An alert subscription has been automatically disabled due to invalid configuration

Microsoft.SystemCenter.2007.UserSubscriptionDisabledWhenCreatorsAccountNotActive (Rule)

There is a process that runs on a regular basis to confirm that all alert subscriptions in the management group are configured correctly and that their configuration is still valid. If one or more subscriptions are found with invalid configuration then the subscription is automatically disabled and this rule will generate an alert.

Knowledge Base article:

Summary

Causes

The accounts that was used to create the subscription, which has been disabled, has experienced one of the following changes:

The account has been disabled or has been deleted entirely.
The account has had its user role membership(s) changed in the management group, or the scope of the user role(s) that the account is a member of has changed in such a way that the user no longer has permissions to some objects that the subscription applies to.

Resolutions

From the alert description, copy the subscription's internal name.
Using either the Operations Console or the Export-ManagementPack cmdlet, export the management pack named "Notifications Internal Library" to an unsealed XML file.
Open the unsealed XML file with an editor of your choice, and search for the rule that has the same "ID" as the subscription's internal name that was copied earlier.
In the rule's configuration, find the value that is used for the "UserSid". This is the security identifier of the account that created the subscription and currently it either does not existing in Active Directory or the account is disabled. Copy this SID.
Replace this SID with the security identifier of a different user account. This account must exist in Active Directory, it must not be disabled and it must be a member of the "Operations Manager Administrators" user role in the management group.
Consider searching the entire file for any references to the invalid account's SID and replacing them with the SID of the new user account, as well.
Save the changes to the unsealed XML file and then import the management pack back into the management group.

Element properties:

Target

Microsoft.SystemCenter.AllManagementServersPool

Category

EventCollection

Enabled

True

Event_ID

11452

Event Source

Health Service Modules

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Remotable

True

Alert Message

An alert subscription has been automatically disabled due to invalid configuration

An alert subscription with the internal name "{0}" has been disabled because there is an issue with its configuration. Refer to the product knowledge for more information on how to troubleshoot this issue.

You can get the subscription's name as it's shown in the operations console by running the following command from the Operations Manager command shell:

Get-NotificationSubscription | where-object{$_.Name -eq "{0}"}

Event Log

Operations Manager

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.SystemCenter.2007.UserSubscriptionDisabledWhenCreatorsAccountNotActive" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.AllManagementServersPool" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>.</ComputerName>

      <LogName>Operations Manager</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">11452</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Health Service Modules</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.SystemCenter.2007.UserSubscriptionDisabledWhenCreatorsAccountNotActive.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/Params/Param[5]$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[5]$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>