RunAs Successful Logon Check

Microsoft.ServiceManager.HealthServiceRunAsAccounts.SuccessfulLogonCheck.Unit (UnitMonitor)

This monitor checks if a Run As account can successfully log on with the configured username and password.

Knowledge Base article:

Summary

The Health Service could not log on the specified RunAs account. This will prevent the Health Service from monitoring or performing actions using this RunAs account.

Below is a summary of the default configuration of this monitor:

Red state : Transition to red state if the Health Service could not log on the specified RunAs account (event 7000).
Green state : Transition to green state if the Health Service successfully logged on all RunAs accounts (7024) or if the connector manager is successfully started for the management group (event 2002).

Causes

The red state can indicate that the following may be happening on the agent:

The Health Service could not log on the specified RunAs account. This will prevent the Health Service from monitoring or performing actions using this RunAs account.

The password entered for the RunAs Account may be incorrect.
The account or its password may have expired.

Resolutions

You can perform the following steps to resolve the problem or to gather data prior to seeking assistance from Microsoft product support:

The password entered for the RunAs Account may be incorrect. Re-enter the password by

Open the Operations Console

Go to the Administration space

Select the Run As Account node on the left pane

Find the specified RunAs Account and open its properties

Select the Account tab and re-enter the correct password

Extend the account (or update its password) in Active Directory (for domain accounts) or on the local computer (for local accounts)
Capture all 7### events, save the Operations Manager event log on the agent computer and call Microsoft product support. During the support call, mention the most recent 7### events and any error codes (e.g. event 7022) inside the event and ask if the Operations Manager event log is needed.

Element properties:

Target

Microsoft.SystemCenter.ServiceManager.ManagementServer

Parent Monitor

Microsoft.ServiceManager.HealthServiceRunAsAccounts.Rollup

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

RunAs Successful Logon Check Failed

{0}

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.ServiceManager.HealthServiceRunAsAccounts.SuccessfulLogonCheck.Unit" Accessibility="Public" Enabled="true" Target="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer" ParentMonitorID="Microsoft.ServiceManager.HealthServiceRunAsAccounts.Rollup" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.ServiceManager.HealthServiceRunAsAccounts.SuccessfulLogonCheck.Unit.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="AccountsFailedToLogOn" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="AccountsAreLoggedOn" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Operations Manager</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer"]/ManagementGroupName$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[5]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">7000</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Operations Manager</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="SM!Microsoft.SystemCenter.ServiceManager.ManagementServer"]/ManagementGroupName$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">7024</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">2002</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>