Here’s a little something-something for the wicked.
Me and my apprentice is currently decommissioning an entire Management Group with a thousand (-ish) agents. Long story short, we got a new Management Group, migrated all the agents, added a couple of hundreds more, deployed a bunch of gateways and now we are shutting down the old one.
Now, uninstalling the old Management Group from all the agents is a breeze using SCCM and handling the few 20-ish servers that are left is not a biggie either. Shutting down ACS, however, is a different matter.
Although you do configure your forwarders using Operations Manager, removing the management group you were running ACS in does not mean the agents will shut down and disable the AdtAgent service or stop trying to forward audit events to your collector. Now, selecting 10 agents at the time and running the “Disable Audit Collection” task–in case you did not know, there’s a limitation on how many agents you can run a task on in the Operations Console–is not my idea of a jolly good day and since Powershell is a bucket of joy in comparison; here’s a script for you all!
It is zipped to avoid security alerts, but as with any script found on the internet I implore to to read the code before actually running it.
Anyway, you can use it in a couple of ways.
To run it interactively, just go to the directory where you unpacked it and run it. You will be requested to enter the FQDN of you Root Management Server and a wildcard search for ACS Forwarders.
For example:
PS C:\..\Scripts> .\DisableACSForwarders.ps1 Root Management Server: rms.teknoglot.local ACS Forwarder name (wildcard): *.teknoglot.local
You can also run it with parameters (for scheduling?) like this:
PS C:\..\Scripts> .\DisableACSForwarders.ps1 rms.teknoglot.local *.teknoglot.local
If you need to run the task with different credentials there’s a switch for that. Just add -UseCredentials to the command and you will be prompted for it.
Like this:
PS C:\..\Scripts> .\DisableACSForwarders.ps1 -UseCredentials
As you might already have realized, the wildcard search does not require actual wildcards. If you only want to disable the ACS forwarder on a single machine, just enter it’s FQDN. As for what wildcards it will accept; anything supported by the powershell -like operator is valid.
[UPDATE!] You might get false failures when running the script on clustered machines because of a bug in the AC Management Pack
For the source code, read on!