Home
  •  

AgentNotRegistered

AgentNotRegisterd_1_Rule (Rule)

Knowledge Base article:

Management Pack
Summary

The Forefront Agent was not registered with the Exchange Transport.

 
Causes
  1. You are running a build of Exchange that is unsupported by your current version of Forefront.
  2. Unable to open Exchange's setup registry key or query Exchange's MSI Install Path from within the registry.
  3. The registration of the Forefront Agent using PowerShell failed or timed out.
 
Resolutions
  1. Make sure you are using a build of Exchange that is supported by Forefront or update your version of Forefront to support the build of Exchange you are running.
  2. Make sure Exchange's registry settings correctly exist and the FSEIMC service (which runs as NetworkService) has access to them.
  3. Refer to the program log to retrieve the exact cause of why the Agent failed to register or contact support for help in pinpointing the error.
 
© 2006 Microsoft Corporation, all rights reserved.

Element properties:

TargetFSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Edge_Transport_Installation
CategoryEventCollection
EnabledTrue
Event_ID1016
Event SourceFSEIMC
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
AgentNotRegistered
Event LogApplication
CommentMom2005ID='{76B4EB18-1243-47AD-B846-1065966B175E}';MOM2005ComputerGroupID={868E5B4E-34B8-4B10-9055-C4074AF41790}

Member Modules:

ID Module Type TypeId RunAs 
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_ DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="AgentNotRegisterd_1_Rule" Target="FSMPack2007_FSE.Forefront_Security_for_Exchange_Server___Edge_Transport_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{76B4EB18-1243-47AD-B846-1065966B175E}';MOM2005ComputerGroupID={868E5B4E-34B8-4B10-9055-C4074AF41790}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" Comment="{F6DA1507-12AF-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>1016</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>FSEIMC</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="HealthLibrary!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="AgentNotRegisterd_1_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters/>

      <Suppression/>

      <Custom1>Microsoft Forefront Server Security</Custom1>

      <Custom2>Forefront Security for Exchange Server</Custom2>

      <Custom3>ServicesFailure</Custom3>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>