These are probably well known but as I have not seen them anywhere else I thought I would document them.
WTS
The Windows Terminal Server management pack does not differentiate between servers in Application Mode (real Terminal Servers) and servers in Administration Mode. In MOM you can get a lot of errors that say “TS Failed printer redirection operation” as admins log onto various servers and the print drivers on their PC do not match those on the server. It is annoying. However you would want the error on a real TS server.
When I first saw this my first reaction was to look for the registry key that differentiated the two modes as I assumed MOM did not look for it. Imagine my surprise after searching for this key and then finding it was already being picked up by MOM. And there are two groups already set up for this purpose.
• Microsoft Windows 2000 Terminal Services Servers Application Mode
• Microsoft Windows 2003 Terminal Services Servers Application Mode
The problem is the Rule Group is associated with the generic Terminal Services computer groups as well! Obviously not a well thought out design.
What you need to do is copy and disable the above rule in these two areas
• Microsoft Windows Terminal Services\ Windows 2000 Terminal Services\ Terminal Services Servers\Event Collection
• Microsoft Windows Terminal Services\ Windows 2003 Terminal Services\ Terminal Services Servers\Event Collection
Create a new Custom Rule Group (best to use the same hierarchy that the original rule was in so you know where it came from) and associate with just the Application Mode Rule Groups. Simple to do so it is a shame it is not done out of the box.
NLB
One customer was using NLB and when a server was taken out of the cluster they expected an error in MOM. This did not happen as a server not being in a cluster is deemed normal behaviour. The same is true for MSCS. The rules are there to pick it up it is just that they are set not to generate an alert. The alerts for starting and convergence are also switched off.
Event 6 (source WLBS) – cluster mode stopped
Event 5 (source WLBS) – cluster mode started
Event 28 (source WLBS) – cluster converged
If you want to be alerted when these events happen you need to go into the NLB MP and tick the Alert box for these rules.
