ConfigMgr 2007 service failure: SMS_SITE_VSS_WRITER was unable to log on

SMSv4_service_failure__SMS_SITE_VSS_WRITER_was_unable_to_log_on_19_Rule (Rule)

Knowledge Base article:

Summary

The service has failed to start because the user credentials and password are no longer valid. As a result the service is no longer available to dependent services and clients. If Configuration Manager is configured to use Advanced Security, it is possible that the account that was used to log on was changed from Local System to something else.

Causes

The account that was used to start the service has invalid credentials or insufficient privilege to start the service.

Additional

This alert is best handled by Configuration Manager administrators.

External

For more assistance, see a list of additional support options in the support section of the Configuration Manager Web site at Support for Configuration Manager.

Sample Events:

The %1 service could not log on as %2 with the currently configured password due to the following error: %n%3%n%n. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

Element properties:

Target	Microsoft.SystemCenter.ConfigurationManager.2007.Microsoft_SMSv4_Site_Servers_Installation
Category	EventCollection
Enabled	True
Alert Generate	False
Remotable	True
Event Log	System
Comment	Mom2005ID='{BBDC6616-5997-4EE3-B759-FD1CC5FBD0E6}';MOM2005ComputerGroupID={D0741372-F3F6-43EB-8B8B-965F937BCC65}

Member Modules:

ID	Module Type	TypeId	RunAs
_907D4578_146C_11D3_AB21_00A0C98620CE_	DataSource	Microsoft.Windows.EventProvider	Default
CollectEventData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
CollectEventDataWarehouse	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="SMSv4_service_failure__SMS_SITE_VSS_WRITER_was_unable_to_log_on_19_Rule" Target="Microsoft.SystemCenter.ConfigurationManager.2007.Microsoft_SMSv4_Site_Servers_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{BBDC6616-5997-4EE3-B759-FD1CC5FBD0E6}';MOM2005ComputerGroupID={D0741372-F3F6-43EB-8B8B-965F937BCC65}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_907D4578_146C_11D3_AB21_00A0C98620CE_" Comment="{907D4578-146C-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Service Control Manager</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Params/Param[1]</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>SMS_SITE_VSS_WRITER</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>7038</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="System.Mom.BackwardCompatibility.AlertResponse">

      <GenerateAlert>true</GenerateAlert>

      <Owner/>

      <Description>

            $Data/LoggingComputer$

           - ConfigMgr 2007 service failure: SMS_SITE_VSS_WRITER was unable to log on.



The SMS_SITE_VSS_WRITER service running on 

            $Data/LoggingComputer$

           was detected as stopped at 

            $Data/@time$

          .</Description>

      <AlertLevel>70</AlertLevel>

      <ResolutionState/>

      <Source>

            $Data/PublisherName$

          </Source>

      <Name>ConfigMgr 2007 service failure: SMS_SITE_VSS_WRITER was unable to log on</Name>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>