SharePoint Administration service is disabled

Microsoft.Windows.SharePoint.Services.3.0.SharePoint_Administration_service_is_disabled (Rule)

Several features of Microsoft Windows SharePoint Services rely on scheduled background processes called timer jobs. Administrators can configure and schedule timer jobs by using Central Administration.

Knowledge Base article:

Summary

Causes

The timer job that was run requires the Windows SharePoint Services Administration (SPAdmin) service, which is disabled.

Resolutions

Start the SharePoint Administration (SPAdmin) service, or review the Windows SharePoint Services Administrator’s Guide for information about how to operate with the Administration Service disabled.

Restart the Windows SharePoint Services service

Ensure that the computer on which the Windows SharePoint Services Search service runs is turned on.
On the affected server, click Start, click Administrative Tools, and then click Services.
Scroll down the list, right-click the Windows SharePoint Services Search service, and then click Properties. The properties page appears.
To stop the service, click Stop.
After the service status changes to Stopped, click Start to restart the service and then click OK to close the properties page.

If the Windows SharePoint Services Administration service will not start, review the Windows NT Event log and resolve accordingly.

Element properties:

Target

Microsoft.Windows.SharePoint.Services.3.0.WSS.Application

Category

EventCollection

Enabled

True

Event_ID

7399

Event Source

Windows SharePoint Services 3

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

SharePoint Administration service is disabled

Event ID {0} from Source {2} on agent computer {3} has triggered this Alert Description : {1}

Event Log

Application

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
CollectData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
DataWarehousePublishData	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
WSS.GenerateAlert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.Windows.SharePoint.Services.3.0.SharePoint_Administration_service_is_disabled" Enabled="onEssentialMonitoring" Target="Microsoft.Windows.SharePoint.Services.3.0.WSS.Application" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="MSWL!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="MSWL!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>7399</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Windows SharePoint Services 3</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="CollectData" TypeID="SystemCenter!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="DataWarehousePublishData" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

    <WriteAction ID="WSS.GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.SharePoint.Services.3.0.SharePoint_Administration_service_is_disabled.AlertMessageID"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDisplayNumber$</AlertParameter1>

        <AlertParameter2>$Data/EventDescription$</AlertParameter2>

        <AlertParameter3>$Data/PublisherName$</AlertParameter3>

        <AlertParameter4>$Target/Host/Property[Type="MSWL!Microsoft.Windows.Computer"]/NetworkName$</AlertParameter4>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

        <SuppressionValue>$Data/EventDescription$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>