This rule generates alerts if the site component manager fails to update objects in Active Directory.
Configuration Manager cannot create, read, update, or delete an already existing object in Active Directory. Configuration Manager status message 4912, 4913, 4915 were detected.
This condition could occur because:
This site server’s computer account might not have full control rights for the Configuration Manager container in Active Directory.
The Active Directory object has either been moved to a location outside of the System Management container, or it has been lost.
The Active Directory schema has not been extended with the correct Configuration Manager Active Directory classes and attributes.
Give the site server computer account full control rights to the Configuration Manager container and all child objects in Active Directory.
Delete the object from its current location, and let Configuration Manager create a new object.
Target | Microsoft.SystemCenter2012.ConfigurationManager.SiteComponentManager | ||
Category | EventCollection | ||
Enabled | False | ||
Event_ID | 4912 | ||
Event Source | SMS Server | ||
Alert Generate | True | ||
Alert Severity | Error | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
| ||
Event Log | Application | ||
Comment | SIV:SVC0029 |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.EventProvider | Default |
Alert | WriteAction | System.Health.GenerateAlert | Default |
WriteToDB | WriteAction | Microsoft.SystemCenter.CollectEvent | Default |
WriteToDW | WriteAction | Microsoft.SystemCenter.DataWarehouse.PublishEventData | Default |
<Rule ID="Microsoft.SystemCenter2012.ConfigurationManager.SiteComponentManager.CanNotUpdateADObject_Events" Comment="SIV:SVC0029" Enabled="false" Target="SCCM!Microsoft.SystemCenter2012.ConfigurationManager.SiteComponentManager" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">4912</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">SMS Server</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
<WriteAction ID="Alert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertName/>
<AlertDescription/>
<AlertOwner/>
<AlertMessageId>$MPElement[Name="Microsoft.SystemCenter2012.ConfigurationManager.SiteComponentManager.CanNotUpdateADObject_AlertMessageResourceID"]$</AlertMessageId>
<AlertParameters/>
<Suppression>
<SuppressionValue/>
</Suppression>
<Custom1/>
<Custom2/>
<Custom3/>
<Custom4/>
<Custom5/>
<Custom6/>
<Custom7/>
<Custom8/>
<Custom9/>
<Custom10/>
</WriteAction>
</WriteActions>
</Rule>