SCSM Orchestrator – Get Object – Active Directory User/Group – Use Powershell for ObjectGUID Instead

Ran into an issue this week where a previous employee returned to our company and our Orchestrator Local Admin runbook was failing on their account. Troubleshooting showed the Get Object activity was grabbing two distinct ObjectGUIDs. Using powershell, while AD returned only one ObjectGUID. Digging into SCSM’s database, it turns out there were two entries for the AD account in the [MT_System$Domain$User]. Found the old entry in the table and removed it (after a backup) based on the old employeeID and we’re all good.

When I started using Orchestrator in 2011, I hadn’t adopted a powershell-first philosophy I have now. I used that little Get Object runbook activity, which I thought was querying our AD domain.

It doesn’t. It appears to query the SCSM database table [MT_System$Domain$User]. Sigh.

I’m changing it to use Powershell and grab the current AD ObjectGUID for the SCSM Service Request relationship.

DS

Posted in Uncategorized | Leave a comment

System Center 2016 Orchestrator (SCOrch) Runbook Server Instability

TL;DR

Inconsistent and failing SCOrch runbook performance due to old Application deployment runbooks stuck in Run mode.

  1. Look for odd Opalis errors (see below) is the SCSM log (C:\ProgramData\Microsoft System Center 2012\Orchestrator\RunbookService.exe\Logs)
  2. Run Orchestrator Health Checker (https://www.petri.com/use-orchestrator-health-checker-troubleshoot-runbooks) to find out what runbooks are monitoring (Run Mode)
  3. Validate the runbooks in Run Mode to ensure they are still working.

We found some old Application runbooks set to Run Mode (monitoring). Turning those off significantly improved our system stability and eliminated the Opalis error.

Background

SCOrch is an integral part of our IT Automation. Employee provisioning, privileged account system access (Local Admin), and Change Management are a few standardized processes the company depends on each day. Unfortunately, we spend time re-running or correcting random, unexplainable incomplete runbook processes or failures. Despite our best efforts, we’ve been unable to fix this completely, until today.

Using While the Orchestrator Health Checker (https://www.petri.com/use-orchestrator-health-checker-troubleshoot-runbooks) to optimize our SCOrch environment, we noted a number of failed unrecognized runbooks. Reviewing our Orchestrator log (C:\ProgramData\Microsoft System Center 2012\Orchestrator\RunbookService.exe\Logs), we also found this error repeating almost every minute.

2018-01-21 06:56:25 [37108] 1 Exception caught in long __stdcall WorkflowContextComAdapter::GetCounterValue(unsigned long,wchar_t *,wchar_t *,struct tagVARIANT *,wchar_t **)

WorkflowContextComAdapter.cpp(756):

<Exception>

<Type>Opalis::Exception</Type>

<Location>

void __cdecl StorageCallExecutor::throwChained(const class Opalis::Exception &)

StorageCallExecutor.cpp(42)

</Location>

<MsgCode>SCE: ActionServerStorage call failed</MsgCode>

<Prev><Exception>

<Type>Opalis::Exception</Type>

<Location>

struct std::pair<class _variant_t,bool> __thiscall ResourceValueExtractor::getValue(const class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > &) const

ResourceValueExtractor.cpp(32)

</Location>

<MsgCode>Invalid pointer</MsgCode>

<Params>

<Param>typeNode</Param>

</Params>

</Exception></Prev>

</Exception>

Digging further into some of the unrecognized runbooks, a previously installed Application Approval Workflow showed some of the enabled runbooks (running). Note the large green “play” arrow showing that the runbook is in monitor mode (running).

Figure 1 – Location of Application Approval Workflow Runbooks

Figure 2 – Some of the Runbooks in Monitor mode (running)

 

Simply turning off these runbooks eliminate the error and stabilized our environment.

 

DS

Posted in Uncategorized | Leave a comment

Microsoft Office Excel ActiveX Fix

 

As planned, Microsoft released a security patch for an Office ActiveX vulnerability on 12/9/2015. Any dated (and I mean code as old as 10-years) Excel VBA macros with ActiveX controls no longer work post-patching. Here are some links if you need to understand more:

Official Microsoft Excel Blog

Frankly, the ideal way to repair this issue is to replace the underlying vulnerable ActiveX VBA code.

Where that isn’t practical, the following fix works for Excel 2007 and Excel 2010, but you need a working unpatched machine to start.

Working directory – C:\Users\%Username%\AppData\Local\Temp

Folder and files to copy –

C:\Users\%Username%\AppData\Local\Temp\Excel8.0

C:\Users\%Username%\AppData\Local\Temp\VBE

Copy and replace the working folders to the broken machine and the macros should start working again.

Each of the directories above contain uncorrupted *.exd files. The issue is resolved when you replace the corrupted files on the broken PC.

Email me if you need a working copy of the files.

Still digging into Excel 2013…

 

DS

Posted in Uncategorized | Leave a comment

Surface Pro 3 Powers Off when Plugged In – Power Cord Issue – Two Outlet Power Brick

Surface Pro 3 – Hard system fault although connected  to wall outlet, power light is on, and battery sufficiently charged.

When powering on a Surface Pro 3, immediately after log on, the system would completely shut off. It’s plugged in (power light on at the connector) and checking the power icon, it shows that the system is correctly plugged in and charging.

It isn’t.

The power supply for all Surface Pro devices is a two part plug that, if not completely connected at the power brick, will cause the device to randomly power off, even if the battery is charged.

Surface Pro Two Piece Power Supply

Microsoft Surface Pro 3 Power Supply – Unassembled

Ensuring the wall-outlet cord is completely connected will correct this issue. Also, make sure you have all of the firmware updates.

Bad connection leads to a short

Make sure the wall outlet cord is completely connected to the power brick.

DS

Posted in Configuration, Microsoft | Tagged | Leave a comment

Manually Checking For Windows Updates in an SCCM-Controlled Environment

Windows 8.1 – When using the Control Panel Windows Update “Check for Updates” button, the system returns “No Updates are Available.” Subsequently using the hyperlink “Check online for updates from Microsoft Update” shows numerous updates are available.

One of my roles as IT Operations Manager is Desktop support. I conduct post-deployment “spot checks” of deployed Windows 8.1 PCs and discovered that we were missing some critical Windows updates. While we use SCCM 2012 to manage our patch deployments, missing Office 2013 patches leads to numerous Excel issues for our users. Why?

  1. Our SCCM doesn’t check for Office Updates
  2. Check for updates only checks the local PC’s update folder.
  3. The update doesn’t check for other Windows products
Check for Updates

Control Panel’s Check for Windows Updates

When I click the “Check for Updates” button

Your Windows is up to Date

Post-Button Notification

 

Click on “Check Settings” on the left hand side and check the box the “Give me updates for other Microsoft products…”

Give me other updates too!

Check the box that states “Give me updates for other Microsoft products…”

After clicking the “Check online for updates from Microsoft Update”

Updates are available

Numerous updates available online

The “Check for Updates” button checks the local PC’s update folder and doesn’t see any new Windows updates. This is expected behavior since an SCCM GPO turns this off. Manually checking online grabs the latest updates. I’ve also modified our SCCM patching routine to check for all Microsoft products. This is going to be a bear during the first run, but after that we’ll obtain all of the latest hotfixes, patches, et al. Risk? Hardly, since Microsoft and the whole community does such a great job of catching issues before we deploy to our user base. We also deploy to three test groups over three-weeks before final deployment.

DS

Posted in Change Management, Configuration, Microsoft | Tagged , , | 2 Comments

System Center 2012 (SCSM) Orchestrator – “Cannot resolve display name…”

 

Every now and then, when working in Orchestrator, I inadvertently enter the wrong field value in an Update Object step.

Search results for the error have a lot of recommendations to check the language settings for Orchestrator. What I found is that you’ve probably entered an invalid list value in the field.

 

 

Notice how the Sequence ID and Status are set to 4. In my first attempt, I had selected Status instead of the correct Sequence ID.

Since “4” is not a selection from our Status drop-down list, the runbook would error with the “Cannot resolve display name (Displayname 2) to name.”

Correcting the field value with an acceptable selection or data value will resolve the issue.

 

DS

 

Posted in Uncategorized | Leave a comment

Cireson Outlook Console Add-In for Service Manager 2012 Review


For those busy IT Managers who don’t have enough time to read the full blog article…

If you use SCSM 2012, purchase the Cireson Outlook Add-In. It’s one of the best third-party add-ons I’ve found to help with the day-to-day management of work items. Watch their video to see why. This is a true “killer” app.

Read on for the reasons why I like it so much on my Windows 8.1 Office 2013 32-bit desktop.

Face it, the Microsoft-based workforce lives and breathes in their Outlook client during day-to-day work. Any time we need to leave Outlook, it slows down our productivity. Cireson appears to have solved this problem for my Help Desk team. Now they can manage work items right from their inbox.

Some of the great things about this add-in:

  • It’s faster than the both the native SCSM 2012 portal and thick client. Not just a little faster, but “smoking fast” faster.
  • Installation takes minutes and setup is painless.
  • Allows you to manage your email inbox like a ticket queue. You can assign, create, or manage work items.
  • Supremely more intuitive than the native forms within the SCSM console.
  • Required fields within SCSM work item forms are much easier to recognize.

While the product is awesome, it’s not perfect, but these minor issues don’t distract from the overall awesome awesomeness.

  • Doesn’t like Office 2013 64-bit. I’m working with Cireson on a solution.
  • I still can’t teleport using the product. Very disappointing.

Features I’d love to see down the road (other than teleporting):

  • Ability to “Right Click” via the console.
  • Keep the “My Active Workitems” sort order after closing

Now for some way cool screen shots…

Figure 1 – All of the options when you right click on an email

Figure 2 – Here’s the Ribbon Bar options for Create

Figure 3 – The Ribbon Bar Edit Features

Figure 4 – What you get when you Edit – Really like the ability to just list incidents assigned to me

Figure 5 – Create Incident Form – Note the bold red boxes and the Tasks selection at the top left corner. No right task pane required to RESOLVE an incident.

Drop me a line in the comments if you have any questions.

DS

Posted in SCSM 2012, Uncategorized | Tagged , , | 2 Comments