[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-283610-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-283610-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","monitoring-untrusted-servers-using-operations-manager-certificate-based-authentication-setup","Monitoring untrusted servers using Operations Manager - Certificate-based authentication setup","","Step-by-step setup for monitoring servers and clients outside an Active Directory environment using Microsoft Operations Manager. The guide focuses on configuring certificate-based agent authentication when Kerberos is not feasible across DMZ workgroup machines or unrelated AD domains. It covers prerequisites and core tasks: network port checks, downloading and importing the trusted root CA certificate, creating and requesting certificates, importing them into SCOM, manually installing agents, and approving agents. Port requirements include TCP 5723 and 5724.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/monitoring-untrusted-servers-using-operations-manager-certificate-based-authentication-setup/283610/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/monitoring-untrusted-servers-using-operations-manager-certificate-based-authentication-setup/283610.png","ImageObject",442,249,{"name":42,"@type":43},"Mack Lee","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-11-04","2026-09-17",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",22,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"Why use certificate-based authentication for untrusted servers in Operations Manager?","Question",{"text":63,"@type":64},"Because servers and clients located outside Operations Manager’s native Active Directory domain cannot reliably use Kerberos, so certificate authentication is configured using an internal or third-party Certificate Authority.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"Which TCP ports must be available for SCOM agent communication?",{"text":68,"@type":64},"The SCOM agent uses TCP ports 5723 and 5724 (both ways) to communicate with the root management server. Connectivity can be tested from the agent server using Telnet to the management server and port.",{"name":70,"@type":61,"acceptedAnswer":71},"What are the main steps to install the Trusted Root (CA) certificate?",{"text":72,"@type":64},"Download the CA certificate chain from the Certificate Authority portal, save it locally, then import it into the Trusted Root Certification Authorities store using MMC and the Certificate Import Wizard on the target RMS/MS/Gateway or DMZ/untrusted domain servers.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},283610,1791720369,{"code":4,"msg":82,"data":83},"success",[84,88,93,98,103,108,113,118,123],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":86,"slug":87},11,90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":125,"show_sort_weight":4,"slug":126},158,"General","general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":85,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":111,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":94},1236954509970,"https://us-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","Step-by-step installation guide for monitoring untrusted servers using Operations Manager  \nMost of the time through Operations Manager, you may require to monitor servers and clients that are located outside of the Active Directory environment. These servers and clients may be located in the DMZ as workgroup machines, or maybe you have a number of completely different Active Directory domains and forests that have no relation with each other but need to be monitored by a central Operation Monitor implementation.  \nThe Operations Manager agents support two types of authentication method, Kerberos or certificate based authentication. In order to monitor servers and clients located outside the Operations Manager’s native Active Directory domain, you will need to configure certificate authentication using either an internal Certificate Authority or through a 3rd party Certificate Authority.  \nFollowing are the high-level overview of tasks involved in monitoring servers and clients located outside Active Directory domain.  \n􀁸 Check communication port availability  \n􀁸 Download the Trusted Root (CA) certificate  \n􀁸 Import the Trusted Root (CA) certificate  \n􀁸 Create a certificate template  \n􀁸 Request a certificate from the enterprise CA  \n􀁸 Import the certificate into SCOM  \n􀁸 Manual installation of agents and importing the SCOM certificate to the servers to be monitored  \n􀁸 Approve agents in SCOM console  \nAgent communication port availability:  \nThe SCOM agent uses TCP Ports 5723 and 5724 (both ways) to communicate with root management server.  \nTo test the port access between agent server and root management server, you may Log on to the agent server and from command prompt, type Telnet \u003CManagement Server> 5723  \nIf you get a cursor at the top left corner then the port is open, any other errors indicate that the port is still closed.  \nAuthor: Jayachandran PK  [http://pkjayan.wordpress.com](http://pkjayan.wordpress.com)  \nDownload the Trusted Root (CA) Certificate:  \nThe trusted root certificate must be installed on the RMS, MS, Gateway server or  \nDMZ/untrusted domain servers. To download the trusted root certificate, Log on to the computer where you want to install a certificate and connect to the Certificate Enrolment URL on the certificate Authority Server. For example, [http://](http://)\u003CCAservername>/certsrv  \nIn case the server in DMZ or untrusted domain cannot reach the certificate Authority Server, you may download the Root (CA) Certificate to any server which has access to the Certificate Enrolment URL on the certificate Authority Server. Then copy the certificate using removable media and imports the same to desired server in DMZ or untrusted domain.  \nOn the Welcome page, click Download a CA Certificate, certificate chain, or CRL.  \nOn the Download a CA Certificate, Certificate Chain, or CRL page, under Encoding method, click Base 64, and then click Download CA certificate chain.  \nAuthor: Jayachandran PK  [http://pkjayan.wordpress.com](http://pkjayan.wordpress.com)  \nIn the File Download dialog box, click Save  \nThen save the certificate with a relevant name such as ‘rootcert’ to the C:\\ drive of your computer.  \nAuthor: Jayachandran PK  [http://pkjayan.wordpress.com](http://pkjayan.wordpress.com)  \nWhen the download has finished, close Internet Explorer.  \nImport the Trusted Root (CA) certificate:  \nLogon to the server (RMS, MS, Gateway server or DMZ/untrusted domain servers), click Start, and then click Run. In the Run dialog box, type mmc, and then click OK.  \nAuthor: Jayachandran PK  [http://pkjayan.wordpress.com](http://pkjayan.wordpress.com)  \nIn the Console1 window, click File, and then click Add/Remove Snap-in.  \nIn the Add or Remove Snap-in dialog box, under the available snap-ins, select Certificates, and then click Add.  \nAuthor: Jayachandran PK  [http://pkjayan.wordpress.com](http://pkjayan.wordpress.com)  \nIn the Certificates snap-in dialog box, select Computer account, and then click Next.  \nIn the Sele","cbCaioGktDrt5WsC","https://ap.wps.com/l/cbCaioGktDrt5WsC","pdf",3630509,"English","# Overview\n## High-level tasks\n## Agent communication port availability\n# Trusted Root (CA) certificate\n## Download the CA certificate\n## Import the trusted root CA certificate\n# SCOM certificate and agent setup\n## Create certificate template\n## Request certificate and import into SCOM\n## Install agents and approve in SCOM console","[{\"question\":\"Why use certificate-based authentication for untrusted servers in Operations Manager?\",\"answer\":\"Because servers and clients located outside Operations Manager’s native Active Directory domain cannot reliably use Kerberos, so certificate authentication is configured using an internal or third-party Certificate Authority.\"},{\"question\":\"Which TCP ports must be available for SCOM agent communication?\",\"answer\":\"The SCOM agent uses TCP ports 5723 and 5724 (both ways) to communicate with the root management server. Connectivity can be tested from the agent server using Telnet to the management server and port.\"},{\"question\":\"What are the main steps to install the Trusted Root (CA) certificate?\",\"answer\":\"Download the CA certificate chain from the Certificate Authority portal, save it locally, then import it into the Trusted Root Certification Authorities store using MMC and the Certificate Import Wizard on the target RMS/MS/Gateway or DMZ/untrusted domain servers.\"}]","Monitoring untrusted servers using Operations Manager - Certificate-based authentication setup | PDF",1789614183]