Event ID's 7015 and 7002 on SCOM 2019 management servers

shankar431 466 Reputation points
2021-04-01T11:48:49.65+00:00

Hi All,

On SCOM 2019 Management Servers we are receiving the events below in windows application logs.

1)Event ID :7015
The description for Event ID 7015 from source HealthService cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:
svcscom-naa
Logon failure: the user has not been granted the requested logon type at this computer.
1385L
SCOM_MG
Log name: Application

2)Event ID :7002
The description for Event ID 7002 from source HealthService cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:
svcscom-naa
SCOM_MG
Log on as a service
Log name: Application

Can you please let us know what action needs to be taken for the above mentioned Event ID's.
Also please let us know if we need to grant any other permission to svcscom-naa .

Regards,
Ravi shankar

Operations Manager
Operations Manager
A family of System Center products that provide infrastructure monitoring, help ensure the predictable performance and availability of vital applications, and offer comprehensive monitoring for datacenters and cloud, both private and public.
1,410 questions
0 comments No comments
{count} votes

3 answers

Sort by: Most helpful
  1. George Moise 2,346 Reputation points Microsoft Employee
    2021-04-01T11:58:12.077+00:00

    Hi,

    Does the user svcscom-naa have Log on as a Service permissions on the Computers where you got this error?

    The following information was included with the event:
    svcscom-naa
    SCOM_MG
    Log on as a service
    Log name: Application


    This article from Kevin might help - https://kevinholman.com/2019/03/14/security-changes-in-scom-2019-log-on-as-a-service/

    0 comments No comments

  2. shankar431 466 Reputation points
    2021-04-01T13:03:08.037+00:00

    Hi George,

    Thank you for the update.
    Do we need to add this notification action account(svcscom-naa) in below location (Log on as a service) locally on the management servers.
    Local Security Policy > Local Policies > User Rights Assignment > Log on as a service.

    Kindly confirm.

    Regards,
    Ravi shankar

    0 comments No comments

  3. Crystal-MSFT 41,766 Reputation points Microsoft Vendor
    2021-04-02T01:23:59.763+00:00

    @shankar431 , For the error we get, it seems the account didn't have enough permission. If the "Log on as a service" permission hasn't been granted to the account yet. we can follow the steps in the following link to add it and see if it is working.
    https://learn.microsoft.com/en-us/system-center/scom/enable-service-logon?view=sc-om-2019

    Hope it can help.


    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.