How to remove custom attributes created in Windows Core LIbrary Management Pack from System Center Operations Manager 1807?

Question

A custom attribute was mistakenly created in Windows Core Library MP. This attribute is causing WMI errors on all of my servers. How can I remove the attribute from Windows Core LIbrary?

Answer 1

So, the discovery causing your issue is called "Group - SEC_SRVADMIN_SERVER_SUPPORTDiscovery" and is stored in the Management Pack called "AD.Partner.Management.Pack"
(try Get-SCOMManagementPack -Name "AD.Partner.Management.Pack" to find its displayname)

If I were you, I would export that MP and check in the XML code what that discovery does precisely before savagely deleting it.

Answer 2

HI,

which attribute do you mean exactly? What is its name?
You extention is not stored in the Windows Core Library for sure. You are just using the class from this library as a base class and you save the customiozations in your own MP. This is clearly described here:

To extend a class

and although this is a Service Manager reference, the principles are the same for SCOM also (both products use the same concept and class model).

Can you please check if you have a MP that could potentially contain this extentions?

Regards,
Stoyan

Answer 3

That custom attribute is stored in "Mclane -DriverPro" MP, it's clearly written in your screenshot.
Also note that the WMI Query "select * from Win32_OperatingSystem where (ProductType = "2")" is used to detect whether a server is a domain controller. (If producttype = 2, it is a DC; otherwise it's not).
Are you sure it's the one used in that custom attribute?

Do you have more details about the failing rule in the error event?

Answer 4

DriverPro is working as expected.

I do not know at this point what is causing this error. My only clue was the date on the attribute that I found in a search. Created same day. Showing sn Windows Core Library with standard names as shown in previous attachment.

I don't need to fix the query only delete it.

A full example of the error being generated on all servers is as follows:

Object enumeration failed

Query: 'select * from Win32_OperatingSystem where (ProductType = "2"'

HRESULT: 0x80041017

Details: Invalid query

One or more workflows were affected by this.

Workflow name: AttributeDiscoveryGeneratedByUIedec1a0ad2994c53bf4f6ede5ffee9b8

Instance name: WPDSTOBHRSQL01.mclane.mclaneco.com

Instance ID: {7E43E36C-5869-C4EE-78ED-CBBFDE304BFA}

Management group: DSTSCOMPROD

Answer 5

Hey,

can you please check your Management Packs in SCOM and try to find a MP that could contain this extention? There should be something in the name, which indicates what the MP does if best practices have been follwed.
You can actually also check the MPs from the 23/10 if this has been saved in a new MP.
You can also export the MPs that could be the cause and then search in the XML for this particular query.
What I can tell you for sure is that this is not saved in the Windows Core Library.
Cyril already gave a great suggestion, maybe the MP is related to AD customizations (the WMI query points to this).

You could also try this approach to find out more about where this workflow (AttributeDiscoveryGeneratedByUIedec1a0ad2994c53bf4f6ede5ffee9b8) has been saved.

SCOM 2012 – Find Workflow From Windows Event
https://www.stefanroth.net/2014/06/24/scom-2012-find-workflow-from-windows-event/

Thanks for updating us!
Regards,
Stoyan