Sponsors, article continues below...

Alert: Logon Failures – Multiple failures by same User on single Machine
Severity: 2
Source: ADS04.Domain.pvt
Path: ADS04.Domain.pvt
Last modified by: System
Last modified time: 9/22/2011 11:47:49 AM

Alert description: Multiple Logon Failures by user DOMAIN\user01 with logon type 0xffffffffc0000225. See Alert Context for more details.

Alert view link: “http://RMS01:51908/default.aspx?DisplayMode=Pivot&AlertID=%7bdbe48f98-2051-4d83-aecb-664a07c0eb46%7d”
Notification subscription ID generating this message: {BB47B5DE-176C-524C-FC13-2C8576C7000E}

Now that you have the subscription ID, you can use PowerShell to obtain the name of the alert via the subscription ID. This script will also show you who is subscribed to each notification subscription. NOTE: Be sure you load the SCOM PowerShell modules first!:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

######################################################################
## Usage: SCOMSubscriptions.ps1  #####################################
## Author: Stephen Leuthold (http://blogmynog.com) ###################
## Created: 9/22/2010 ################################################
## Modified: 12/5/2010 ###############################################
## Purpose: Obtain list of alert notifications and subscribers #######
######################################################################
 
$subs = get-notificationsubscription | Select-object Id,DisplayName,ToRecipients 
$out = ""
[system.array]$report = $null
foreach($sub in $subs) {
                $recipients = $sub.ToRecipients | %{$_.Name}
                foreach ($recipient in $recipients) {
                                $out = New-Object PSObject
                                $out | Add-Member -membertype noteproperty -Name Id -Value $($sub.Id)
                                $out | Add-Member -membertype noteproperty -Name Name -Value $($sub.DisplayName)
                                $out | Add-Member -membertype noteproperty -Name Recipient -Value $($recipient)
                                $report = $report + $out               }
 
} 
$report | export-csv c:\temp\SCOM_AlertSubscriptions.csv

Sponsors, article continues below...

1. First you want to ensure that the intended account(s) can successfully access the intended Live Maps dashboards.
2. Ensure that your RMS has SPN’s (Service Principal Names) registered for your SDK service account. In the following example RMSSERVER is my RMS SERVER, DOMAIN and domain.local are my domain, and SDKaccount01 is my SCOM SDK service account.
   • Check if your SPN’s are registered by running the following:
     setspn -L RMSSERVER\sdkaccount01
     It should tell you that the SPN is regered under MSOMSdkSvc/RMSSERVER and MSOMSdkSvc/RMSSERVER.domain.local. If it’s registered for your RMS server’s hostname and FQDN proceed to step 3.
   • If it is not registered for the RMS server’s hostname and FQDN, register it!
     setspn -a MSOMSdkSvc/RMSSERVER DOMAIN\SDKaccount01
     setspn -a MSOMSdkSvc/RMSSERVER.domain.local DOMAIN\SDKaccount01
3. Verify your domain function level in AD Domains and Trusts (2003 or 2008…same solution works for 2008 R2).
4. Verify “Account is sensitive and cannot be delegated” is NOT checked on the SCOM SDK service account in AD. You can see this option under the Account tab.
   • Configure constrained delegation.
   • Locate the Live Maps’ server computer object in AD, go to its properties and select the Delegation tab.
   • For Windows 2003 (also look at Kevin’s reference to hotfix issues):
     Select “Trust this computer for delegation to specified services only” and “Use Kerberos only”.
     Click the Add button and add the SCOM SDK service (in my case sdkaccount01). The “Add Services” box should show MSOMSdkSvc, click OK on all remaining windows.
   • For Windows 2008 and 2008 R2:
     Select “Trust this computer for delegation to any service (Kerberos only).
     Click OK on all remaining windows.
5. If you haven’t already, enable Windows authentication for Live Maps on your Live Maps server.
   • Open Internet Information Services (IIS) Manager and go to the Live Maps site.
   • Open Authentication.
   • Enable “Windows Authentication” and disable “Forms Authentication”.

Hopefully this works for you as it did for me. Good luck!

1) First step is to get a list of the machines to be rebooted into a CSV.

2) Fire up a PowerShell with a domain account that has local admin rights on the target machines.

3) Set the header if you did not put a header in the CSV file.

1

$header = "server"

4) Set $servers equal to an array of server names to be rebooted.

1

$servers = import-csv c:\path\to\ServersToReboot.csv -header $header

5) Issue reboots using a foreach loop.

1
2
3
4
5
6
7
8
9
10
11
12
13

foreach($i in $servers) {
     Write-Host "Attempting to reboot:" $i.server "..."
 
     $serverObj = gwmi Win32_operatingsystem -computer $i.server
 
     $status = $serverObj.reboot()
 
     if ($status.ReturnValue = "0") {
          Write-Host "Reboot successful."
     } else {
          Write-Host "Reboot failed. Check permissions."
     }
}

Here is an example of all the code together:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

$header = "server"
 
$servers = import-csv c:\path\to\ServersToReboot.csv -header $header
 
foreach($i in $servers) {
     Write-Host "Attempting to reboot:" $i.server "..."
 
     $serverObj = gwmi Win32_operatingsystem -computer $i.server
 
     $status = $serverObj.reboot()
 
     if ($status.ReturnValue = "0") {
          Write-Host "Reboot successful."
     } else {
          Write-Host "Reboot failed. Check permissions."
     }
}

Piece of cake!

This issue can occur on Windows 2008 since the NT Kernel Logger trace is already running in Performance and Reliability monitor.

C:\Program Files\Microsoft Windows Performance Toolkit>xperf.exe -on DiagEasy
xperf: error: NT Kernel Logger: Cannot create a file when that file already exis
ts. (0xb7).

The problem is you cannot stop the NT Kernel Logger trace when the Trace Session->Stream mode is set to Real Time in the NT Kernel Logger Event Trace Sessions’ properties. Switch it to File and then you will be able to stop it. You can then utilize xperf to run kernel traces. Be sure to switch it back to the way it was when you are done!

A great blog post I came across that goes into more detail is located here: http://greatit.wordpress.com/2009/08/17/high-interrupt-cpu-time-troubleshooting-with-xperf/

Sponsors, article continues below...

Log Name: Operations Manager
Source: Health Service Modules
Date: 10/25/2010 5:08:33 PM
Event ID: 11852
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Computer: RMS01.domain.pvt
Description:
OleDb Module encountered a failure 0×80004005 during execution and will post it as output data item. Unspecified error
: [DBNETLIB][ConnectionOpen (Invalid Instance()).]Invalid connection.

Workflow name: Microsoft.SystemCenter.SqlBrokerAvailabilityMonitor
Instance name: RMS01.domain.pvt
Instance ID: {A851F280-FDAE-C8B0-79EC-FF7F12070A65}
Management group: NA

Log Name: Operations Manager
Source: Health Service Script
Date: 10/25/2010 5:39:13 PM
Event ID: 100
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: RMS01.domain.pvt
Description:
PartitioningAndGroomingMonitor.vbs : Script executed with Error Number: -2147467259 Error Details: [DBNETLIB][ConnectionOpen (Invalid Instance()).]Invalid connection.

Log Name: Operations Manager
Source: Health Service Script
Date: 10/25/2010 5:39:13 PM
Event ID: 100
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: RMS01.domain.pvt
Description:
DetectDuplicateRelAgnToSrvMonitor.vbs : Script executed with Error Number: -2147467259 Error Details: [DBNETLIB][ConnectionOpen (Invalid Instance()).]Invalid connection.

It turns out I was required to specify the instance name along with the SQL server name in two locations after performing the DB migration. The TechNet documentation specifies it in one area but neglects to mention it for another.

1) Add SQLSERVER\SQLINSTANCE to registry string value DatabaseServerName under key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Operations Manager\3.0\Setup\DatabaseServerName.

2) Add SQLSERVER\SQLINSTANCE to column name SQLServerName_6B1D1BE8_EBB4_B425_08DC_2385C5930B04 in table dbo.MT_ManagementGroup in database Operations Manager.

After that I bounced the System Center Data Access, Management and Management Configuration services. Then I started to receive successful events for the scripts that were failing before. You can see examples of successful script executions below:

Log Name: Operations Manager
Source: Health Service Script
Date: 10/25/2010 5:46:07 PM
Event ID: 100
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: RMS01.domain.pvt
Description:
PartitioningAndGroomingMonitor.vbs : Script executed with Process Succeed Count 3

Log Name: Operations Manager
Source: Health Service Script
Date: 10/25/2010 5:46:07 PM
Event ID: 100
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: RMS01.domain.pvt
Description:
DetectDuplicateRelAgnToSrvMonitor.vbs : Script executed with Duplicate Records Count 0

In case anyone else if having this issue… This is the script I am using as a Recovery Task with Winmgmt as its parameter to run and sorry if I made any mistakes this is only my third PowerShell script! Feel free to change and let me know if there is a better way! .. NOTE: You will probably need to sign the code unless you changed the PowerShell script execution policy to Unrestricted !

Sponsors, article continues below...

####################################################
## Usage: RestartService.ps1 <service name> ########
## Author: Stephen Leuthold (http://blogmynog.com) #
## Created: 6/22/2010 ##############################
## Modified: 6/22/2010 #############################
## Purpose: Restart service and dependencies #######
####################################################
 
PARAM($svcName)
 
# Get dependent services
$depSvcs = Get-Service -name $svcName -dependentservices | Where-Object {$_.Status -eq "Running"} |Select -Property Name
 
# Check to see if dependent services are started
if ($depSvc -ne $null) {
	# Stop dependencies
	foreach ($depSvc in $depSvcs)
	{
		Stop-Service $depSvc.Name
		do
		{
			$service = Get-Service -name $depSvc.Name | Select -Property Status
			Start-Sleep -seconds 1
		}
		until ($service.Status -eq "Stopped")
	}
}
 
# Restart service
Restart-Service $svcName -force
do
{
	$service = Get-Service -name $svcName | Select -Property Status
	Start-Sleep -seconds 1
}
until ($service.Status -eq "Running")
 
 
$depSvcs = Get-Service -name $svcName -dependentservices |Select -Property Name
 
# We check for Auto start flag on dependent services and start them even if they were stopped before
foreach ($depSvc in $depSvcs)
{
	$startMode = gwmi win32_service -filter "NAME = '$($depSvc.Name)'" | Select -Property StartMode
	if ($startMode.StartMode -eq "Auto") {
		Start-Service $depSvc.Name
		do
		{
			$service = Get-Service -name $depSvc.Name | Select -Property Status
			Start-Sleep -seconds 1
		}
		until ($service.Status -eq "Running")
	}
}

Sponsors, article continues below...

I had an issue after upgrading where it kept saying my iPhone password had expired, even after I changed it 5 times. To resolve the issue I ended up removing the profile and setup the Exchange and wireless manually. I am not aware of a way to setup the VPN manually. There may be a new profile builder utility out that creates a profile compatible with iOS 4.

Sponsors, article continues below...

no mgcp t38 inhibit

mgcp package-capability fxr-package

mgcp default-package fxr-package

Sponsors, article continues below...

SELECT
 UPPER(a.DeviceName) DeviceName ,
 b.IPAddress,
 b.ProductName,
 b.ProductId,
 b.OSVendor,
 b.SerialNumber,
 b.AssetTag,
 b.ROMVersion,
 b.MemorySize,
 b.CPUs,
 -- a.startDate StartDate ,
 -- a.EndDate EndDate ,
 dbo.fn_ConvertDate(a.startDate) StartDate ,
 dbo.fn_ConvertDate(a.EndDate) EndDate ,
 a.ExpirationStatus ,
 a.responseTime  ResponseTime,
 a.coverageWindow  Coverage,
 a.serviceLevel ServiceLevel,
 c.CSInfo,
 c.PCName,
 c.address1,
 c.address2,
 c.city,
 c.state,
 c.postalCode,
 c.country,
 c.custTimeZone,
 c.PCPhone,
 c.PCEmail
 
FROM
      dbo.R_WarrantyContract a
LEFT JOIN
      (
            SELECT
                  DeviceKey,
                  IPAddress,
                  ProductName,
                  ProductId,
                  OSVendor,
                  SerialNumber,
                  AssetTag,
                  ROMVersion,
                  MemorySize,
                  NumberOfCPU CPUs
            FROM
                  dbo.R_Inventory
            GROUP BY
                  DeviceKey,
                  IPAddress,
                  ProductName,
                  ProductId,
                  OSVendor,
                  SerialNumber,
                  AssetTag,
                  ROMVersion,
                  MemorySize,
                  NumberOfCPU       
      ) b
      ON 
      a.DeviceKey = b.DeviceKey
     
LEFT JOIN
 (
  SELECT
   DeviceKey,
   CSInfo,
   address1,
   address2,
   city,
   state,
   postalCode,
   country,
   custTimeZone,
   PCName,
   PCPhone,
   PCEmail
  FROM
            EXT_CustSiteNContactsInfo
 ) c
 ON
 a.DeviceKey = c.DeviceKey
ORDER BY
      c.CSInfo

I had to create a new “mickey mouse” view do to time constraints, in which the above query selects from.

SELECT     dbo.devices.Name AS DeviceName, dbo.devices.DeviceKey, SysCustomer.companyName AS CSInfo, SysCustomer.address1, SysCustomer.address2,
                      SysCustomer.city, SysCustomer.state, SysCustomer.postalCode, SysCustomer.country, SysCustomer.custTimeZone, ISNULL(PC.contactSalutation, N'')
                      + N' ' + ISNULL(PC.contactFirstName, N'') + N' ' + ISNULL(PC.contactLastName, N'') AS PCName, PC.contactPhone AS PCPhone, PC.contactEmail AS PCEmail,
                      ISNULL(SC.contactSalutation, N'') + N' ' + ISNULL(SC.contactFirstName, N'') + N' ' + ISNULL(SC.contactLastName, N'') AS SCName, SC.contactPhone AS SCPhone,
                      SC.contactEmail AS SCEmail, ISNULL(PSC.contactSalutation, N'') + N' ' + ISNULL(PSC.contactFirstName, N'') + N' ' + ISNULL(PSC.contactLastName, N'') AS PSCName,
                      PSC.contactPhone AS PSCPhone, PSC.contactEmail AS PSCEmail, - 1 AS SnapshotID
FROM         dbo.devices INNER JOIN
                          (SELECT     dbo.SIM_SysCustomer.companyName, dbo.SIM_SysCustomer.address1, dbo.SIM_SysCustomer.address2, dbo.SIM_SysCustomer.city,
                                                   dbo.SIM_SysCustomer.state, dbo.SIM_SysCustomer.postalCode, dbo.SIM_SysCustomer.country, dbo.SIM_SysCustomer.custTimeZone,
                                                   dbo.deviceAssocObjects.nodeID AS SysNodeId
                            FROM          dbo.SIM_SysCustomer INNER JOIN
                                                   dbo.deviceAssocObjects ON dbo.deviceAssocObjects.assocObjectLUID = dbo.SIM_SysCustomer.customerLuid INNER JOIN
                                                   dbo.devices AS devices_4 ON dbo.deviceAssocObjects.nodeID = devices_4.nodeLuid) AS SysCustomer ON
                      dbo.devices.nodeLuid = SysCustomer.SysNodeId LEFT OUTER JOIN
                          (SELECT     dbo.SIM_SysContact.contactSalutation, dbo.SIM_SysContact.contactFirstName, dbo.SIM_SysContact.contactLastName,
                                                   dbo.SIM_SysContact.contactPhone, dbo.SIM_SysContact.contactEmail, deviceAssocObjects_3.nodeID AS PCNodeId
                            FROM          dbo.SIM_SysContact INNER JOIN
                                                   dbo.deviceAssocObjects AS deviceAssocObjects_3 ON deviceAssocObjects_3.assocObjectLUID = dbo.SIM_SysContact.contactLuid AND
                                                   deviceAssocObjects_3.assocType = 0 INNER JOIN
                                                   dbo.devices AS devices_3 ON deviceAssocObjects_3.nodeID = devices_3.nodeLuid) AS PC ON PC.PCNodeId = dbo.devices.nodeLuid LEFT OUTER JOIN
                          (SELECT     SIM_SysContact_2.contactSalutation, SIM_SysContact_2.contactFirstName, SIM_SysContact_2.contactLastName, SIM_SysContact_2.contactPhone,
                                                   SIM_SysContact_2.contactEmail, deviceAssocObjects_2.nodeID AS PCNodeId
                            FROM          dbo.SIM_SysContact AS SIM_SysContact_2 INNER JOIN
                                                   dbo.deviceAssocObjects AS deviceAssocObjects_2 ON deviceAssocObjects_2.assocObjectLUID = SIM_SysContact_2.contactLuid AND
                                                   deviceAssocObjects_2.assocType = 1 INNER JOIN
                                                   dbo.devices AS devices_2 ON deviceAssocObjects_2.nodeID = devices_2.nodeLuid) AS SC ON SC.PCNodeId = dbo.devices.nodeLuid LEFT OUTER JOIN
                          (SELECT     SIM_SysContact_1.contactSalutation, SIM_SysContact_1.contactFirstName, SIM_SysContact_1.contactLastName, SIM_SysContact_1.contactPhone,
                                                   SIM_SysContact_1.contactEmail, deviceAssocObjects_1.nodeID AS PCNodeId
                            FROM          dbo.SIM_SysContact AS SIM_SysContact_1 INNER JOIN
                                                   dbo.deviceAssocObjects AS deviceAssocObjects_1 ON deviceAssocObjects_1.assocObjectLUID = SIM_SysContact_1.contactLuid AND
                                                   deviceAssocObjects_1.assocType = 2 INNER JOIN
                                                   dbo.devices AS devices_1 ON deviceAssocObjects_1.nodeID = devices_1.nodeLuid) AS PSC ON PSC.PCNodeId = dbo.devices.nodeLuid

I ran the query in MS SQL Server Management Studio, exported the results to excel and shot it off to my vender. I might clean this up and just put it all in a single view someday. When I do I’ll update this post.

UPDATE: 6-23-2010
You will need the following function added to your DB before running…

/****** Object: UserDefinedFunction [dbo].[fn_ConvertDate] Script Date: 06/22/2010 15:21:56 ******/
SET ANSI_NULLS ON
GO
 
SET QUOTED_IDENTIFIER ON
GO
 
CREATE FUNCTION [dbo].[fn_ConvertDate] (@Datetime BIGINT)
RETURNS DATETIME
AS
BEGIN
DECLARE @LocalTimeOffset BIGINT;
DECLARE @AdjustedLocalDatetime BIGINT;
SELECT @LocalTimeOffset = DATEDIFF(SECOND,GETDATE(),GETUTCDATE())
SELECT @AdjustedLocalDatetime = (@Datetime – @LocalTimeOffset)/1000
RETURN (SELECT DATEADD(SECOND,@AdjustedLocalDatetime, CAST(’1970-01-01 00:00:00′ AS datetime)))
END;
GO