Stop SCOM from alerting on Demoted Domain Controller

Question

Hi Team,

A DC was demoted in the environment but the server is kept alive as it is our CA.
SCOM is now alerting on all DC roles, Rules and Monitors for this DC.

Is there a simple was to stop all the Domain Controller discoveries from occurring on this server as opposed to me touching each 20 individual alert and overriding the Class for this Server Instance.

Answer 1

So far i have tried this:

Went to Administration > Agent Managed
Uninstalled agent from server

On SCOM Mgmt server i ran:
Remove-SCOMDisabledClassInstance -ComputerName <Demoted Server>

all i am getting is:

Remove-SCOMDisabledClassInstance : The Data Access service is either not running or not yet initialized. Check the event log for more information.
At line:1 char:1

• Remove-SCOMDisabledClassInstance -ComputerName <Server name>
• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
• CategoryInfo : InvalidOperation: (Microsoft.Syste...nstancesCommand:RemoveSCDisabledClassInstancesCommand) [Remove-SCOMDisabledClassInstance], ServiceNotRunningException
• FullyQualifiedErrorId : ExecutionError,Microsoft.SystemCenter.OperationsManagerV10.Commands.RemoveSCDisabledClassInstancesCommand

I have checked and the DAS service is still running on the Mgmt Server.

Anybody got any ideas?

Answer 2

Hi @Saiyad Rahim ,

The Remove-SCOMDisabledClassInstance is specifically made to undiscover instances of classes for which the discovery rule has been overriden > disabled, if you haven't done any overrides it won't be of any help here since you decided to actually uninstall the SCOM agent.

Are you still receiving alerts?

----------

(If the reply was helpful please don't forget to upvote or accept as answer, thank you)

Best regards,
Leon

Answer 3

Hi @Saiyad Rahim ,

the error you are getting is because you are most probably running the cmdlet on another server, different then then a SCOM management server.
In order to to run it you can open a management group connection first (-SCSession param from the cmdlet) or run it on a management server. From the MS Docs article:

Remove-SCOMDisabledClassInstance

Now to the actual issue: If you have already unintsalled the agent once, all the dioscvery data should be gone after running the cmdlet. So after installing it again you should not see those alerts anymore.

Please post us updated!

Thnaks and Regards,
Stoyan

----------

(If the reply was helpful please don't forget to upvote or accept as answer, thank you)