Posts

Showing posts from April, 2022

SrvAny

This thing is great because it lets you run notepad as a service so you can stop and start it when testing service monitoring in SCOM. Stopping can be dodgy so just kill the process. Note: The old srvany.exe and instsrv.exe from the Win 2003 resource kit are hard to find now. Install a service Download  SrvAny.zip and extract contents. Open admin PowerShell and type this command to run notepad as a service (path may vary depending on OS version): SrvAny.exe -install ServiceShortName 1 c:\windows\notepad.exe I don't know what the 1 does but you need it. Set the service to auto start and you're done. Remove a service SrvAny.exe -remove ServiceShortName

Delete data from SCOM Ops db

Image
Had an issue with SCOM where an agent had been deleted but still appeared in the Windows Computers  view. I followed this article and ran all queries except 5. After a few minutes the computer disappeared. In brief you need to run these queries: First, get the BaseManagedEntityId of the computer: DECLARE @name varchar(255) = 'COMP_FQDN' SELECT BaseManagedEntityId, FullName, DisplayName, IsDeleted, Path, Name FROM BaseManagedEntity WHERE FullName like @name OR DisplayName like @name ORDER BY FullName Note: It's the row with  Microsoft.Windows.Computer:COMP_FQDN Change BaseManagedEntityId   to the ID of the invalid entity: DECLARE @EntityId uniqueidentifier = 'BaseManagedEntityId' DECLARE @TimeGenerated datetime;  SET @TimeGenerated = getutcdate(); BEGIN TRANSACTION  EXEC dbo.p_TypedManagedEntityDelete @EntityId, @TimeGenerated;  COMMIT TRANSACTION Run the first query again. This is to inspect the objects and see if their IsDeleted flag is now = 1. A few hours later

Reg.exe examples

Displays all subkeys and values reg query "HKLM\SOFTWARE\Wow6432Node\Network Associates\ePolicy Orchestrator" reg query "\\COMPUTER\HKLM\SOFTWARE\Wow6432Node\Network Associates\ePolicy Orchestrator" Show the value of InstallFolder reg query "\\COMPUTER\HKLM\SOFTWARE\Wow6432Node\Network Associates\ePolicy Orchestrator" /v InstallFolder

SCOM expired eval license

Image
You'll get this error when SCOM's eval license runs out. Event Id: 26319 Event Source: OpsMgr SDK Service You will also see the alert Product evaluation has expired which is generated by the monitor  Product Expiration - Error which looks for event id 26383. See  how to license SCOM . Once you have licensed it restart all services. I had some workflows not running because I didn't bounce the HealthService.