There is a process that runs on a regular basis to confirm that all alert subscriptions in the management group are configured correctly and that their configuration is still valid. If one or more subscriptions are found with invalid configuration then the subscription is automatically disabled and this rule will generate an alert.
There is a process that runs on a regular basis to confirm that all alert subscriptions in the management group are configured correctly and that their configuration is still valid. If one or more subscriptions are found with invalid configuration then the subscription is automatically disabled and this rule will generate an alert.
The accounts that was used to create the subscription, which has been disabled, has experienced one of the following changes:
The account has been disabled or has been deleted entirely.
The account has had its user role membership(s) changed in the management group, or the scope of the user role(s) that the account is a member of has changed in such a way that the user no longer has permissions to some objects that the subscription applies to.
From the alert description, copy the subscription's internal name.
Using either the Operations Console or the Export-ManagementPack cmdlet, export the management pack named "Notifications Internal Library" to an unsealed XML file.
Open the unsealed XML file with an editor of your choice, and search for the rule that has the same "ID" as the subscription's internal name that was copied earlier.
In the rule's configuration, find the value that is used for the "UserSid". This is the security identifier of the account that created the subscription and currently it either does not existing in Active Directory or the account is disabled. Copy this SID.
Replace this SID with the security identifier of a different user account. This account must exist in Active Directory, it must not be disabled and it must be a member of the "Operations Manager Administrators" user role in the management group.
Consider searching the entire file for any references to the invalid account's SID and replacing them with the SID of the new user account, as well.
Save the changes to the unsealed XML file and then import the management pack back into the management group.
Target | Microsoft.SystemCenter.RootManagementServer | ||
Category | EventCollection | ||
Enabled | True | ||
Event_ID | 11452 | ||
Event Source | Health Service Modules | ||
Alert Generate | True | ||
Alert Severity | Error | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
| ||
Event Log | Operations Manager |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.EventProvider | Default |
Alert | WriteAction | System.Health.GenerateAlert | Default |
<Rule ID="Microsoft.SystemCenter.2007.UserSubscriptionDisabledWhenCreatorsAccountNotActive" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.RootManagementServer" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Operations Manager</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">11452</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Health Service Modules</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.SystemCenter.2007.UserSubscriptionDisabledWhenCreatorsAccountNotActive.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/Params/Param[5]$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>
<SuppressionValue>$Data/Params/Param[5]$</SuppressionValue>
</Suppression>
</WriteAction>
</WriteActions>
</Rule>