Rule to alert if a SPN for the account running the Data Access service isn't registered
In order for the OpsMgr Console or any other SDK clients to authenticate using Kerberos, the Data Access service needs to register SPNs for itself.
If the Data Access service is not running as "Local System" it does not have the right permissions to register SPNs with Active Directory.
You can use SetSPN.exe to register the SPNs for the Data Access service. Here are the commands that you need to execute using an account which has domain administrator rights:
Setspn.exe –A MSOMSdkSvc/<RMS FQDN> domain\username (this is the Data Access service account name)
Setspn.exe –A MSOMSdkSvc/<RMS NETBIOS> domain\username
Note: If the RMS is clustered, you should use the virtual server name.
Target | Microsoft.SystemCenter.RootManagementServer | ||
Category | Alert | ||
Enabled | True | ||
Event_ID | 26371 | ||
Event Source | OpsMgr SDK Service | ||
Alert Generate | True | ||
Alert Severity | Error | ||
Alert Priority | High | ||
Remotable | True | ||
Alert Message |
| ||
Event Log | Operations Manager |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.EventProvider | Default |
Alert | WriteAction | System.Health.GenerateAlert | Default |
<Rule ID="Microsoft.SystemCenter.2007.SdkSpnRegistration" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.RootManagementServer" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>Alert</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Operations Manager</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">26371</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">OpsMgr SDK Service</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
<Priority>2</Priority>
<Severity>2</Severity>
<AlertName/>
<AlertDescription/>
<AlertOwner/>
<AlertMessageId>$MPElement[Name="Microsoft.SystemCenter.2007.SdkSpnRegistration.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>
<SuppressionValue>$Data/PublisherName$</SuppressionValue>
</Suppression>
</WriteAction>
</WriteActions>
</Rule>