audit”<\/p>\n BodyAsHTML = $True<\/p>\n }<\/p>\n Here I have my “user defined” parameters, where you need to update the existing parameters that match your environment. Listed are places for the SCOM management and RMS server, in addition to an optional exempt parameter in case you have systems that you cannot (for various reasons) have the SCOM agent installed on. If you notice the $EmailParams<\/i> parameter, you will see that it is actually a hash table of several parameters that will be used at the end of this script for an email notification. By the way, this is called “splatting.” Learn it, live it, love it.<\/p>\n #Get list of AD Servers<\/p>\n Write-Verbose (“[{0}] Getting list of servers from Active Directory” -f (Get-Date))<\/p>\n $ADServers = Get-Server | Where {$Exempt -NotContains $_}<\/p>\n <\/p>\n #Initialize SCOM SnapIn<\/p>\n Write-Verbose (“[{0}] Loading SCOM SnapIn” -f (Get-Date))<\/p>\n Add-PSSnapin Microsoft.EnterpriseManagement.OperationsManager.Client -ErrorAction SilentlyContinue<\/p>\n <\/p>\n #Make SCOM Connection<\/p>\n Write-Verbose (“[{0}] Connecting to SCOM RMS Server: {1}” -f (Get-Date),$SCOMRMS)<\/p>\n New-ManagementGroupConnection -ConnectionString $SCOMRMS | Out-Null<\/p>\n <\/p>\n #Connect to SCOM Provider<\/p>\n Write-Verbose (“[{0}] Connecting to SCOM Provider” -f (Get-Date))<\/p>\n Push-Location ‘OperationsManagerMonitoring::’<\/p>\n Write-Verbose (“[{0}] Connecting to SCOM Server: {1}” -f (Get-Date),$SCOMMgmtServer)<\/p>\n $MgmtServer = Get-ManagementServer | Where {$_.Name -eq $SCOMMgmtServer}<\/p>\n <\/p>\n #Get all SCOM Agent Servers<\/p>\n Write-Verbose (“[{0}] Gathering all SCOM managed systems” -f (Get-Date))<\/p>\n $SCOMServers = Get-Agent | Select -Expand NetworkName | Sort<\/p>\n <\/p>\n #Compare list to find servers not in SCOM<\/p>\n Write-Verbose (“[{0}] Filtering out all Non SCOM managed systems to audit” -f (Get-Date))<\/p>\n $NonSCOMTEMP = @(Compare-Object -ReferenceObject $SCOMServers -DifferenceObject $ADServers | Where {<\/p>\n $_.SideIndicator -eq ‘=>’<\/p>\n } | Select -Expand Inputobject)<\/p>\n Now we are starting to perform some actions to get this script rolling. First, I use my little function to grab a list of all of the servers in Active Directory and filter out all of the systems that I listed in my exempt list. The next part loads up the SCOM snap-in so we are able to make use of the SCOM cmdlets. Next, I make the connection to the SCOM management server that was specified earlier in the script. When we have that connection, I switch directories to the “OperationsManagerMonitoring::” provider, which is required to run the commands later in the script. After all of this, I begin my query of SCOM for all servers currently being managed via the SCOM agent, and I use Compare-Object<\/b> to filter out the servers from my Active Directory list that are already listed in SCOM. We now have our list of servers that we need to focus on to install the SCOM agent.<\/p>\n #Attempt to Discover Systems<\/p>\n Write-Verbose (“[{0}] Configuring SCOM discovery prior to use” -f (Get-Date))<\/p>\n $Discover = New-WindowsDiscoveryConfiguration -ComputerName $NonSCOM -PerformVerification -ComputerType “Server”<\/p>\n $Discover.ComputerNameDiscoveryCriteria.getComputernames() | ForEach {Write-Verbose (“{0}: Attempting to discover” -f $_)}<\/p>\n Write-Verbose (“[{0}] Beginning SCOM discovery” -f (Get-Date))<\/p>\n $DiscResults = Start-Discovery -WindowsDiscoveryConfiguration $Discover -ManagementServer $MgmtServer<\/p>\n <\/p>\n #Check Alert history for failed Discoveries<\/p>\n Write-Verbose (“[{0}] Checking for failed Discoveries” -f (Get-Date))<\/p>\n $alerts = @(Get-Alert -Criteria “PrincipalName = ‘$SCOMMgmtServer’ AND MonitoringClassId=’ab4c891f-3359-3fb6-0704-075fbfe36710’`<\/p>\n AND Name=’An error occurred during computer verification from the discovery wizard'”) | Where { <\/p>\n #Look for unresolved alerts<\/p>\n $_.ResolutionState -eq 0<\/p>\n }<\/p>\n Here I am setting up for my attempted discovery of the servers that need the SCOM agent installed. I use my current collection of servers that is supplied to the ComputerName<\/i> parameter for New-WindowsDiscoveryConfiguration<\/b>, which I save to $Discover<\/b>. I then supply this variable to the Start-Discovery<\/b> cmdlet, and save the results of this discovery to $DiscResults<\/b>, which looks something like this:<\/p>\n This can be used later when I prepare to push out the SCOM agent installations.<\/p>\n Now that I went through the discovery process, a check is performed against the SCOM management server by using Get-Alert<\/b>. I supply the principal name of the management server, filter to look only for failed discoveries, and save any results that are found so they can be parsed later and added to a collection for reporting.<\/p>\n If ($Alerts.count -gt 0) {<\/p>\n #Start processing the failed discovery alerts<\/p>\n $alert = $alerts | Select -Expand Parameters<\/p>\n $Pattern = “Machine Name: ((\\w+|\\.)*)\\s”<\/p>\n $FailedDiscover = $alert | ForEach { <\/p>\n $Server = ([regex]::Matches($_,$Pattern))[0].Groups[1].Value<\/p>\n Try {<\/p>\n $ServerIP = ([net.dns]::Resolve($Server).AddressList[0])<\/p>\n } Catch {<\/p>\n $ServerIP = $Null<\/p>\n }<\/p>\n If (-Not ([string]::IsNullOrEmpty($Server))) {<\/p>\n New-Object PSObject -Property @{<\/p>\n Server = $Server<\/p>\n Reason = $_<\/p>\n IP = $ServerIP<\/p>\n }<\/p>\n }<\/p>\n }<\/p>\n <#<\/p>\n Resolve the alerts for failed discoveries, otherwise we will have false positives that there were no failed discoveries.<\/p>\n #><\/p>\n Write-Verbose (“[{0}] Resolving active alerts” -f (Get-Date))<\/p>\n $Alerts | ForEach {<\/p>\n Resolve-Alert -Alert $_ | Out-Null<\/p>\n }<\/p>\n }<\/p>\n If failed discoveries are found in the alert log, the script digs out the Parameters<\/b> property of the $alert<\/b> collection, and the systems will get parsed from the log by using some regular expression magic. Then an attempt to get the IP address will be performed. The expanded Parameters<\/b> property will look similar to this:<\/p>\n Computer verification failure for Machine Name: DC1.Rivendell.com is 0x800706BA. The RPC server is unavailable.<\/i><\/p>\n Any generated reports will be saved to the $FailedDiscover<\/b> variable that will be sent in the email report at the end of the script. After this is done, all of the alerts that are found are resolved by the script.<\/p>\n If ($DiscResults.CustomMonitoringObjects.count -gt 0) {<\/p>\n #Install Agent on Discovered Servers<\/p>\n Write-Verbose (“[{0}] Beginning installation of SCOM Agent on discovered systems” -f (Get-Date))<\/p>\n $DiscResults.custommonitoringobjects | ForEach {Write-Verbose (“{0}: Attempting Agent Installation” -f $_.Name)}<\/p>\n $Results = Install-Agent -ManagementServer $MgmtServer -AgentManagedComputer: $DiscResults.custommonitoringobjects<\/p>\n Now for the installation of the systems that we were able to successfully discover! If you remember, I saved the results of the discovery to the $DiscResults<\/b> variable. Now I am able to use that to supply the collection of systems for the agent installation by using the CustomMonitoringObjects<\/b> property of the $DiscResults<\/b> collection. Note that I have saved the results of this agent installation to $Results<\/b> that will be parsed later in the script, and those results will be included in the email report. <\/p>\n #Check for failed installations<\/p>\n $FailedInstall = @{}<\/p>\n $SuccessInstall = @{}<\/p>\n Write-Verbose (“[{0}] Checking for Failed and Successful installations” -f (Get-Date))<\/p>\n $Results.MonitoringTaskResults | ForEach {<\/p>\n <\/p>\n If (([xml]$_.Output).DataItem.ErrorCode -ne 0) {<\/p>\n #Failed Installation<\/p>\n $FailedInstall[([xml]$_.Output).DataItem.PrincipalName] = `<\/p>\n (([xml]$_.output).DataItem.Description.”#cdata-section” -split “\\s{2,}”)[0]<\/p>\n } Else {<\/p>\n #Successful Installation<\/p>\n $SuccessInstall[([xml]$_.Output).DataItem.PrincipalName] = `<\/p>\n Get-Date ([xml]$_.output).DataItem.Time<\/p>\n }<\/p>\n }<\/p>\n }<\/p>\n And by later in the script, I mean now. I first create two empty hash tables that will hold the successes and failures that are found. The results of the agent installation were first split based on the error code that is in the XML data. From there, if a failure is detected, the code continues to parse the failure message from the XML and place it into the $FailedInstall<\/b> hash table. A failed installation result will look similar to this:<\/p>\n The task will register as a success, so I have to dig into the output XML to pull the actual error code for the agent installation. If it is a successful installation, the system is added to the $SuccessInstall<\/b> hash table, which will be sent in the email report at the end of the script.<\/p>\n $head = @”<\/p>\n <style><\/p>\n TABLE{background-color:LightYellow;border-width: 1px;border-style: solid;border-color: black;border-collapse: collapse;}<\/p>\n TH{border-width: 1px;padding: 5px;border-style: solid;border-color: black;}<\/p>\n TD{border-width: 1px;padding: 5px;border-style: solid;border-color: black;}<\/p>\n <\/style><\/p>\n “@<\/p>\n <\/p>\n If ($SuccessInstall.Count -gt 0) {<\/p>\n Write-Verbose (“[{0}] Adding {1} Successful installations to report” -f (Get-Date), $SuccessInstall.Count)<\/p>\n $html1 = @”<\/p>\n <html><\/p>\n <body><\/p>\n <h5><\/p>\n <font color=’white’><\/p>\n Please view in html!<\/p>\n <\/font><\/p>\n <\/h5><\/p>\n <h2><\/p>\n The following servers were found in Active Directory and had the SCOM Agent successfully installed:<\/p>\n <\/h2><\/p>\n $($SuccessInstall.GetEnumerator() | Select Name, Value | Sort Name | ConvertTo-HTML -head $head)<\/p>\n <\/body><\/p>\n <\/html><\/p>\n “@<\/p>\n } Else {<\/p>\n $html1 = $Null<\/p>\n }<\/p>\n <\/p>\n If ($FailedInstall.Count -gt 0) {<\/p>\n Write-Verbose (“[{0}] Adding {1} Failed installations to report” -f (Get-Date), $FailedInstall.Count,)<\/p>\n $html2 = @”<\/p>\n <html><\/p>\n <body><\/p>\n <h5><\/p>\n <font color=’white’><\/p>\n Please view in html!<\/p>\n <\/font><\/p>\n <\/h5><\/p>\n <h2><\/p>\n The following servers are Active Directory and were discovered, but Failed to install the SCOM Agent:<\/p>\n <\/h2><\/p>\n $($FailedInstall.GetEnumerator() | Select Name,Value | Sort Name | ConvertTo-HTML -head $head)<\/p>\n <\/body><\/p>\n <\/html><\/p>\n “@<\/p>\n } Else {<\/p>\n $html2 = $Null<\/p>\n }<\/p>\n <\/p>\n If ($FailedDiscover.Count -gt 0) {<\/p>\n Write-Verbose (“[{0}] Adding {1} Failed Discoveries to report” –f (Get-Date), $FailedDiscover.Count)<\/p>\n $html3 = @”<\/p>\n <html><\/p>\n <body><\/p>\n <h5><\/p>\n <font color=’white’><\/p>\n Please view in html!<\/p>\n <\/font><\/p>\n <\/h5><\/p>\n <h2><\/p>\n The following servers are Active Directory but Failed to be Discovered by SCOM:<\/p>\n <\/h2><\/p>\n $($FailedDiscover | Sort Server | ConvertTo-HTML -head $head)<\/p>\n <\/body><\/p>\n <\/html><\/p>\n “@<\/p>\n } Else {<\/p>\n $html3 = $Null<\/p>\n }<\/p>\n <\/p>\n If ($html1 -OR $html2 -OR $html3) {<\/p>\n $Emailparams[‘Body’] = “$($Html1,$Html2,$Html3)”<\/p>\n } Else {<\/p>\n $Emailparams[‘Body’] = @”<\/p>\n <html><\/p>\n <body><\/p>\n <h5><\/p>\n <font color=’white’><\/p>\n Please view in html!<\/p>\n <\/font><\/p>\n <\/h5><\/p>\n <h2><\/p>\n All servers in Active Directory are currently being managed by SCOM Agents.<\/p>\n <\/h2><\/p>\n <\/body><\/p>\n <\/html><\/p>\n “@<\/p>\n }<\/p>\n Write-Verbose (“[{0}] Sending Audit report to list of recipients.” -f (Get-Date))<\/p>\n Send-MailMessage @Emailparams<\/p>\n We are now at the end of the script where the data we have collected is compiled into HTML and added to the body of the email. Take note of the @EmailParams<\/b> that is supplied to the Send-MailMessage<\/b> cmdlet. This is “splatting” being used to supply all of the parameters to the cmdlet. Although I am sure that my HTML code could be a little better, it does well enough to provide a nice readable report to review. If there is nothing to report, an email will still go out. This is a reminder that if a report didn’t go out, it should be investigated for possible issues.<\/p>\n Typically, this script is better run as a scheduled job to ensure that any server being brought into the domain receives the SCOM agent. But for this example, I am going to run it to show the verbose output that is generated and to show the email notification showing the HTML body.<\/p>\n The report that is emailed will look something like this, based on the data that was received during the duration of the script.<\/p>\n So there you go…<\/p>\n With a little research and testing against a platform that I was not all that familiar with at the time, I was able to put together a nice script. My script automated the installation of SCOM agents for new servers that were brought into the domain, and provided a report on the installations and failures.<\/p>\n ~Boe<\/p>\n Thank you, Boe, for sharing. As always, it is an interesting and informative blog.<\/p>\n I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n Ed Wilson, Microsoft Scripting Guy<\/b> <\/p>\n","protected":false},"excerpt":{"rendered":" Summary: Guest blogger, Boe Prox, shows how to use Windows PowerShell to automate SCOM agent installations. Microsoft Scripting Guy, Ed Wilson, is here. Last month, guest blogger, Boe Prox, wrote a series of blogs about WSUS. Today he is back to talk about SCOM. Boe Prox is currently a senior systems administrator with BAE Systems. […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[162,56,321,3,45],"class_list":["post-11161","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-boe-prox","tag-guest-blogger","tag-scom-2007-r2","tag-scripting-guy","tag-windows-powershell"],"acf":[],"blog_post_summary":" Summary: Guest blogger, Boe Prox, shows how to use Windows PowerShell to automate SCOM agent installations. Microsoft Scripting Guy, Ed Wilson, is here. Last month, guest blogger, Boe Prox, wrote a series of blogs about WSUS. Today he is back to talk about SCOM. Boe Prox is currently a senior systems administrator with BAE Systems. […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/11161","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=11161"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/11161\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=11161"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=11161"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=11161"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"Photo](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/6180.hsg-2-13-12-1.jpg\" "\\"Photo")
<\/a><\/p>\n
Boe’s blog<\/strong>: Learn PowerShell | Achieve More<\/a><\/p>\nRequirements for script<\/h3>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/2804.hsg-2-13-12-2.jpg\" "\\"Image")
<\/a> <\/p>\nDigging into the script<\/h3>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/6724.hsg-2-13-12-3.jpg\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/4341.hsg-2-13-12-4.jpg\" "\\"Image")
<\/a><\/p>\nScript in action<\/h3>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3240.hsg-2-13-12-5.jpg\" "\\"Image")
<\/a><\/p>\n![\"\"](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/0131.SCOMReport.jpg\")
<\/a><\/p>\n