Home
  •  

SCOM2019 RunAs Helper Event 7002 Configure Log on as a service Rule

SCOM2019.RunAsHelper.Event.7002.Alert.Rule (Rule)

Element properties:

TargetMicrosoft.SystemCenter.Agent
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
RunAs account is missing Log on as a service - user right on a SCOM Agent
An Event 7002 was detected with a RunAs account missing the Log on as a service user right on this agent.

A modification attempt was made for Log on as a service.

Result: {3}

UserName: {0}\{1}

User right properties before modification: {4}

User right properties after modification: {5}

Event Description that triggerred this response:
{2}

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource SCOM2019.RunAsHelper.7002EventScript.DS Default
Alert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="SCOM2019.RunAsHelper.Event.7002.Alert.Rule" Enabled="true" Target="SC!Microsoft.SystemCenter.Agent" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Alert</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="SCOM2019.RunAsHelper.7002EventScript.DS">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <TimeoutSeconds>120</TimeoutSeconds>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="SCOM2019.RunAsHelper.Event.7002.Alert.Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/Property[@Name='Domain']$</AlertParameter1>

        <AlertParameter2>$Data/Property[@Name='UserName']$</AlertParameter2>

        <AlertParameter3>$Data/Property[@Name='EventDescription']$</AlertParameter3>

        <AlertParameter4>$Data/Property[@Name='Result']$</AlertParameter4>

        <AlertParameter5>$Data/Property[@Name='AccountListBefore']$</AlertParameter5>

        <AlertParameter6>$Data/Property[@Name='AccountListAfter']$</AlertParameter6>

      </AlertParameters>

      <Suppression/>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>