UserPinService: Found users who are already or about to be permanently locked

• Question

• 

  

  0

  Sign in to vote

  Hello,

  I have been getting this annoying message about: 

  [Skype] Found users who are already or about to be permanently locked

  I worked with a great team at microsoft with my contact being Yogaprakash.

  Here is what we found:

  Monitor Name: UserPinService: Found users who are already or about to be permanently locked

  Alert Name: [Skype] Found users who are already or about to be permanently locked

  Monitor Configuration:

  <Configuration>

    <ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>Lync Server</LogName>

    <ErrorExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">47066</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">LS UserPin Service</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </ErrorExpression>

    <AutoResolveInterval>7200</AutoResolveInterval>

  </Configuration>

  So as per the above monitor configuration, SCOM monitoring the event id 47066 published by LS UserPin Service Source on the Skype servers.

  The above monitor is from the Skype for Business 2015 Management Pack and it’s sealed management pack.

  
  

  We can’t make any changes with respect to increase/decrease the time interval for this monitor to execute to monitor the event id mentioned above due to sealed management pack from Microsoft.

  Below are the only override parameters which are available or exposed to make changes

  Override Parameters:

  
  

  As SCOM is looking for the event id 47066 published by LS UserPin Service Source on the Skype servers, when this event id logged, SCOM will generate an alert.

  Full details about this monitor:UPIN_FOUND_PERMANENTLY_LOCKED_USERS

  I hope this helps.

  Thanks

  Rob

  Tuesday, May 2, 2017 7:12 PM