Service account password for Office Communications Server has been updated since the server was las

OCS_Password_Expiry_Check_12297_EE (Rule)

Service account password for Office Communications Server has been updated since the server was last restarted. Office Communications Server will not function correctly if new password is not the same as previous.

Knowledge Base article:

Summary

Causes

Service account password has been updated since the server was last restarted.

Resolutions

Please set the new password on the service account and restart Office Communications Server

Element properties:

Target

Microsoft_Office_Communications_Server_2007_R2_Enterprise_Edition

Category

EventCollection

Enabled

True

Event_ID

12297

Event Source

OCS Password Expiry Check

Alert Generate

True

Alert Severity

Error

Alert Priority

High

Remotable

True

Alert Message

{0}

Event Log

Office Communications Server

Member Modules:

ID	Module Type	TypeId	RunAs
CollectEvent	DataSource	Microsoft.Windows.EventProvider	Default
WriteAlert	WriteAction	System.Health.GenerateAlert	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="OCS_Password_Expiry_Check_12297_EE" Enabled="true" Target="Microsoft_Office_Communications_Server_2007_R2_Enterprise_Edition" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="CollectEvent" TypeID="SCWindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="SCWindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Office Communications Server</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">OCS Password Expiry Check</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">12297</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SCSystemLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteAlert" TypeID="SCHealth!System.Health.GenerateAlert">

      <Priority>2</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="Service_account_password_for_Office_Communications_Server_has_been_updated_since_the_server_was_last_restarted__Office_Communications_Server_will_not_function_correctly_if_new_password_is_not_the_same_as_previous_"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

      </Suppression>

    </WriteAction>

    <WriteAction ID="WriteToDW" TypeID="SCDataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>