Run As Account or Password Expired or Incorrect

Microsoft.SystemCenter.HealthServiceRunAsAccounts.SuccessfulLogonCheck.Unit (UnitMonitor)

This monitor checks if a Run As account can successfully log on with the configured username and password.

Knowledge Base article:

Summary

The System Center Management Health Service could not log on the specified Run As account. This will prevent the System Center Management Health Service from monitoring or performing actions using this Run As account

Below is a summary of the default configuration of this monitor:

Warning state: Transition to warning state if the System Center Management Health Service could not log on the specified Run As account (event 7000)
Healthy state: Transition to healthy state if the System Center Management Health Service successfully logged on all Run As accounts (7024)

Causes

The password entered for the Run As account may be incorrect.
The account or its password may have expired.
The account may be disabled.

Resolutions

You can perform the following steps to resolve the problem or to gather data prior to seeking assistance from Microsoft product support:

The password entered for the Run As account may be incorrect. Re-enter the password by

Open the Operations console

Go to the Administration space

Select the Run As Account node on the left pane

Find the specified Run As account and open its properties

Select the Account tab and re-enter the correct password

Extend the account (or update its password) in Active Directory (for domain accounts) or on the local computer (for local accounts)
Ensure that the account is enabled in Active Directory (for domain accounts) or on the local computer (for local accounts)

Element properties:

Target

Microsoft.SystemCenter.HealthService

Parent Monitor

Microsoft.SystemCenter.HealthServiceRunAsAccounts.Rollup

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Run As Account Could Not Log On

One or more Run As accounts failed to log on. The account {0}\{1} may be disabled or has an expired password.

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.SystemCenter.HealthServiceRunAsAccounts.SuccessfulLogonCheck.Unit" Accessibility="Public" Enabled="true" Target="SCLibrary!Microsoft.SystemCenter.HealthService" ParentMonitorID="Microsoft.SystemCenter.HealthServiceRunAsAccounts.Rollup" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.SystemCenter.HealthServiceRunAsAccounts.SuccessfulLogonCheck.Unit.AlertMessage">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/DataItem/Params/Param[1]$</AlertParameter1>

      <AlertParameter2>$Data/Context/DataItem/Params/Param[2]$</AlertParameter2>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="AccountsFailedToLogOn" MonitorTypeStateID="FirstEventRaised" HealthState="Warning"/>

    <OperationalState ID="AccountsAreLoggedOn" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Operations Manager</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[5]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">7000</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Operations Manager</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">HealthService</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value Type="String">$Target/ManagementGroup/Name$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">7024</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">2002</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>