Rap As A Service For Sharepoint Server: Data Collection Machine Does Not Have Internet Access
Rap As A Service For Sharepoint Server: Data Collection Machine Does Not Have Internet Access
Rap As A Service For Sharepoint Server: Data Collection Machine Does Not Have Internet Access
This document explains the required steps to configure the RAP as a Service for SharePoint Server.
There are two scenarios available to configure the assessment. Determine which scenario fits best for your organization.
1. Data collection machine does not have Internet access
2. Data collection machine has Internet access
The following path shows the relationship between your Windows computers and log analytics after you have installed and
configured the OMS Gateway and data collection machine.
Data collection machine → Collects data from all SharePoint servers in the environment → Forward collected data to the OMS
Gateway → Submit data to the log analytics workspace
Data collection machine → Collects data from all SharePoint servers in the environment → Submit data to the log analytics
workspace.
Detailed information on these configurations and requirements are listed later in this document.
This document was last updated on January 02, 2019. To ensure you have the latest version of this document, check here:
https://www.microsoft.com/en-us/download/details.aspx?id=34698
Table of Contents
System Requirements and Configuration at Glance.......................................................................................... 3
Supported Versions.................................................................................................................................................................................. 3
OMS Gateway (required in the data collection machine does not have Internet access scenario)........................... 3
Supported Versions
• Your SharePoint environment must run on SharePoint Server 2010, SharePoint Server 2013, Microsoft
SharePoint Server 2016 or Microsoft SharePoint Server 2019.
OMS Gateway (required in the data collection machine does not have Internet access
scenario)
• The OMS Gateway can be a standalone or a member server. It requires Windows Server 2012 R2 or later.
• The OMS Gateway must be able to connect to the Internet using HTTPS to submit the collected data to your log
analytics workspace. This connection can be direct, via a proxy.
• OMS Gateway hardware: Minimum 4 GB of RAM and 2 GHz processor.
• OMS Gateway user account rights: None required.
PowerShell on the tools machine is used to scan the servers for installed security patches as well as audit policy
configuration.
• Windows Update Agent must be running on all SharePoint servers for the security update scan
• PowerShell version 2 or greater is required on the SharePoint server and comes installed by default starting with
Windows Server 2008 R2. For Windows Server 2008 SP2, PowerShell version 2 is not installed by default. It is
available for download here https://aka.ms/wmf3download
Additional requirements for Windows Server 2008-2012 R2 (or later if defaults modified) Target Machines:
The following three items must be configured on SharePoint servers to support data collection: PowerShell Remoting,
WinRM service and Listener, and Inbound Allow Firewall Rules.
Note1: Windows Server 2012 R2 and Windows Server 2016 have WinRM and PowerShell remoting enabled by default.
The following configuration steps detailed below will only need to be implemented if the default configuration for target
machines has been altered.
Note 2: Windows Server 2008—Windows Server 2012 have WinRM disabled by default. The following settings will need
to be configured to support PowerShell Remoting:
• Execute Enable-PSRemoting Powershell cmdlet on each target machine within the scope of the
assessment. This one command will configure PS-Remoting, WinRM service and listener, and enable required
Inbound FW rules. A detailed description of everything Enable-PSRemoting does is documented here.
OR
Two steps are involved to configure a group policy to enable both WinRM listener and the required inbound allow firewall
rules:
A) Identify the IP address of the source computer where data collection will occur from.
B) Create a new GPO linked to the SharePoint servers organizational unit, and define an inbound rule for the tools
machine
A.) Log into the chosen data collection machine to identify its current IP address using IPConfig.exe from the command prompt.
Windows IP Configuration
Make a note of the IPv4 address of your machine. The final step in the configuration will use this address to ensure only the data
collection machine can communicate with the Windows Update Agent on the SharePoint servers.
B.) Create, configure, and link a group policy object to the SharePoint servers OU in each domain in the forest.
1. Create a new GPO. Make sure the GPO applies to the SharePoint server’s organizational unit. Give the new group policy a name
based on your group policy naming convention or something that identifies its purpose similar to “SP Assessment”
3. Create an advanced Inbound Firewall Rule to allow all network traffic from the tools machine to the SharePoint servers. This can
be the applied to the same GPO that was used in step 1 above. (Computer Configuration\Policies\Windows Settings\Security
Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security –LDAP:/xxx\Inbound Rules)
4. To create the new rule, Right Click on “Inbound Rules” and select “New”
5. Create a custom rule and choose “Next”
After you have finished the installation of the Microsoft Monitoring Agent/OMS Gateway, and configured PowerShell
Remoting on the target machines, continue with the next section to set up the assessment.
On the data collection machine, change the following setting in the group policy editor (gpedit.msc) from "not
configured" to "enabled":
The appendix has the information how to setup the data collection machine and assessment.
The option changes from Add to View in Azure Log Analytics. You are now all set for the next steps.
Determine the steps to follow to successfully setup the environment for your scenario:
o [Optional] If the server on which the OMS Gateway resides needs to go through a proxy, input the proxy
address where the OMS Gateway needs to connect. For example, myorgname.corp.contoso.com:80. This is
an optional value. If it is blank, the OMS Gateway will try to connect to the Internet directly. Otherwise, the
OMS Gateway will connect through your internal proxy. If your proxy requires authentication, you can
provide a username (domain\user) and password. (NOTE: If you do not provide a domain for the user, it
will not work).
o Click Next.
5. On the Destination Folder page, either retain the default folder location of %ProgramFiles%\OMS Gateway, or
type the location where you want to install, and then click Next.
6. On the Ready to install page, select Install. A User Account Control dialog box might appear requesting
permission to install. If so, click OK.
7. After Setup completes, click Finish. You can verify that the service is running by opening the Services.msc snap-in
and checking the status of the service called OMS Gateway.
8. Download and install the Microsoft Monitoring Agent setup file from log analytics.
Note. It is required to install the Microsoft Monitoring Agent on the OMS Gateway and configure it to with the log
analytics workspace that you configure on the data collection machine. Follow the instructions in the next section
in this document, Data Collection Machine Setup.
Note. If the collection machine does not have an Internet connection, perform the first 3 steps from an Internet
Connected machine.
1. In the Azure portal, go to log analytics, select your workspace and click the Advanced Settings Icon.
3. Click the Download Windows Agent link that is applicable to your computer processor type to download the
setup file. If the agent is downloaded on another machine, copy the Setup file over to the data collection machine
or OMS Gateway server.
Note. If a monitoring client was installed for System Center Operations Manager (SCOM), the setup only offers to
Upgrade the agent, preserving existing settings. The upgrade does not include any of the configuration steps
below.
The next steps apply to installations where no monitoring client was installed for SCOM.
Refer to the Microsoft Monitoring Agent Upgrade section in this document when you are performing an upgrade
of the Monitoring Agent for SCOM.
9. On the Overview, Settings Dashboard page, click Connected Sources, and then copy and paste the Workspace
ID and Workspace Key (Primary Key) from the log analytics portal. (Hint: Click the copy button then paste in the
corresponding Agent Setup field).
Select Azure Commercial or if you are using an Azure US Government cloud select Azure US Government from
the Azure Cloud drop down menu and click OK.
10. If you are currently installing the agent on the data collection machine and using an OMS Gateway as part of the
OMS Gateway and Data Collection Machine scenario, or if your company requires access through a proxy
server, click the Advanced button to provide HTTP proxy configuration. If you do not use any of the above, click
Next and go to step 12.
11. Specify the fully qualified domain name (FQDN) or the IP address and port of the OMS Gateway.
12. On the Microsoft Update page, optionally select Use Microsoft Update when I check for updates
(recommended), then click Next.
13. On the Ready to Install page, review your choices, and then click Install.
14. On the Microsoft Monitoring Agent configuration completed successfully page, click Finish.
15. When complete, the Microsoft Monitoring Agent appears in Control Panel. You can review your configuration
there and verify that the agent is connected to log analytics. When connected to log analytics, the agent displays a
message stating: The Microsoft Monitoring Agent has successfully connected to the log analytics service.
After setting up the data collection machine, continue with the setup of the Assessment as outlined in the prerequisites
and configuration documentation for each technology.
If a monitoring agent is already installed, the Microsoft Monitoring Agent setup will only display the upgrade option. The
upgrade will keep the existing configuration and adds a new option to configure a log analytics workspace.
Follow the steps below to perform an upgrade and configure the agent for the log analytics Workspace.
10. Copy and paste the Workspace ID and Workspace Key (Primary Key) from the log analytics portal. (Hint: Click
the copy button then paste in the corresponding Agent Setup field). Select Azure Commercial or, if you are
using an Azure US Government cloud select Azure US Government from the Azure Cloud drop down menu and
click OK.
11. An exclamation mark will be visible in the Workspaces pane. Click Apply. This will stop and start the agent, and
the Workspaces pane should look like the following example after a few seconds.
12. Click OK to finish the Microsoft Monitoring Agent upgrade for log analytics.
Pre-requisites
The SCOM 2012 SP1 UR6 (UR7 for proxy/gateway support) or SCOM 2012 R2 UR2 (UR3 for proxy/gateway support)
agent is the minimum version required to fully support log analytics functionality.
If you are using multi homing of log analytics workspaces, we would suggest that you not use the agent that comes
with SCOM but use the Microsoft Monitoring Agent from Microsoft Update/log analytics workspace instead. The
current Microsoft Monitoring Agent version is backwards compatible and supported with all SCOM
2012 R2/2016 management groups.
1. On the SCOM Administration Console go to Administration -> Operations Management Suite -> Connection
Back in the SCOM Administration Console you need to opt-in the agents for log analytics/OMS:
3. Select the object type (Windows Computer or Groups) and optionally leave the Filter field empty to return all
objects of the type selected
Microsoft.IntelligencePacks.<technology>.Assessment
The Microsoft Unified Support assessments MPs will be downloaded as soon as the solution is added to the log analytics
workspace. The MPs are downloaded into the Management Pack folder of the agent (this is true regardless of the setup –
direct, through GW, or through SCOM):
You can also look at the OperationsManager event log (it’s the same for the SCOM agent or the stand alone MMA agent)
for the events indicating the MPs have been downloaded:
2. MP is distributed to
agents 1. Add Microsoft
Unified Support
Solution Pack &
solution assessment
Collected data from any agent that is running the scheduled task is sent back to the SCOM Management Server which in
turn will upload to the log analytics/OMS Workspace
Note: the SCOM Management Group might connect directly to the log analytics service or through the OMS Gateway. The
OMS Gateway in the picture above is used for certain solutions that cannot leverage SCOM.
Reference: https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-om-agents
3. Provide the required user account credentials. These credentials are used to run the SharePoint Assessment.
o NOTE: If the ServerName switch was not used in the previous step, you will be prompted to provide the
server name before providing the credentials as per screenshot below.
NOTE: This domain account must have all the following rights:
• Farm Administrator.
• Local Admin rights on All SharePoint & SQL Servers associated with the SharePoint farm being assessed.
• Sysadmin rights on all Instances housing SharePoint databases.
• Unrestricted network access to every SharePoint server in the farm.
4. The script will continue with the necessary configuration. It will create a scheduled task that will trigger the data
collection.
6. During collection and analysis, data is temporarily stored under the WorkingDirectory folder that was configured
during setup, using the following structure:
7. After data collection and analysis is completed on the tools machine, it will be submitted to your log analytics
workspace depending on the scenario you have chosen:
o Directly if the Data Collection Machine is connected to the Internet and configured to submit directly.
Through the OMS Gateway Server if this option is configured, then the data will be submitted to your
log analytics workspace.
8. Data Collection takes approximately 30 minute to 60 minutes.
9. Once Data Collection has been completed it will then be automatically uploaded to your log analytics workspace.
Your assessment results will be available to view on your log analytics dashboard. Click the SharePoint Server
Assessment tile to review:
The SharePoint Assessment in the log analytics workspace and Microsoft Unified Support Solution Pack uses
multiple data collection methods to collect information from your environment. This section describes the methods used
to collect data from your environment. No Microsoft Visual Basic (VB) scripts are used to collect data.
Registry Collectors
Registry keys and values are read from the data collection machine and all servers. They include items such as:
• Service information from HKLM\SYSTEM\CurrentControlSet\Services.
• This allow to analyze the status of Operations Manager services
Windows PowerShell
Collects various information, such as:
• SharePoint Farm information
• SharePoint Content Database Information