Central concepts[edit]

The basic idea is to place a piece of software, an agent, on the computer to be monitored. The agent watches several sources on that computer, including the Windows Event Log, for specific events or alerts generated by the applications executing on the monitored computer. Upon alert occurrence and detection, the agent forwards the alert to the SCE server. This SCE server application maintains a database that includes a history of alerts. The SCE server applies filtering rules to alerts as they arrive; a rule can trigger some notification to a human, such as an e-mail or a pager message, or trigger some other workflow intended to correct the cause of the alert in an appropriate manner.

SCE uses the term management pack to refer to a set of filtering rules specific to some monitored application. While Microsoft and other software vendors make management packages available for their products, SCE also provides for authoring custom management packs. While an administrator role is needed to install agents, configure monitored computers and create management packs, rights to simply view the list of recent alerts can be given to any valid user account.

It has been a while as I had to find the time to draft this post. In part 2 we will cover basic configuration of SCE2010. As you already know SCE2010 is a combination of several System Center products so there are a fair amount of settings that need to be configured. When you first open up SCE2010 a wizard opens that you use to configure it. Here is the list of what is in the initial configuration:

• Group Policy Settings (Use Local or Domain Group Policy)
• Computer Discovery (A scheduled job that adds new computers to SCE2010.)
• Email Notifications (What email server and account is used to send out notifications.)
• Proxy Server
• Monitoring Configuration
• Error Monitoring and Forwarding
  

  Group Policy Settings

  This gives you two options for Group Policy. You have domain or local. Domain is the recommended option as this will automatically make changes to computers that you add to SCE2010 such as directing computers to use SCE2010 for Windows updates. If you do not have a domain account that has privileges to create objects in the domain group policy then you will have to go with the local option. This will work just fine but changes are made to the local group policy of ever computer that is managed by SCE 2010 rather then pushed down through domain group policy.

  When the SCE 2010 agent is installing on a computer a SCE_ConfigureAgentCertPolicy rule in the System Center Essentials Management Pack runs and configures the machines local group policy settings.)

  Select “Yes” and put in your domain account credentials. Click test to make sure the account has enough privileges to create GPO objects.

  System Center Essentials 2010 (Essentials 2010) is a new management solution in the System Center family of IT systems management products specifically designed for midsized businesses. You can manage up to 50 servers and 500 workstations which make it a great fit for small and medium sized businesses.

  Essentials 2010:

  • Provides a unified solution with a single console for managing a broad range of tasks across your physical and virtual servers, clients, hardware, software, and IT services for a unified experience.
  • Enables you to proactively manage your IT environment, helping keep your system up-to-date with a solution that accelerates problem resolution and enables automation of system updates and data collection.
  • Is easy to deploy and maintain helping simplify complex management tasks for increased IT efficiency.