Error after upgrading Orchestrator to 2012 R2

After upgrading from System Center Orchestrator 2012 sp1 to 2012 R2, my Runbooks weren’t running via my scheduled tasks.  After some digging, I figured out that I couldn’t open the Orchestration Console, because I kept getting this error:

Error executing the current operation.
[HttpWebRequest_WebException_RemoteServer]
Arguments: NotFound
Debugging resource strings are unavailable. Often the key and arguments provide sufficient information to diagnose the problem. See http://go.microsoft.com/fwlink/?linkid=106663&Version=5.1.20913.0&File=System.Windows.dll&Key=HttpWebRequest_WebException_RemoteServer

I did some research, but couldn’t figure it out, and there was a particular Runbook that I needed to have run every night.  So I opened a ticket with Microsoft.  In order to save you the trouble, if you come across this issue, here is the solution:

1. Enable detailed logging for the connection attempt.

Create a folder to store the log file: C:\Logs in this sample:

    initializeData="C:\logs\SRV_Traces.svclog" />

Edit the Web.Config file located in the following default location:

C:\Program Files (x86)\Microsoft System Center 2012 R2\Orchestrator\Web Service\Orchestrator2012

======================

Part1 add the following just below section <configuration>

<system.diagnostics>

    <sources>

      <source name="System.ServiceModel"

              switchValue="Information, ActivityTracing"

              propagateActivity="true" >

        <listeners>

          <add name="xml"/>

        </listeners>

      </source>

      <source name="System.ServiceModel.MessageLogging">

        <listeners>

          <add name="xml"/>

        </listeners>

      </source>

    </sources>

    <sharedListeners>

      <add name="xml"

           type="System.Diagnostics.XmlWriterTraceListener"

                 initializeData="C:\logs\SRV_Traces.svclog" />

    </sharedListeners>

</system.diagnostics>

==============

Part2 added into the  section: <system.serviceModel>

<diagnostics wmiProviderEnabled="true">

      <messageLogging

           logEntireMessage="true"

           logMalformedMessages="true"

           logMessagesAtServiceLevel="true"

           logMessagesAtTransportLevel="true"

           maxMessagesToLog="3000"

       />

</diagnostics>

2. Perform an IISRestart and test connecting to the Orchestration console to generate the error.

3. Stop the IIS Site and view the resulting log file.

4. Opening the log file using: SvcTraceViewer.exe make it much easier to parse.

You can get it either by installing (a non-express version of) Visual Studio, or by installing the (free) Windows SDKs

(http://www.microsoft.com/downloads/details.aspx?FamilyID=E6E1C3DF-A74F-4207-8586-711EBE331CDC&displaylang=en)

5. Drilling into the XML data for the "Handling an Exception" entry and locating the inner exception we found the following:

System.Data.SqlClient.SqlException: The EXECUTE permission was denied on the object ‘GetSecurityToken’, database ‘<SCO DB Name>’, schema ‘Microsoft.SystemCenter.Orchestrator’.

It appears that in uninstalling/reinstalling the Web Console the needed permissions were not updated in SQL.

6. To address this issue we ran a SQL script that was contained in the following MSI

%localappdata%\Microsoft System Center 2012\Orchestrator\Microsoft.SystemCenter.Orchestrator.ManagementServer.msi"

From the *.SQL located the file:  Microsoft.SystemCenter.Orchestrator.Roles.SQL

Using the text from this file, we created a new query to run  against the Orchestrator database to reapply the permission grant operations.

The key was step 6.  The security evidently didn’t get setup correctly on the update, and needed to be fixed manually.