RunAs Account Monitoring Check

Microsoft.ServiceManager.HealthServiceRunAsAccounts.AccountMonitoringCheck.Unit (UnitMonitor)

Monitor which indicates our self-monitoring status of RunAs accounts.

Knowledge Base article:

Summary

This monitor and alert indicates that the Health Service cannot verify whether the specified RunAs Account is valid. Below is a summary of the default configuration of this monitor:

Yellow state : Transition to yellow state if the Health Service cannot verify the validity of a RunAs Account (event 7015 or 7016)
Green state : Transition to green state if the Health Service successfully validated all RunAs Accounts (7019).

Causes

The yellow state can indicate that the following may be happening on the agent:

The Health Service cannot verify the future validity of the specified RunAs account due to:

An error retrieving information from Active Directory (for Domain Accounts)
Or an error retrieving information from the local security authority (for Local Accounts)
Or an error that is specified in the event

Resolutions

You can perform the following steps to resolve the problem or to gather data prior to seeking assistance from Microsoft product support:

Ensure access to Active Directory is available from the managed computer on which the Health Service is running
Try to use another user account as the RunAs Account for this Health Service
Capture all 7### events, save the Service Manager event log (named Operations Manager) on the management server and call Microsoft product support. During the support call, mention the most recent 7### events and any error codes (e.g. event 7022) inside the event and ask if the Service Manager event log is needed.

Element properties:

Target

Microsoft.SystemCenter.ServiceManager.ManagementServer

Parent Monitor

Microsoft.ServiceManager.HealthServiceRunAsAccounts.Rollup

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Failed to Check for Password Expiration on RunAs Account

{0}

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.ServiceManager.HealthServiceRunAsAccounts.AccountMonitoringCheck.Unit" Accessibility="Public" Enabled="true" Target="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer" ParentMonitorID="Microsoft.ServiceManager.HealthServiceRunAsAccounts.Rollup" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.ServiceManager.HealthServiceRunAsAccounts.AccountMonitoringCheck.Unit.AlertMessage">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="AccountMonitoringCheckCheckSuccess" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

    <OperationalState ID="AccountMonitoringCheckCheckFailed" MonitorTypeStateID="FirstEventRaised" HealthState="Warning"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Operations Manager</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">7015</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">7016</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer"]/ManagementGroupName$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[5]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Operations Manager</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">7019</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer"]/ManagementGroupName$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>