Rap As A Service For Sharepoint Server: Data Collection Machine Does Not Have Internet Access
Rap As A Service For Sharepoint Server: Data Collection Machine Does Not Have Internet Access
This document explains the required steps to configure the RAP as a Service for SharePoint Server.
There are two scenarios available to configure the assessment. Determine which scenario fits best for your organization.
    1.     Data collection machine does not have Internet access
    2.     Data collection machine has Internet access
The following path shows the relationship between your Windows computers and log analytics after you have installed and
configured the OMS Gateway and data collection machine.
Data collection machine → Collects data from all SharePoint servers in the environment → Forward collected data to the OMS
Gateway → Submit data to the log analytics workspace
Data collection machine → Collects data from all SharePoint servers in the environment → Submit data to the log analytics
workspace.
Detailed information on these configurations and requirements are listed later in this document.
         This document was last updated on January 02, 2019. To ensure you have the latest version of this document, check here:
                                   https://www.microsoft.com/en-us/download/details.aspx?id=34698
Table of Contents
System Requirements and Configuration at Glance.......................................................................................... 3
Supported Versions.................................................................................................................................................................................. 3
OMS Gateway (required in the data collection machine does not have Internet access scenario)........................... 3
Supported Versions
    •   Your SharePoint environment must run on SharePoint Server 2010, SharePoint Server 2013, Microsoft
        SharePoint Server 2016 or Microsoft SharePoint Server 2019.
OMS Gateway (required in the data collection machine does not have Internet access
scenario)
    •   The OMS Gateway can be a standalone or a member server. It requires Windows Server 2012 R2 or later.
    •   The OMS Gateway must be able to connect to the Internet using HTTPS to submit the collected data to your log
        analytics workspace. This connection can be direct, via a proxy.
    •   OMS Gateway hardware: Minimum 4 GB of RAM and 2 GHz processor.
    •   OMS Gateway user account rights: None required.
PowerShell on the tools machine is used to scan the servers for installed security patches as well as audit policy
configuration.
    •        Windows Update Agent must be running on all SharePoint servers for the security update scan
    •        PowerShell version 2 or greater is required on the SharePoint server and comes installed by default starting with
             Windows Server 2008 R2. For Windows Server 2008 SP2, PowerShell version 2 is not installed by default. It is
             available for download here https://aka.ms/wmf3download
Additional requirements for Windows Server 2008-2012 R2 (or later if defaults modified) Target Machines:
   The following three items must be configured on SharePoint servers to support data collection: PowerShell Remoting,
   WinRM service and Listener, and Inbound Allow Firewall Rules.
   Note1: Windows Server 2012 R2 and Windows Server 2016 have WinRM and PowerShell remoting enabled by default.
   The following configuration steps detailed below will only need to be implemented if the default configuration for target
   machines has been altered.
   Note 2: Windows Server 2008—Windows Server 2012 have WinRM disabled by default. The following settings will need
   to be configured to support PowerShell Remoting:
         •     Execute Enable-PSRemoting Powershell cmdlet on each target machine within the scope of the
               assessment. This one command will configure PS-Remoting, WinRM service and listener, and enable required
               Inbound FW rules. A detailed description of everything Enable-PSRemoting does is documented here.
OR
Two steps are involved to configure a group policy to enable both WinRM listener and the required inbound allow firewall
rules:
A) Identify the IP address of the source computer where data collection will occur from.
         B) Create a new GPO linked to the SharePoint servers organizational unit, and define an inbound rule for the tools
               machine
A.) Log into the chosen data collection machine to identify its current IP address using IPConfig.exe from the command prompt.
Windows IP Configuration
Make a note of the IPv4 address of your machine. The final step in the configuration will use this address to ensure only the data
collection machine can communicate with the Windows Update Agent on the SharePoint servers.
B.) Create, configure, and link a group policy object to the SharePoint servers OU in each domain in the forest.
1.   Create a new GPO. Make sure the GPO applies to the SharePoint server’s organizational unit. Give the new group policy a name
     based on your group policy naming convention or something that identifies its purpose similar to “SP Assessment”
3.   Create an advanced Inbound Firewall Rule to allow all network traffic from the tools machine to the SharePoint servers. This can
     be the applied to the same GPO that was used in step 1 above. (Computer Configuration\Policies\Windows Settings\Security
     Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security –LDAP:/xxx\Inbound Rules)
4.   To create the new rule, Right Click on “Inbound Rules” and select “New”
5.   Create a custom rule and choose “Next”
After you have finished the installation of the Microsoft Monitoring Agent/OMS Gateway, and configured PowerShell
Remoting on the target machines, continue with the next section to set up the assessment.
On the data collection machine, change the following setting in the group policy editor (gpedit.msc) from "not
configured" to "enabled":
The appendix has the information how to setup the data collection machine and assessment.
The option changes from Add to View in Azure Log Analytics. You are now all set for the next steps.
Determine the steps to follow to successfully setup the environment for your scenario:
            o   [Optional] If the server on which the OMS Gateway resides needs to go through a proxy, input the proxy
                address where the OMS Gateway needs to connect. For example, myorgname.corp.contoso.com:80. This is
                an optional value. If it is blank, the OMS Gateway will try to connect to the Internet directly. Otherwise, the
                OMS Gateway will connect through your internal proxy. If your proxy requires authentication, you can
                provide a username (domain\user) and password. (NOTE: If you do not provide a domain for the user, it
                will not work).
            o Click Next.
   5.   On the Destination Folder page, either retain the default folder location of %ProgramFiles%\OMS Gateway, or
        type the location where you want to install, and then click Next.
   6.   On the Ready to install page, select Install. A User Account Control dialog box might appear requesting
        permission to install. If so, click OK.
   7.   After Setup completes, click Finish. You can verify that the service is running by opening the Services.msc snap-in
        and checking the status of the service called OMS Gateway.
   8.   Download and install the Microsoft Monitoring Agent setup file from log analytics.
        Note. It is required to install the Microsoft Monitoring Agent on the OMS Gateway and configure it to with the log
        analytics workspace that you configure on the data collection machine. Follow the instructions in the next section
        in this document, Data Collection Machine Setup.
Note. If the collection machine does not have an Internet connection, perform the first 3 steps from an Internet
Connected machine.
1. In the Azure portal, go to log analytics, select your workspace and click the Advanced Settings Icon.
    3.   Click the Download Windows Agent link that is applicable to your computer processor type to download the
         setup file. If the agent is downloaded on another machine, copy the Setup file over to the data collection machine
         or OMS Gateway server.
         Note. If a monitoring client was installed for System Center Operations Manager (SCOM), the setup only offers to
         Upgrade the agent, preserving existing settings. The upgrade does not include any of the configuration steps
         below.
         The next steps apply to installations where no monitoring client was installed for SCOM.
         Refer to the Microsoft Monitoring Agent Upgrade section in this document when you are performing an upgrade
         of the Monitoring Agent for SCOM.
9.  On the Overview, Settings Dashboard page, click Connected Sources, and then copy and paste the Workspace
    ID and Workspace Key (Primary Key) from the log analytics portal. (Hint: Click the copy button then paste in the
    corresponding Agent Setup field).
    Select Azure Commercial or if you are using an Azure US Government cloud select Azure US Government from
    the Azure Cloud drop down menu and click OK.
10. If you are currently installing the agent on the data collection machine and using an OMS Gateway as part of the
    OMS Gateway and Data Collection Machine scenario, or if your company requires access through a proxy
    server, click the Advanced button to provide HTTP proxy configuration. If you do not use any of the above, click
    Next and go to step 12.
11. Specify the fully qualified domain name (FQDN) or the IP address and port of the OMS Gateway.
12. On the Microsoft Update page, optionally select Use Microsoft Update when I check for updates
    (recommended), then click Next.
13. On the Ready to Install page, review your choices, and then click Install.
14. On the Microsoft Monitoring Agent configuration completed successfully page, click Finish.
15. When complete, the Microsoft Monitoring Agent appears in Control Panel. You can review your configuration
    there and verify that the agent is connected to log analytics. When connected to log analytics, the agent displays a
    message stating: The Microsoft Monitoring Agent has successfully connected to the log analytics service.
After setting up the data collection machine, continue with the setup of the Assessment as outlined in the prerequisites
and configuration documentation for each technology.
If a monitoring agent is already installed, the Microsoft Monitoring Agent setup will only display the upgrade option. The
upgrade will keep the existing configuration and adds a new option to configure a log analytics workspace.
Follow the steps below to perform an upgrade and configure the agent for the log analytics Workspace.
10. Copy and paste the Workspace ID and Workspace Key (Primary Key) from the log analytics portal. (Hint: Click
    the copy button then paste in the corresponding Agent Setup field). Select Azure Commercial or, if you are
    using an Azure US Government cloud select Azure US Government from the Azure Cloud drop down menu and
    click OK.
11. An exclamation mark will be visible in the Workspaces pane. Click Apply. This will stop and start the agent, and
    the Workspaces pane should look like the following example after a few seconds.
12. Click OK to finish the Microsoft Monitoring Agent upgrade for log analytics.
Pre-requisites
  The SCOM 2012 SP1 UR6 (UR7 for proxy/gateway support) or SCOM 2012 R2 UR2 (UR3 for proxy/gateway support)
  agent is the minimum version required to fully support log analytics functionality.
  If you are using multi homing of log analytics workspaces, we would suggest that you not use the agent that comes
  with SCOM but use the Microsoft Monitoring Agent from Microsoft Update/log analytics workspace instead. The
  current Microsoft Monitoring Agent version is backwards compatible and supported with all SCOM
  2012 R2/2016 management groups.
1. On the SCOM Administration Console go to Administration -> Operations Management Suite -> Connection
Back in the SCOM Administration Console you need to opt-in the agents for log analytics/OMS:
3.   Select the object type (Windows Computer or Groups) and optionally leave the Filter field empty to return all
     objects of the type selected
Microsoft.IntelligencePacks.<technology>.Assessment
The Microsoft Unified Support assessments MPs will be downloaded as soon as the solution is added to the log analytics
workspace. The MPs are downloaded into the Management Pack folder of the agent (this is true regardless of the setup –
direct, through GW, or through SCOM):
You can also look at the OperationsManager event log (it’s the same for the SCOM agent or the stand alone MMA agent)
for the events indicating the MPs have been downloaded:
                              2. MP is distributed to
                                      agents                                                1. Add Microsoft
                                                                                            Unified Support
                                                                                            Solution Pack &
                                                                                          solution assessment
    Collected data from any agent that is running the scheduled task is sent back to the SCOM Management Server which in
    turn will upload to the log analytics/OMS Workspace
    Note: the SCOM Management Group might connect directly to the log analytics service or through the OMS Gateway. The
    OMS Gateway in the picture above is used for certain solutions that cannot leverage SCOM.
Reference: https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-om-agents
   3.   Provide the required user account credentials. These credentials are used to run the SharePoint Assessment.
            o NOTE: If the ServerName switch was not used in the previous step, you will be prompted to provide the
                server name before providing the credentials as per screenshot below.
NOTE: This domain account must have all the following rights:
            •   Farm Administrator.
            •   Local Admin rights on All SharePoint & SQL Servers associated with the SharePoint farm being assessed.
            •   Sysadmin rights on all Instances housing SharePoint databases.
            •   Unrestricted network access to every SharePoint server in the farm.
   4.   The script will continue with the necessary configuration. It will create a scheduled task that will trigger the data
        collection.
6.   During collection and analysis, data is temporarily stored under the WorkingDirectory folder that was configured
     during setup, using the following structure:
7.   After data collection and analysis is completed on the tools machine, it will be submitted to your log analytics
     workspace depending on the scenario you have chosen:
         o Directly if the Data Collection Machine is connected to the Internet and configured to submit directly.
             Through the OMS Gateway Server if this option is configured, then the data will be submitted to your
             log analytics workspace.
8.   Data Collection takes approximately 30 minute to 60 minutes.
9.   Once Data Collection has been completed it will then be automatically uploaded to your log analytics workspace.
     Your assessment results will be available to view on your log analytics dashboard. Click the SharePoint Server
     Assessment tile to review:
The SharePoint Assessment in the log analytics workspace and Microsoft Unified Support Solution Pack uses
multiple data collection methods to collect information from your environment. This section describes the methods used
to collect data from your environment. No Microsoft Visual Basic (VB) scripts are used to collect data.
Registry Collectors
Registry keys and values are read from the data collection machine and all servers. They include items such as:
   • Service information from HKLM\SYSTEM\CurrentControlSet\Services.
   • This allow to analyze the status of Operations Manager services
Windows PowerShell
Collects various information, such as:
    • SharePoint Farm information
    • SharePoint Content Database Information