locked
RMS having limited functionality??? RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello,

    Since an intrusion last week in our environment service accounts have been reset or password changed.

    Now I am getting an error:

    "Alert description: The root management server (HealthService) is  running but has reported limited functionality soon after 10/20/2014 11:16:46 AM. The specific reason code is 43 and description is " System workflows essential to running of the product have failed to load. "."

    This error is repetitive every 5 minutes...

    The task failing are :

    Target:   
Target Type:  Health Service 
Category:  Maintenance 
Task Output: 
 
Date and Time:Date and Time: 10/20/2014 11:12:39 AM 
Total Workflows Failed: 3 
Details: show/hide 
 
Object Id: {16781F33-F72D-033C-1DF4-65A2AFF32CA3} 
Object Display Name: Microsoft System Center Data Warehouse 
Workflows: show/hide 
 
Workflow Id: Workflow Display Name: 
Microsoft.SystemCenter.OperationalDataReporting.SubmitOperationalData Microsoft System Center Reporting Server Operational Data Submission 
Object Id: {DF927679-EAC0-B8EC-F8CC-F0031A36AD4F} 
Object Display Name: OPMGRRMS1.ad 
Workflows: show/hide 
 
Workflow Id: Workflow Display Name: 
Microsoft.SystemCenter.DataWarehouse.Deployment.Report Data Warehouse report deployment rule 
Object Id: {760DB2AB-8591-FF63-3660-8165664B0B11} 
Object Display Name: Application Server 2008 Instances Group 
Workflows: show/hide 
 
Workflow Id: Workflow Display Name: 
Microsoft.Windows.Server.2008.AppServer.InstancesGroup.Discovery Populate the "Application Server 2008 Instances Group" group with Managed Entity instances.

    Any clue?

    Thanks,

    Dom




    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

    Object Id: {16781F33-F72D-033C-1DF4-65A2AFF32CA3} 
Object Display Name: Microsoft System Center Data Warehouse 
Workflows: show/hide 
 
Workflow Id: Workflow Display Name: 
Microsoft.SystemCenter.OperationalDataReporting.SubmitOperationalData Microsoft System Center Reporting Server Operational Data Submission 
Object Id: {DF927679-EAC0-B8EC-F8CC-F0031A36AD4F} 
Object Display Name: OPMGRRMS1.ad.medctr.ucla.edu 
Workflows: show/hide 
 
Workflow Id: Workflow Display Name: 
Microsoft.SystemCenter.DataWarehouse.Deployment.Report Data Warehouse report deployment rule 
Object Id: {760DB2AB-8591-FF63-3660-8165664B0B11} 
Object Display Name: Application Server 2008 Instances Group 
Workflows: show/hide 
 
Workflow Id: Workflow Display Name: 
Microsoft.Windows.Server.2008.AppServer.InstancesGroup.Discovery Populate the "Application Server 2008 Instances Group" group with Managed Entity instances.


    • Edited by Felyjos Monday, October 20, 2014 6:27 PM
    Monday, October 20, 2014 6:25 PM

Answers

  • Question
    Sign in to vote
    1
    Sign in to vote

    Seems like a network device issue is causing the problem.

    Refer the below threads.

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/7d82ef4a-b497-4304-b4a7-a4397c9122b9/sce-acting-weird-ever-since-getting-root-management-server-unavailable-alert?forum=systemcenter

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/913deb9d-5abb-4e59-bc02-9792a74ab140/root-management-server-unavailable?forum=systemcenteressentials

    Gautam.75801

    • Marked as answer by Felyjos Tuesday, October 21, 2014 6:57 PM
    Tuesday, October 21, 2014 2:10 AM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Hi There,

    Below are the account mappings:

    Data Warehouse Action Account - is for the Data writer account.
    Data Warehouse Report Deployment Account - is for the Data reader account

    The one which is blacked out in the screenshot will be the main SCOM Action account.

    So re enter the passwords carefully and accordingly and check and let me know.

    Gautam.75801



    Tuesday, October 21, 2014 4:17 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Will Suggest yes as a answer.

    Once you reboot if the accounts are proper below events will appear.

    Event id - 7025 - The Health Service has authorized all configured RunAs accounts to execute for management group XXXXXXXX.

    Event id - 7026  -The Health Service successfully logged on the RunAs account "Your action account"T for management group XXXXX

    Event id - 7026  -The Health Service successfully logged on the RunAs account "Your data reader account"T for management group XXXXX

    Event id - 7026  -The Health Service successfully logged on the RunAs account "Your data writer account"T for management group XXXXX

    If you have created specific Run as profiles based on your requirement, Do check the same events in the event log (Will just change the Run as account in the event description, But the event id will remain same) if even that has successfull login. If yes its fine. If no get the password updated for them as well.

    Let me know the results.

    Gautam.75801


    Tuesday, October 21, 2014 6:25 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/7d82ef4a-b497-4304-b4a7-a4397c9122b9/sce-acting-weird-ever-since-getting-root-management-server-unavailable-alert?forum=systemcenter

    the RMS came available 2 minutes only

    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

    • Marked as answer by Felyjos Tuesday, October 21, 2014 6:57 PM
    Tuesday, October 21, 2014 5:06 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/913deb9d-5abb-4e59-bc02-9792a74ab140/root-management-server-unavailable?forum=systemcenteressentials

    I have the event 4000 but did all actions requested and still not working..

    Having some other events which have impacted the RMS after the password reset...

    The Health Service could not log on the RunAs account AD\SVCMOMDWA for management group SCOM-MED.  The error is Logon failure: unknown user name or bad password.(1326L).  This will prevent the health service from monitoring or performing actions using this RunAs account
---------------------------------------------------------
The Health Service could not log on the RunAs account AD\svcmomaction for management group SCOM-MED.  The error is Logon failure: unknown user name or bad password.(1326L).  This will prevent the health service from monitoring or performing actions using this RunAs account
----------------------------------------------------------

    SVCMOMDWA is the Datawarehouse account I have changed the password then changed in the

    Administration > Run As Configuration > Profiles > Type: Windows

    - Data Warehouse Action Account

    SVCMOMACTION is the user account under which all rules run by default

    It seems I missed some locations where to update the password!!!

    Any clue?

    Thanks,

    Dom

    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager


    • Edited by Felyjos Tuesday, October 21, 2014 3:58 PM
    • Marked as answer by Felyjos Tuesday, October 21, 2014 6:57 PM
    Tuesday, October 21, 2014 3:56 PM

All replies

  • Question
    Sign in to vote
    1
    Sign in to vote

    Seems like a network device issue is causing the problem.

    Refer the below threads.

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/7d82ef4a-b497-4304-b4a7-a4397c9122b9/sce-acting-weird-ever-since-getting-root-management-server-unavailable-alert?forum=systemcenter

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/913deb9d-5abb-4e59-bc02-9792a74ab140/root-management-server-unavailable?forum=systemcenteressentials

    Gautam.75801

    • Marked as answer by Felyjos Tuesday, October 21, 2014 6:57 PM
    Tuesday, October 21, 2014 2:10 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/7d82ef4a-b497-4304-b4a7-a4397c9122b9/sce-acting-weird-ever-since-getting-root-management-server-unavailable-alert?forum=systemcenter

    the RMS came available 2 minutes only

    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

    • Marked as answer by Felyjos Tuesday, October 21, 2014 6:57 PM
    Tuesday, October 21, 2014 5:06 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/913deb9d-5abb-4e59-bc02-9792a74ab140/root-management-server-unavailable?forum=systemcenteressentials

    I have the event 4000 but did all actions requested and still not working..

    Having some other events which have impacted the RMS after the password reset...

    The Health Service could not log on the RunAs account AD\SVCMOMDWA for management group SCOM-MED.  The error is Logon failure: unknown user name or bad password.(1326L).  This will prevent the health service from monitoring or performing actions using this RunAs account
---------------------------------------------------------
The Health Service could not log on the RunAs account AD\svcmomaction for management group SCOM-MED.  The error is Logon failure: unknown user name or bad password.(1326L).  This will prevent the health service from monitoring or performing actions using this RunAs account
----------------------------------------------------------

    SVCMOMDWA is the Datawarehouse account I have changed the password then changed in the

    Administration > Run As Configuration > Profiles > Type: Windows

    - Data Warehouse Action Account

    SVCMOMACTION is the user account under which all rules run by default

    It seems I missed some locations where to update the password!!!

    Any clue?

    Thanks,

    Dom

    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager


    • Edited by Felyjos Tuesday, October 21, 2014 3:58 PM
    • Marked as answer by Felyjos Tuesday, October 21, 2014 6:57 PM
    Tuesday, October 21, 2014 3:56 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Hi There,

    Below are the account mappings:

    Data Warehouse Action Account - is for the Data writer account.
    Data Warehouse Report Deployment Account - is for the Data reader account

    The one which is blacked out in the screenshot will be the main SCOM Action account.

    So re enter the passwords carefully and accordingly and check and let me know.

    Gautam.75801



    Tuesday, October 21, 2014 4:17 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello,

    SVCMOMDWA is used by Data Warehouse Action Account.

    SVCMOMRS is used by Data Warehouse Report Deployment Account

    I reinput both passwords... again...

    any service(s) to restart?

    or just checking the event logs for error on connection?

    svcMOMDWA does not show anymore in the event log ...

    remain svcmomaction..

    Thanks,
    Dom

    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager


    • Edited by Felyjos Tuesday, October 21, 2014 4:55 PM
    Tuesday, October 21, 2014 4:45 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Will Suggest yes as a answer.

    Once you reboot if the accounts are proper below events will appear.

    Event id - 7025 - The Health Service has authorized all configured RunAs accounts to execute for management group XXXXXXXX.

    Event id - 7026  -The Health Service successfully logged on the RunAs account "Your action account"T for management group XXXXX

    Event id - 7026  -The Health Service successfully logged on the RunAs account "Your data reader account"T for management group XXXXX

    Event id - 7026  -The Health Service successfully logged on the RunAs account "Your data writer account"T for management group XXXXX

    If you have created specific Run as profiles based on your requirement, Do check the same events in the event log (Will just change the Run as account in the event description, But the event id will remain same) if even that has successfull login. If yes its fine. If no get the password updated for them as well.

    Let me know the results.

    Gautam.75801


    Tuesday, October 21, 2014 6:25 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    The Health Service has authorized all configured RunAs accounts to execute for management group SCOM-MED.

    The Health Service successfully logged on the RunAs account AD\SVCMOMAction for management group SCOM-MED

    The Health Service successfully logged on the RunAs account AD\svcFIMSP for management group SCOM-MED

    The Health Service successfully logged on the RunAs account AD\svcmomaction for management group SCOM-MED

    The Health Service successfully logged on the RunAs account AD\svcmomrs for management group SCOM-MED

    The Health Service successfully logged on the RunAs account AD\SVCMOMDWA for management group SCOM-MED

    this looks good,

    Thnaks a lot

    Dom

    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

    Tuesday, October 21, 2014 6:57 PM
  • Question
    Sign in to vote
    1
    Sign in to vote
    Your welcome.

    Gautam.75801

    Tuesday, October 21, 2014 6:59 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    As I removed all Network Devices have been removed at one point what would be your advice adding them back or forgot about them..??

    https://social.technet.microsoft.com/Forums/systemcenter/en-US/7d82ef4a-b497-4304-b4a7-a4397c9122b9/sce-acting-weird-ever-since-getting-root-management-server-unavailable-alert?forum=systemcenter

https://social.technet.microsoft.com/Forums/systemcenter/en-US/913deb9d-5abb-4e59-bc02-9792a74ab140/root-management-server-unavailable?forum=systemcenteressentials

    Thanks,

    Dom

    System Center Operations Manager 2007 / System Center Configuration Manager 2007 R2 / Forefront Client Security / Forefront Identity Manager

    Tuesday, October 21, 2014 7:07 PM