RunAs 授權檢查

Microsoft.ServiceManager.HealthServiceRunAsAccounts.AuthorizationCheck.Unit (UnitMonitor)

此監視器會檢查一組執行身分帳戶是否有效，且其是否可以授權。

Knowledge Base article:

摘要

因為健全狀況服務未獲此管理群組之健全狀況服務的授權，所以封鎖了對指定 Windows 認證 (於使用 RunAs 帳戶時使用) 的存取。

以下是此監視器的預設設定摘要:

紅色狀態:若健全狀況服務封鎖了對指定 Windows 認證的存取 (事件 7017)，將會轉變為紅色狀態
綠色狀態:若健全狀況服務已授權允許所有設定的 RunAs 帳戶執行 (事件 7025)，或管理群組的連接器管理員已成功啟動 (事件 2002)，將會轉變為綠色狀態

原因

紅色狀態表示代理程式可能發生下列狀況:

健全狀況服務執行所在之受管理電腦的本機系統管理員可能執行了 HSLockdown 工具拒絕對此 Windows 認證的存取 (或僅允許存取某些 Windows 認證)。

解決方法

請先執行下列步驟解決問題或收集資料，然後再尋求 Microsoft 產品支援的協助:

執行 HSLockdown 工具變更受管理電腦所授權的認證
擷取所有的 7### 事件，並將 Service Manager 事件記錄檔 (命名為 Operations Manager) 儲存在管理伺服器上，然後連絡 Microsoft 產品支援。在連絡支援服務時，提供最新的 7### 事件與事件內的任何錯誤碼 (例如事件 7022)，並詢問是否需要 Service Manager 事件記錄檔。

Element properties:

Target

Microsoft.SystemCenter.ServiceManager.ManagementServer

Parent Monitor

Microsoft.ServiceManager.HealthServiceRunAsAccounts.Rollup

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

RunAs 授權檢查失敗

{0}

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.ServiceManager.HealthServiceRunAsAccounts.AuthorizationCheck.Unit" Accessibility="Public" Enabled="true" Target="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer" ParentMonitorID="Microsoft.ServiceManager.HealthServiceRunAsAccounts.Rollup" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.ServiceManager.HealthServiceRunAsAccounts.AuthorizationCheck.Unit.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="AccountsAreNotAuthorized" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="AccountsAuthorized" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Operations Manager</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">7017</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer"]/ManagementGroupName$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[3]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Operations Manager</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer"]/ManagementGroupName$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">7025</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>