Migrating Management Packs When Upgrading SCOM

Management Packs contain the actual monitoring (the workflows themselves) as well as extend the SCOM platforms functionality and are critical to getting your new SCOM Management Group up and running.

The good news is most of SCOM Management Packs that worked with SCOM 2012 R2 work right through to SCOM 2019, so you are safe to import them into your new Management Group. However, we always recommend checking compatibility with the vendor/author of the Management Pack before importing into your new group.

There are some wrinkles to be aware of….

There are two types of MP, sealed and unsealed. Sealed MPs have been signed by their creator and cannot be modified without unsealing them, but if you unseal an MP, it cannot be depended on by other MPs (e.g. the Hyper-V Discovery and Monitoring MPs depend on workflows in the Hyper-V Library MP. If the Hyper-V Library MP where to be unsealed, Hyper-V Discovery and Monitoring MPs would report they were missing their dependant library MP). So, for these reasons unsealing MPs is not recommended.

This is important in the upgrade case as you want to ensure sealed MPs remain sealed, so they continue to work in your new Management Group.

Unsealed MPs can be exported from your old Management Group using the below PowerShell. MPs exported will, in general, be safe to import into your new Management Group (though we recommend you check with the MPs author first).

Get-SCOMManagementPack | where {$_.Sealed -eq $False} | Export-SCOMManagementpack -Path "C:\Management Packs\Unsealed"

Sealed MPs when exported become unsealed, and so it is required that you get sealed MPs from their source (their author/vendor) rather than exporting them from your old Management Group. We give the PowerShell to export sealed MPs for completeness only.

Get-SCOMManagementPack | where {$_.Sealed -eq $True} | Export-SCOMManagementpack -Path "C:\Management Packs\Sealed"

RunAs Accounts

Run as accounts are annoyingly essential to SCOMs operation, authenticating you to other bits of infrastructure. When setting up your new Management Group, you may start by scrolling through the list of accounts in your old Management Group and find usernames/passwords that you are missing passwords for or simply don't know what they are used for.

Ruben Zimmerman has helpfully pulled together some PowerShell scripts to allow you to export/import RunAsAccounts (including a way to decrypt their passwords!) which wraps up some work from Stefan Roth (who in turn wraps some work from Richard Warren -  a delicious PowerShell Kinder egg of RunAs account treats).

Have a read of his guide here (about 1/3 of the way through the article) on how you do this with PowerShell.

Need more advice on your SCOM Upgrade?

If you found this information useful you may want to check out the other blogs in our SCOM Upgrade series:

Navigating the Challenges and Choices of Upgrading SCOM
Alert Tuning for Your Upgraded SCOM Environment