The Password Change Notification service executable failed while verifying the file signature.

The_Password_Change_Notification_service_executable_failed_while_verifying_the_file_signature._1_Rule (Rule)

Knowledge Base article:

Management Pack

Causes
Invalid Service Executable

Resolutions
Something has tampered with the PCNS service and rendered it invalid. Investigate the PCNS installation to determine the source of the change.

Sample Event
The Password Change Notification service executable "%3" failed while verifying the file signature. The service will not be started and password notifications will not be sent. %1%2

Element properties:

Target

Microsoft.Windows.PasswordChangeNotificationService.2003.Microsoft_Password_Change_Notification_Service_2003_Servers_Installation

Category

EventCollection

Enabled

True

Event_ID

6004

Event Source

PCNS Filter

Alert Generate

True

Alert Severity

Error

Alert Priority

Low

Remotable

True

Alert Message

The Password Change Notification service executable failed while verifying the file signature.

$Data/EventDescription$

Event Log

Application

Comment

Mom2005ID='{2DB7C8D9-2E82-40DC-A6E1-0DA4D0C75BF8}';MOM2005ComputerGroupID={F4E5E633-97D9-45D5-BA6E-A8DA919ABDDD}

Member Modules:

ID	Module Type	TypeId	RunAs
_F6DA1507_12AF_11D3_AB21_00A0C98620CE_	DataSource	Microsoft.Windows.EventProvider	Default
CollectEventData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
CollectEventDataWarehouse	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="The_Password_Change_Notification_service_executable_failed_while_verifying_the_file_signature._1_Rule" Target="Microsoft.Windows.PasswordChangeNotificationService.2003.Microsoft_Password_Change_Notification_Service_2003_Servers_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{2DB7C8D9-2E82-40DC-A6E1-0DA4D0C75BF8}';MOM2005ComputerGroupID={F4E5E633-97D9-45D5-BA6E-A8DA919ABDDD}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_F6DA1507_12AF_11D3_AB21_00A0C98620CE_" Comment="{F6DA1507-12AF-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">Channel</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Application</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>PCNS Filter</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>6004</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>50</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>The Password Change Notification service executable failed while verifying the file signature.</Name>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>