RunAs Authorization Check

Microsoft.ServiceManager.HealthServiceRunAsAccounts.AuthorizationCheck.Unit (UnitMonitor)

此監視會檢查一組執行身分帳戶是否有效且可以授權。

Knowledge Base article:

摘要

健全狀況服務封鎖了指定 Windows 認證的存取 (用於 RunAs 帳戶)，因為未在此健全狀況服務上授權此管理群組進行存取。

此監視的預設設定摘要如下：

紅色狀態：如果健全狀況服務封鎖指定的 Windows 認證存取 (事件 7017)，則轉為紅色狀態
綠色狀態：如果健全狀況服務授權所有設定的 RunAs 帳戶執行 (事件 7025)，或如果已順利為管理群組啟動連接器管理員 (事件 2002)，則轉為綠色狀態

原因

紅色狀態可能表示代理程式上可能發生下列狀況：

健全狀況服務於其上執行的受管理電腦之本機系統管理員可能執行了 HSLockdown 工具以拒絕此 Windows 認證存取 (或僅允許存取特定的 Windows 認證)。

解決方法

在尋求 Microsoft 產品支援的協助之前，請執行下列步驟解決問題或收集資料：

執行 HSLockdown 工具，變更受管理電腦上授權的認證。
擷取所有的 7### 事件，在管理伺服器上儲存 Service Manager 事件記錄檔 (名為 Operations Manager) 並連絡 Microsoft 產品支援。與支援服務通話期間，敘述最新的 7### 事件和事件內的任何錯誤碼 (例如事件 7022) 並詢問是否需要 Service Manager 事件記錄檔。

Element properties:

Target

Microsoft.SystemCenter.ServiceManager.ManagementServer

Parent Monitor

Microsoft.ServiceManager.HealthServiceRunAsAccounts.Rollup

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

RunAs 授權檢查失敗

{0}

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.ServiceManager.HealthServiceRunAsAccounts.AuthorizationCheck.Unit" Accessibility="Public" Enabled="true" Target="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer" ParentMonitorID="Microsoft.ServiceManager.HealthServiceRunAsAccounts.Rollup" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.ServiceManager.HealthServiceRunAsAccounts.AuthorizationCheck.Unit.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="AccountsAreNotAuthorized" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="AccountsAuthorized" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Operations Manager</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">7017</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer"]/ManagementGroupName$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[3]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Operations Manager</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer"]/ManagementGroupName$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">7025</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>