realscom

Trace Logs C:\ProgramData\Microsoft System Center 2012\Orchestrator You'll find most stuff under  C:\ProgramData\Microsoft System Center 2012\Orchestrator\ManagementService.exe\Logs. When I had problems with the runbook service stopping I got some good info in  C:\ProgramData\Microsoft System Center 2012\Orchestrator\RunbookServerMonitorService.exe\Logs. Services Orchestrator Management Service (omanagement) Installed on management server Maintains the Orchestrator database Communicates with runbook designers and deployment manager Orchestrator Runbook Server Monitor (omonitor) Installed on management server Monitors health of runbook servers Orchestrator Runbook Service (orunbook) Installed on each runbook server Runs the actual runbooks and communicates with the Orchestrator database Orchestrator Remoting Service (oremoting) Enables the Orchestrator Deployment Manager to deploy Runbook Designer, Runbook Server, or integration packs Runbook table relationships

To really turn UAC off Go to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system and set EnableLUA to 0. Or run this to get current value (will be 0x1 if it's enabled) REG QUERY HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system /v EnableLUA To disable it (will prompt to overwrite) REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system /v EnableLUA /t REG_DWORD /d 0

After installing a new SCOM 2016 management group I was getting this error when trying to install the Reporting server component on a seperate server. The DW database was on a different server that was part of an Always On availability group. When I ran the install it would always bomb out with this error: The specified SQL Server instance is not valid.  The possible causes of this problem include the following: * SSRS has not been configured correctly * Secure Socket Layer (SSL) is configured for the SQL Server Report Server. * A proxy server is configured for the SQL Server Report Server. After much digging around and trying all the usual crazy stuff (delete encryption keys, ResetSRS.exe etc) I found this error in the log that SCOM creates when adding/removing components. It's located in the user profile of whomever is running the install %USERPROFILE%\AppData\Local\SCOM\LOGS\OpsMgrSetupWizard.log. [13:54:08]: Always: :Reporting URL: http://MyReportServer/ReportServer_REP_01 [13:

This affects SCOM 2012 and 2016. At a client site I was doing a side-by-side upgrade of SCOM 2012 SP1 to 2016. In the old SCOM environment clicking on any state views resulted in the UI crashing, the local SCOM guy put it down to a poked SCOM databases. When I built the new 2016 environment, we were getting the same issue. Turns out it was a patch released in October 2016 causing the problem. The fix was to install windows8.1-kb3200006-x64_c699272ce136f853353d4c6804126b8a6025d76a.msu. Kevin discusses it  here .

These are the steps I took to migrate notifications from a production SCOM 2012 SP1 management group to a new 2016 management group. This works really well and is an awesome time-saver. Export the Microsoft.SystemCenter.Notifications.Internal mp in the old and new management groups - do not modify these, they are our backup copies Make a copy of both files and rename them to something meaningful like Microsoft.SystemCenter.Notifications.Internal. ManagementGroupName_backup .xml Make a note of the mp version number of the Microsoft.SystemCenter.Notifications.Internal mp from the new management group. In my case it was 7.2.11719.0 Open up the Microsoft.SystemCenter.Notifications.Internal.xml file for the old management group and change the version number to that of the new management group mp version + 1 . In my case I changed it from 7.0.9538.0 to 7.2.11719.1. This is so the mp imports properly in the new management group At this point you may want to consider disabling all the subscrip

When you install SCOM 2012/16 you will usually get this alert form all management servers: Name:  Data Access Service SPN Not Registered Description:  The System Center Data Access service failed to register an SPN. A domain admin needs to add MSOMSdkSvc/hostname and MSOMSdkSvc/hostname.domain.name to the servicePrincipalName of CN=hostname,OU=MyOU,DC=domain,DC=name This alert is a bug and is discussed  here . I usually disable this alert as it's useless but we do need to confirm SPNs are setup correctly so run this command: setspn -L domain\DasUserAccount You should get this back if it's all good: Registered ServicePrincipalNames for CN=domain\DasUserAccount,OU=MyOU,DC=domain,DC=name: MSOMSdkSvc/MS1 MSOMSdkSvc/MS1.domain.name MSOMSdkSvc/MS2 MSOMSdkSvc/MS2.domain.name If not, we just need to setup the SPNs for all management servers like this: setspn -S MSOMSdkSvc/MS1 domain\DasUserAccount setspn -S MSOMSdkSvc/MS1.domain.name domain\DasUserAccount setspn -S MSOMSdkSvc/MS2 domai

Install logs To view the log files created when adding or removing SCOM components are here %LOCALAPPDATA%\SCOM\LOGS. Where are my database servers? To find the servers that the SCOM databases have been installed on, logon to any management server, open regedit and go to  HKLM\SOFTWARE\Microsoft\Microsoft Operations Manager\3.0\Setup. Ops db is here: DatabaseName DatabaseServerName DW db is here: DataWarehouseDBName DataWarehouseDBServerName Misc alert stuff Severity mapping 0 - Information 1 - Warning 2 - Critical Priority mapping 0 - Low 1 - Medium (or Normal ) 2 - High Default Resolution States 0 - New 247 - Awaiting Evidence 248 - Assigned to Engineering 249 - Acknowledged 250 - Scheduled 254 - Resolved 255 - Closed

When running the update_rollup_mom_db.sql  script from the UR9 update for SCOM 2012 R2 it would always bomb out after a few minutes with this error: (1 row(s) affected) (1 row(s) affected) Msg 1205, Level 13, State 56, Line 1 Transaction (Process ID 152) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction. Msg 3727, Level 16, State 0, Line 1 Could not drop constraint. See previous errors. Out of interest I decided to keep the DAS, Config and Exchange Correlation Engine services running while doing this as I'd never had a problem before. Getting nowhere I then stopped the Correlation Engine and - looking more promising - the script ran for about 20 minutes then bombed out with the same error. I then stopped the DAS, Config and HealthService services on all management servers as Kevin advises in the article below and the script completed successfully in less than 1 minute. The UR_Datawarehouse.sql script completed s

To run this on remote servers sc \\server <command> Get status of a service sc query spooler Get configuration information of a service sc qc spooler Stop a service sc stop spooler Start a service sc start spooler Get startup account sc qc spooler Change start type to Disabled Note: You might need a space after the equal sign on some computers. sc config spooler start=disabled Change start type to Manual sc config spooler start=demand Change start type to Automatic sc config spooler start=auto Get DisplayName of a service sc GetDisplayName spooler Get ServiceName of a service sc GetKeyName "Print Spooler"

If you're getting high cpu on lab servers (usually running Win 2012 R2) disable Windows Update in Control Panel and set the 'Windows Modules Installer' service to Manual start with the below command and reboot. Note: The space after the equal sign  is required. sc config TrustedInstaller start= demand

netsh advfirewall set allprofiles state off

Shutdown local computer shutdown /s /f /t 0 Restart local computer shutdown /r /f /t 0 Shutdown remote computer shutdown \\computer /s /f /t 0 Restart remote computer shutdown \\computer /r /f /t 0

Loop through names in file FOR /F %i in (c:\Temp\_Computers.txt) do @echo %i Populate AD group with computer accounts FOR /F %i in (c:\Temp\_Computers.txt) do dsmod group "CN=GPO-Server-Low Criticality,OU=Group Policy Filtering,OU=Privileged Objects,OU=All Resources,DC=lab,DC=com" -addmbr %i

To add an event to the Application log eventcreate /L APPLICATION /T ERROR /SO TestSource /ID 500 /D "Test event using eventcreate.exe" Limitations You can only use the Application log EventID must be in the range of 1 - 1000 EventSource must be unique within all logs so use something like 'TestSource'

For a single file in cab: expand <file.cab> -r If there's multiple files in cab: Note: The "." is the current directory. expand <file.cab> -r -f:* .

Here's some options for filling disks up when testing low disk space alerts in SCOM: # 1 - fsutil This will create a 1gb file: fsutil file createnew c:\temp\test.txt 1000000000 # 2 - File copy This will copy the file 1.test nine times: FOR /L %i IN (2,1,10) DO copy 1.test %i.test