AKN649521

Monitor_AKN649521 (UnitMonitor)

Configure Windows Error Reporting consent levels to help you find solutions for your operating system stop error

Knowledge Base article:

Element properties:

Source Code:

<UnitMonitor ID="Monitor_AKN649521" Comment="SupportTopic=TBD;VersionNumber=1.0.0.0;" Accessibility="Public" Enabled="true" Target="MicrosoftKnowledgeServicesWindowsLibrary!Microsoft.KnowledgeServices.Windows.OperatingSystem" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="High" TypeID="KnowledgeServicesLibrary!Microsoft.KnowledgeServices.Library.PowerShellMonitorEx" ConfirmDelivery="true">

  <Category>Alert</Category>

  <AlertSettings AlertMessage="MonitorMessage485afe3d4efe4a4dafc3698cf05629d6">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>High</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Success" MonitorTypeStateID="Success" HealthState="Success"/>

    <OperationalState ID="Error" MonitorTypeStateID="Error" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ScriptName>AKN649521.ps1</ScriptName>

    <Parameters/>

    <ScriptBody><Script>



$ErrorActionPreference = "Stop"



# Set up the arguments

$scriptargs = new-object psobject



# Set up the output

$global:scriptoutput = new-object psobject

$scriptoutput | add-member NoteProperty "HasIssue" $false

# Environment

$scriptenv = New-Object psobject

$scriptenv | Add-Member NoteProperty "RuntimeError" $false

$scriptenv | Add-Member NoteProperty "IsWerEnabled" $true

$scriptenv | Add-Member ScriptProperty "IsBugCheckEventExisted" { @(Get-EventLog -LogName "System" -Source "BugCheck" -EntryType "Error" -ErrorAction SilentlyContinue | ? { $_.EventID -eq 1001 }).Count -gt 0}



function Check-WerEnabledFromRegistry($registryPath) {

    $result = $null

    if (Test-Path -Path $registryPath) {

        if ((Get-ItemProperty -Path $registryPath -ErrorAction SilentlyContinue).Disabled -eq 1) {

            $result = $false;

        } else {

            $registryConsentPath = $registryPath + "\Consent"

            if (Test-Path -Path $registryConsentPath) {

                $defaultConsent = (Get-ItemProperty -Path $registryConsentPath -ErrorAction SilentlyContinue).DefaultConsent

                if ($defaultConsent -ne $null) {

                    $result = @(2,3,4) -contains $defaultConsent

                }

            }

        }

    }



    $result

}



function Check-IsWerEnabled

{

    $scriptenv.IsWerEnabled = $true

    

    New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS

 

    $LM_Policies_WER_RegistryPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting'

    $LM_WER_RegistryPath = 'HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting'

    $registryPaths = [System.Collections.ArrayList]@($LM_Policies_WER_RegistryPath, $LM_WER_RegistryPath)

    

    $userSids = @((Get-Item "HKU:\" -ErrorAction SilentlyContinue).GetSubKeyNames() | ? { ([String]$_).StartsWith("S-1-5-21") -and (-not $_.Contains("_Classes")) })

    foreach($userSid in $userSids) {

        $registryPaths.Add("HKU:\$userSid\SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting")

    }

    foreach($userSid in $userSids) {

        $registryPaths.Add("HKU:\$userSid\SOFTWARE\Microsoft\Windows\Windows Error Reporting")

    }

    

    foreach ($rpath in $registryPaths) {

        $checkResult = Check-WerEnabledFromRegistry $rpath

        if ($checkResult -ne $null) {

            $scriptenv.IsWerEnabled = $checkResult

            break

        }

    }

}



function AdvisorRule($scriptargs, $scriptoutput)

{

    trap [Exception] {

        $scriptenv.RuntimeError = $true

        continue; 

    }



    # Initialize parameters

    $scriptoutput.HasIssue = $false



    # Detection Logic

    Check-IsWerEnabled

    if((-not $scriptenv.IsWerEnabled) -and $scriptenv.IsBugCheckEventExisted)

    {

        if ($scriptenv.RuntimeError -eq $false)

        {

            $scriptoutput.HasIssue = $true

        }

    }

}

AdvisorRule $scriptargs $scriptoutput



# set the output

$mom = new-object -comobject "MOM.ScriptAPI"

$bag = $mom.CreatePropertyBag()



if ($scriptoutput.HasIssue -ne $null)

{

	$bag.AddValue("HasIssue", $scriptoutput.HasIssue)

}



$bag



</Script></ScriptBody>

    <SnapIns/>

    <TimeoutSeconds>300</TimeoutSeconds>

    <Schedule>86393</Schedule>

    <ErrorExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="Boolean">Property[@Name='HasIssue']</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="Boolean">true</Value>

        </ValueExpression>

      </SimpleExpression>

    </ErrorExpression>

    <SuccessExpression>

      <Not>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="Boolean">Property[@Name='HasIssue']</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="Boolean">true</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </Not>

    </SuccessExpression>

  </Configuration>

</UnitMonitor>