Monitoring Nondomain Member Considerations

DMZ, workgroup, and nontrusted domain agents require special configuration, such as certificates to establish mutual authentication. Operations Manager 2007 requires mutual authentication; that is, the server authenticates to the client and the client authenticates to the server to ensure that the monitoring communications are not hacked. Without mutual authentication, a hacker can execute a man-in-the-middle attack and impersonate either the client or the server. Thus, mutual authentication is a security measure designed to protect clients, servers, and sensitive Active Directory domain information, which is exposed to potential hacking attempts by the all-powerful management infrastructure. However, OpsMgr relies on Active Directory Kerberos for mutual authentication, which is not available to nondomain members.

In the absence of Active Directory, trusts, and Kerberos, OpsMgr 2007 R2 can use X.509 certificates to establish the mutual authentication. These can be issued by any PKI, such as Microsoft Windows Server 2008 Enterprise CA.

Installing agents on Edge Component servers is discussed later in the chapter in the “Installing Edge Component Monitoring Certificates” section.