1. SCOM administrators ignore them as they receive such alerts from agents day in and day out.

2.The emails cannot be customised like sending with High Priorities etc.

This is where PowerShell comes handy. Let us see how to make life of a SCOM administrator easier.

1. Create this PowerShell script in SQL Server hosting the Operations Manager Database. Here is the script which you can use with slight modification highlighted. You can create the script on any server as a matter of fact.
2. ############################################################# $MS1=$null $MS2=$null $MSs=$null Try{ $dataSource = "SQL2016" #Replace the databaseservername with the SQL Server name. Verify that you are able to connect to the instance using UDL test. You might need to provide the instance name along with port number $database = "OperationsManager" #Replace OperationsManagerDB with the name of your Operations Manager Database $connectionString = “Server=$dataSource;Database=$database;Integrated Security=True;” $connection = New-Object System.Data.SqlClient.SqlConnection $connection.ConnectionString = $connectionString $connection.Open() #This query gives the detail of the Management Server and the Gateway which are not healthy on the console. $query = "select BME.path from Availability AV join BaseManagedEntity BME on AV.BaseManagedEntityId=BME.BaseManagedEntityId join MT_healthservice HS on AV.BaseManagedEntityId=HS.BaseManagedEntityId where (HS.ismanagementserver=1 or HS.isgateway=1) and AV.isavailable=0" $command = $connection.CreateCommand() $command.CommandText = $query $result = $command.ExecuteReader() $table = new-object “System.Data.DataTable” $table.Load($result) $connection.Close() $MSs=$table.path if($MSs -eq $null) { #Write-host "exit loop" exit } else { [string]$MS1=$MSs.Split(' ') } } Catch { #write-host "Catch Loop" $MS2= "Either SQL database is down or we cannot connect to the SQL instance" Send-MailMessage -From "opsmgr@pop1.lab" -to "udish@pop1.lab" -cc "udish@pop1.lab" -Body $MS2 -SmtpServer "exchange2010.pop1.lab" -Port 25 -Priority High -Subject "Management Servers and Gateways Unhealthy" break } #Send email to users if the SQL returns any output #The -from, -to, -smtpserver, -port, -subject parameter values should be replaced. Refer to your SMTP channel in SCOM console to get the details. If($MS1.count -ne 0) { [string]$mailbody="" foreach($MS in $MSs) { $mailbody = $mailbody + $MS + "`r`n" #$mailbody } Send-MailMessage -From "opsmgr@pop1.lab" -to "udish@pop1.lab" -cc "udish@pop1.lab" -Body $mailbody -SmtpServer "exchange2010.pop1.lab" -Port 25 -Priority High -Subject "Management Servers and Gateways Unhealthy" } ###############################################################
3. Once the script is ready and test with PowerShell ISE. Some sample output of the email. 3. The next steps would be to put in a task scheduler (or may be Orchestrator if you are using it) i. Open TaskSchedular. Right Click -> Create Task. ii.Enter the details under the highlighted lines. IMP: Use a service account to run the task which has permission to the Operations Manager Database. I would suggest SDK account.     iii.  Add the schedule. IMP: Duration should be set to “Indefinitely”. iv. Put in the path where the script is located on the server. v. Run the task to verify everything is working as expected.

It is strange as I am logged in as an administrator(DOM50446\Administrator) and I installed VMM Management Server with the same account.

Now when I access the share from windows file explorer, I encounter the same problem.

Interestingly, if I access the file share from another machine with the same account, I can access the share. I do not remember why I tested it :)

I tried to locate the folder in my VMM Management Server and after some struggle I am able to locate it under C:\ProgramData\Virtual Machine Manager Library Files.

Looking at the permissions of the share, I can see "Domain Admins" group has full control, which explains why we can access the share from other machines.

I explicitly added the account DOM50446\Administrator to the permissions and gave Full Control.

And now the Library Share is accessible from the VMM console.

At this point of time, I do not have any idea why this behavior is seen. May be once I can talk to a Windows Expert I will get the answers to my questions :). And I will update the article with the root cause.

1. All your VMs will be in a "Not Responding State" and all your Refresh jobs will fail with the below error:

1. Access to your "Active Directory Users and Computers" and locate the DKM. Note: It is not a bad idea to have your AD Administrator by your side.
2. In case you have not moved your DKM yet and not aware of its location, login to your VMM Database and run the below query:SELECT PropertyName, PropertyValue FROM [VirtualManagerDB].[dbo].[tbl_VMM_GlobalSetting] WHERE PropertyName like '%Container%';
3. Once your locate the DKM container, move the DKM to the new container as desired. If already moved no actions are required in ADDS. (Wait till it reflects under the new container)
4. Right click on the DKM -> Properties -> Attribute Editor -> distinguishedName
5. Double click on distinguishedName, copy it.
6. Expand VMM DB -> Locate the table "[dbo].[tbl_VMM_GlobalSetting]" -> Right Click -> Edit 200 Rows -> Locate the row "TopContainerName" -> Change the PropertyValue to the new DKM location copied in Step 5 -> Cntrl+S -> Close the table editor.
7. Once you made the changes run the below query again to verify the changes are done properly.      SELECT PropertyName, PropertyValue       FROM [VirtualManagerDB].[dbo].[tbl_VMM_GlobalSetting]       WHERE PropertyName like '%Container%';
8. Once you verify that the container name is right in VMM DB, login to your VMM management Server and restart the service "System Center Virtual Machine Manager".
9. Enter the password of the RunAsAccounts again. They should work now.
10. The Refresh Jobs should now run successfully and the VMs will be back to Responding State.

• Firstly, we need to configure the ACS forwarder either as a workgroup agent or an agent pointed to a gateway, in another domain as compared to the Collector where there is no two-way transitive trust between the domains. Steps to configure the same are explained in the below articles.
• On the ACS Forwarder:
  • An agent is installed on the computer that will serve as the ACS Forwarder. For more information, see Operations Manager Agent Installation Methods.
  • A certificate and certification authority [CA] certificate is installed on the computer hosting the agent. For more information, see Authentication and Data Encryption for Windows Computers in the Deployment Guide.
• On the ACS Collector:
  • A certificate (and CA certificate) is installed on the management server hosting the ACS Collector. For more information, see Authentication and Data Encryption for Windows Computers in the Deployment Guide.
  • The pending agent is approved and communication between the agent and the management server is operating properly. For more information, see Process Manual Agent Installations.
  • The ACS Collector and database is installed. For more information, see How to Install an Audit Collection Services (ACS) Collector and Database in the Deployment Guide.

• Once the collector is installed, you can verify the same under the below view in Operations Manager console.
• Also, refer to the below article to filter out the events you want to collect from the forwarder before you configure the forwarders. Or else, it might flood your ACS database. **Microsoft do not support manually grooming data out of ACS database. So if you flood the database the only way out is to wait for 42 days, the default retention period. https://technet.microsoft.com/en-us/library/ee909501.aspx
• The current setting of the filtration can be found in the below registry on the collector.
• Verify if the certificates on the forwarder and collector are configured properly.

1. The root CA and the intermediate CAs(if any) for the certificate on the collector should be imported to the Root CA Store and Intermediate CA Store of the forwarder respectively.
2. The root CA and the intermediate CAs(if any) for the certificate on the forwarder should be imported to the Root CA Store and Intermediate CA Store of the collector respectively.

**If the above steps are not configured an event 4369 will be logged on the forwarder.

• To assign a certificate to the ACS Collector

3. On the Windows desktop, click Start, and then click Run.
4. In the Rundialog box, type cmd, and then click OK.
5. At the command prompt, type <drive_letter>: (where <drive_letter> is the drive where the operating system is installed), and then press ENTER.
6. Type cd %systemroot%, and then press ENTER.
7. Type cd system32\security\adtserver, and then press ENTER.
8. Type net stop adtserver, and then press ENTER.
9. Type adtserver -c, and then press ENTER. **The adtserver tool will only display the certificates where the “Intended Purpose” of the certificates have “Client Authentication”

10. In the numbered list of certificates, find the certificate used for Operations Manager, type the number in the list (should be 1), and then press ENTER.
11. Type net start adtserverand then press ENTER.

• To export the certificate on the forwarder

1. On the Windows desktop, click Start, and then click Run.
2. In the Rundialog box, type mmc, and then click OK.
3. On the Filemenu, click Add/Remove Snap-in.
4. In the Add/Remove Snap-indialog box, click Add.
5. In the Add Standalone Snap-indialog box, click Certificates, and then click Add.
6. In the Certificates snap-indialog box, select Computer account, and then click Next.
7. In the Select Computerdialog box, select Local computer (the computer this console is running on), and then click Finish.
8. In the Add Standalone Snap-indialog box, click Close.
9. In the Add/Remove Snap-indialog box, click OK.
10. In the Console Root\Certificates (Local Computer) pane, expand Certificates (Local Computer), expand Personal, and then click Certificates.
11. In the results pane, right-click the certificate you are using for Operations Manager, point to All Tasks, and then click Export.
12. In the Certificate Export Wizard, on the Welcomepage, click Next.
13. On the Export Private Keypage, select No, do note export the private key, and then click Next.
14. On the Export File Formatpage, select DER encoded binary X.509 (.CER), and then click Next.
15. On the File to Exportpage, click Browse.
16. On the Save Aspage, select a folder and file name for the certificate, ensure that the Save as type is set to DER Encoded Binary X.509 (*.cer), and then click Save.

17. On the File to Exportpage, ensure that the path and file name are correct, click Next, and then click Finish.

• To configure named mapping to the certificate

1. Log on to the computer hosting Active Directory.
2. On the Windows desktop, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
3. Expand the domain name, right-click Computers, point to New, and then click Computer.
4. In the New Object - Computer dialog box, enter the NetBIOS name of the computer that is hosting the ACS Forwarder, and then click Next. Repeat this step for every computer that hosts an ACS Forwarder.
5. In the Managed dialog box, ensure that This is a managed computer is not selected, and then click Next.
6. In the New Object - Computer dialog box, click Finish.
7. In Active Directory Computers and Users, in the right pane, right-click the computer (or computers) you added, and then click Name Mappings.
8. In the Security Identity Mapping dialog box, click X.509 Certificates, and then click Add.
9. In the Add Certificate dialog box, click the Look in menu, select the location where the exported certificate is located, and then click Open. ** This certificate should be of the forwarder
10. In the Add Certificate dialog box, ensure that Use Subject for alternate security identity is selected, and then click OK.
11. In the Security Identity Mapping dialog box, click OK.
12. Repeat steps 4–11 for each computer you have added.

• After you complete these procedures, you need to enable the ACS Forwarders. For more information, see How to Enable Audit Collection Services (ACS) Forwarders.

• To run the adtagent command on the forwarder.

1. On the Windows desktop, click Start, and then click Run.
2. In the Run dialog box, type cmd, and then click OK.
3. At the command prompt, type <drive_letter>: (where <drive_letter> is the drive where the Operating System is installed), and then press ENTER.
4. Type cd %systemroot% and then press ENTER.
5. Type cd system32 and then press ENTER.

12. Type adtagent -cand then press ENTER. **The adtserver tool will only display the certificate where the “Intended Purpose” of the certificates have “Client Authentication”

1. You will see a numbered list of certificates. Find the certificate used for Operations Manager, type the number in the list (should be 1), and then press ENTER.
2. Type exit to close the command window.

• Verify if we have received the event 4368 on the forwarder.

• Run the below queries to verify the events are collected in the ACS database.

• Run the default ACS reports to verify the reports are populating the data.