Category: SCOM

SCOM Troubleshooting: SQL Monitoring failed – Error after installing SCOM MP 7.0.15 for MS SQL – By Ruben Zimmermann

In this troubleshooting tip, Ruben talks about fixing the error you might encounter after you install the Management Pack for SQL version 7.0.15.


After we updated the MS SQL Management Pack to 7.0.15 several servers threw alerts that monitoring isn’t working any more.

The error message stated that a WMI query did not return any value.


Shortly after we updated the Management Pack to 7.0.15 we received error messages from a couple of SQL Servers.

The WMI query that is triggered by the DiscoverSQL2012DBEngineDiscovery.vbs did not return any valid instances.

Furthermore, on the SQL Server the SQL Server Configuration Manager could not be started anymore and terminated with the error that it could not connect to the WMI  provider.


Rebuilding provider on the affected SQL Servers.

  1. Start the command prompt (cmd)
  2. Navigate to (cd) “C:\ProgramFiles(x86)\MicrosoftSQLServer\110\Shared\” where 110 depends on the g the SQL server version installed on that machine
  3. Run the following command: mofcomp sqlmgmproviderxpsp2up.mof

Hope this helps!


SCOM Troubleshooting – Missing Reports

Recently I was deploying a new SCOM 2019 management group. I had Kevin’s SCOM 2019 deployment guide on the side for reference and to organize a general flow of the process. Everything was going great, until I came to the part of installing the reporting server. Now, I was following the guide closely and had all the best practices for permissions for all my SCOM accounts. But, still I was having a hard time installing reporting.

I installed SSRS, validated the URL, all was good. Then when I was running the reporting server setup, it was taking a long time and would finally fail. Now this was just for POC and I figured it was better to just start this piece again instead of spending time with the troubleshooting, looking into logs and stuff. So, that’s what I did. Cleaned up everything, uninstalled SSRS and ran the installer again. Well, this time again it took a lot of time, but was actually successful. But when I went into reporting tab and validate the installation, I saw this:

Hmm…not good. I see a bunch of reports missing here. So I started looking into the logs. And indeed, this is what I found:

Type: Error

Event ID: 26319 

User: N/A

Computer: Computername
Description: An exception was thrown while processing GetUserRolesForOperationAndUser for session id uuid:UUID. Exception Message: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) Full Exception: System.UnauthorizedAccessException: Access is denied. (Exception fro HRESULT: 0x80070005 (E_ACCESSDENIED))

Exception Message: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) Full Exception: System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) at Microsoft.Interop.Security.AzRoles.IAzApplication2.InitializeClientContextFr omStringSid(String SidString, Int32 lOptions, Object varReserved) at Microsoft.EnterpriseManagement.Mom.Sdk.Authorization.AzManHelper.GetScopedRo leAssignmentsForUser(IList`1 roleNames, String userName) at Microsoft.EnterpriseManagement.Mom.Sdk.Authorization.AuthManager.GetUserRole sForOperationAndUser(Guid operationId, String userName) at Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.SdkDataAccess.GetUserRol esForOperationAndUser(Guid operationId, String userName) at Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.SdkDataAccessTieringWrap per.GetUserRolesForOperationAndUser(Guid operationId, String userName) at Microsoft.EnterpriseManagement.Mom.ServiceDataLayer.SdkDataAccessExceptionTr acingWrapper.GetUserRolesForOperationAndUser(Guid operationId, String userName)

No worries though, a quick search brought me this:

When you try to install Microsoft System Center Operations Manager 2007 Reporting, the installation is unsuccessful

Now this link talks about issues with OS Windows 2000, but I was using Windows 2016, so I should not be technically facing this issue. However, since the accounts I was using were local accounts and not domain admins I still decided to try it out and add the SDK (DAS account in SCOM 2019) account in the Windows Authorization Access Group, which actually seemed to work. Slowly but steadily, all the reports started appearing. Problem solved! 😉

Hope this helps!


Automate SQL Express Instance removal from SCOM with PowerShell – Ruben Zimmermann

Ruben is back again with another Powershell banger! This time he presents you a Powershell script that will automatically detect and remove the SQL Express Instances from SCOM monitoring and save you from unnecessary overhead of removing them manually!


SQL Express Databases are a widely used storage for settings in applications or as data storage for small amount of data. Except of backups in cases it is not required to manage those databases.

The MS SQL Server Management Pack for SCOM discovers any edition. Thus, we can spot Express databases from the SCOM Console.

Unfortunately, the Management Pack can’t monitor Express databases and lots of unfixable alerts are thrown.

Manual solution

As described by Tim McFadden here

or by  Kevin Holman here

It is possible to either set filter strings to prevent the discovery for all Express instances by name.

This does not work if the Express is named as MSSQLSERVER.

MSSQLSERVER is also the default for SQL Standard and other editions.

Only choice then is to override object by object manually, or?

PowerShell solution

With a bit of PowerShell it is possible to override the discovery rules for Express editions no matter which name they have. – Put this script into your regular maintenance scripts to keep your SCOM free from Express instances:

# Defining Override Management Pack. - It needs to be created before starting.

$overrideMP = Get-SCOMManagementPack -DisplayName 'Custom.SQL.Server.Express.Removals'

# Get all Windows Servers Instances, needed as lookup to disable the specific computer object

$winSrvClass     = Get-SCOMClass -Name Microsoft.Windows.Server.Computer

$winSrvInstances = Get-SCOMClassInstance -Class $winSrvClass

# Get Express instances For SQL 2005 to SQL 2012

$classSQL2to8     = Get-SCOMClass -Name Microsoft.SQLServer.DBEngine

$instancesSQL2to8 = Get-SCOMClassInstance -Class $classSQL2to8

$expressSQL2to8   = $instancesSQL2to8 | Where-Object {$_.'[Microsoft.SQLServer.DBEngine].Edition'.Value  -eq 'Express Edition' }

$computersSQL2to8 = $expressSQL2to8.path

# Finding the computer objects which host SQL 2005 to SQL2012, store them in ArrayList

$targetComputers = New-Object -TypeName System.Collections.ArrayList

$computersSQL2to8 | ForEach-Object {

    $tmp   = ''

    $check = $false

    $check = $winSrvInstances.DisplayName.Contains($_)   

    if ($check) {

        $number = $winSrvInstances.DisplayName.IndexOf($_)

        $tmp    = $winSrvInstances[$number]

        if ($tmp -ne '') {       




} #end $computersSQL2to8 | ForEach-Object { }

# Disabling the Dicovery Rules for those computers which host SQL 2005 to SQL 2012

$discoveryRuleList = @(

  'Discover SQL Server 2005 Database Engines (Windows Server)'

  'Discover SQL Server 2008 Database Engines (Windows Server)'

 'Discover SQL Server 2012 Database Engines (Windows Server)'


foreach ($discoveryRuleItem in $discoveryRuleList) {

$discoveryRule = Get-SCOMDiscovery -DisplayName $discoveryRuleItem

$targetComputers | ForEach-Object {

Disable-SCOMDiscovery -Instance $_ -Discovery $discoveryRule -ManagementPack $overrideMP



#Removing the objects from SCOM. - This can take some Time!


# Get Express instances for SQL 2014

$classSQL2014     = Get-SCOMClass -Name 'Microsoft.SQLServer.2014.DBEngine'

$instancesSQL2014 = Get-SCOMClassInstance -Class $classSQL2014

$expressSQL2014   = $instancesSQL2014 | Where-Object {$_.'[Microsoft.SQLServer.2014.DBEngine].Edition'.Value  -eq 'Express Edition' }

$computersSQL2014 = $expressSQL2014.path

# Finding the computer objects which host SQL 2014, store them in ArrayList

$targetComputers   = New-Object -TypeName System.Collections.ArrayList

$computersSQL2014 | ForEach-Object {

    $tmp   = ''

    $check = $false

    $check = $winSrvInstances.DisplayName.Contains($_)

    if ($check) {

        $number = $winSrvInstances.DisplayName.IndexOf($_)

        $tmp    = $winSrvInstances[$number]

        if ($tmp -ne '') {       




} #end $computersSQL2014 | ForEach-Object { }

# Disabling the Dicovery Rule for those computers which host SQL 2014

$discoveryRule = Get-SCOMDiscovery -DisplayName 'MSSQL 2014: Discover SQL Server 2014 Database Engines'

$targetComputers | ForEach-Object {

Disable-SCOMDiscovery -Instance $_ -Discovery $discoveryRule -ManagementPack $overrideMP


#Removing the objects from SCOM. - This can take some Time!


# Get Express instances for SQL 2016

$classSQL2016     = Get-SCOMClass -Name 'Microsoft.SQLServer.2016.DBEngine'

$instancesSQL2016 = Get-SCOMClassInstance -Class $classSQL2016

$expressSQL2016   = $instancesSQL2016 | Where-Object {$_.'[Microsoft.SQLServer.2016.DBEngine].Edition'.Value  -eq 'Express Edition' }

$computersSQL2016 = $expressSQL2016.Path

# Finding the computer objects which host SQL 2016, store them in ArrayList

$targetComputers   = New-Object -TypeName System.Collections.ArrayList

$computersSQL2016 | ForEach-Object {

    $tmp = ''

    $check = $false    

    $check = $winSrvInstances.DisplayName.Contains($_)

    if ($check) {

        $number = $winSrvInstances.DisplayName.IndexOf($_)

        $tmp = $winSrvInstances[$number]

        if ($tmp -ne '') {       




} #end $computersSQL2016 | ForEach-Object { }

# Disabling the Dicovery Rule for those computers which host SQL 2016

$discoveryRule = Get-SCOMDiscovery -DisplayName 'MSSQL 2016: Discover SQL Server 2016 Database Engines'

$targetComputers | ForEach-Object {

    Disable-SCOMDiscovery -Instance $_ -Discovery $discoveryRule -ManagementPack $overrideMP


#Removing the objects from SCOM. - This can take some Time!


Feedback is appreciated 😊

Warm regards


Hybrid Monitoring Solutions during your transition to Cloud

Most enterprises now have either moved to cloud, or are moving towards it. And why not? Running your workloads on cloud services such as Azure frees you up from a lot of maintenance and administrative overheads, and you can use this time to do something better.

Here are some major benefits to moving to cloud:

  1. Less administration tasks – The cloud providers are responsible for managing and upgrading their infrastructure and so the customer does not have to worry about that.
  2. Cloud is flexible – It can adjust to the rapid growth or the fluctuations in business and adopt to that to provide you the optimized resources and hence managing costs.
  3. Cost efficient – Since you don’t have to spend on the big hardware and the maintenance that comes along with it, you can save that initial capital investment. Moreover, on cloud you mostly only pay for what you use and for the time you use it, it saves a lot of cost there as well.
  4. Disaster Recovery – Not every company, especially smaller sized, can invest into a Disaster Recovery strategy. On premise, it’s basically like running two datacenters and so double the cost. Moving to cloud eliminates that since the cloud provider is responsible to provide resiliency on their side to make sure your servers are up and running even if there is any hardware failure.

These are just some of the major benefits transitioning to cloud provides, there are many more. So if you’ve made a decision to move to the cloud – you’re looking at the right direction!

Now, on premise or on cloud – monitoring your infrastructure is equally critical. While the cloud provider will look after the hardware components, monitoring your servers and applications is still your responsibility, and something that you need to invest the time, money and efforts into. There are some great tools out there in the market to let you effectively monitor your infrastructure, like Microsoft’s System Center Operations Manager (SCOM), and Azure Monitor, which is a monitoring solution residing in Azure. So which one should you use to monitor your infrastructure?

Since you are transitioning to cloud (say Azure), you already have an on premise infrastructure. That most likely means you also already have made an investment in a tool like SCOM for monitoring it. So now you’re wondering, “So…does moving to Azure mean I have to decommission my SCOM now and move my monitoring to Azure Monitor?”

The good news is – you don’t have to choose between SCOM and Azure Monitor at all! (click to read more). They work the best together in a hybrid environment and complement each other very well.

SCOM is generally considered better in monitoring on premise workloads and has been used for it since a very long time. SCOM provides deep insights and a very thorough leveled monitoring of the workloads you want to monitor. It is also very easy to monitor your custom applications by authoring your own management packs. In short, it gives you a more detailed look into your infrastructure and alerts you based on it.

Azure Monitor on the other hand suits the best for Azure resources. Since it does not require installation, it is up and running in a matter of minutes. It also does not require you to worry about maintaining it, upgrading it or troubleshooting it. It is highly scalable, which means you can start on-boarding your servers immediately without worrying about the underlying infrastructure sizing capacity. However the biggest highlight of using Azure Monitor is probably its ability to query the data. Once the agent collects the data you can query it and get very granular. It is a very efficient way to make sure you’re only dealing with the data you want, and are only alerted for what you’re concerned with.

SCOM integrates seamlessly with Azure Monitor and can upload all the data it is collecting on premise to Azure Monitor where it can be queried. There are some great advantages of integrating SCOM with Azure Monitor, for example:

  1. You’re now getting more useful data rather than spam. Azure Monitor’s querying capability plays an important role here. You collect the data from Azure resources as well as on premise servers, and only extracting the data you need for alerting meaningful to you.
  2. Azure Monitor provides a single pane of glass for alerts and ways to manage them across your infrastructure, so it reduces the administrative overhead considerably.
  3. With all the data going into Azure Monitor, you can actually shut off a lot of workloads you don’t need from SCOM which means better performance with less resources used!
  4. SCOM monitors what it monitors the best – on premise infrastructure while Azure Monitor Monitors what it monitors the best – Cloud resources.
  5. You can reduce the dependency on only one monitoring solution, and run these two in parallel for resiliency.
  6. You can leverage PowerBI to visualize the data
  7. With release of SCOM 2019, with all its new capabilities and better visibility into cloud resources, this integration has become even better!
  8. It is much more cost-effective considering the returns it provides in value in a long run.

Hope this helps you plan your transition to cloud while maintaining the monitoring it all!

(Featured image credits to Microsoft!)


SCOM 2019 vs Azure Monitor: Which one to choose?

Having worked with both SCOM and Azure Monitor, recently I was asked to compare them both and suggest the right choice. First off, I have a disclaimer to make – Azure Monitor is great, but it can not replace SCOM entirely, not just yet.

SCOM 2019 was recently released and it came loaded with some great new features. Read more about it here. What I especially like is the new capabilities of it to monitor Azure resources. It now has insights more than ever before into the cloud. And with the ever rising numbers of cloud migrations or new cloud deployments, Azure Monitor’s popularity and importance keeps getting higher.

However, I believe these two tools have their own “personality” if you will, and work the best with each other. Here’s what I have to say about this in more details:

Defining Your Enterprise Monitoring Strategy: Close the Gaps with SCOM 2019 and Azure Monitor


Export All SCOM Subscriptions into a Text File

A few days ago I was in need to export all my SCOM subscriptions and be able to analyze them thoroughly. So I researched for a script/solution online but didn’t find anything particularly useful to my exact requirement. So I decided to write one myself!

I wrote a quick version of the script to get the job done, and indeed it was an investment of time well made! The script really spells out everything and it is very easy to analyze it visually and understand the relationships between the subscriptions, the channels as well as the subscribers. Sample output:

SCOM-Bob Cornelissen was gracious enough to publish the blog on his website as a guest post, read it here:

Export SCOM Subscriptions using Powershell


Updated! Database Query Result Monitoring MP

The company that I am working for Savision always looking for an opportunity to contribute to the community; therefore, I found time at Savision to work on the old OleDB query monitoring project. Now I am happy to announce that I fixed bugs and add more features, here is a list of key features:

  • Easy Authoring template to create and delete queries.
  • Support for SQL Authentication.
  • Dedicated views in SCOM console.
  • Historical data collection.
  • Monitor using consecutive samples condition and schedule filter.
  • Two or three monitoring states (healthy/warning/critical).
  • Recalculate state on-demand.
  • Grouping of multiple queries.

You are welcome to download it directly from the Savision website.

Leon Laude [Interview]

This time, we are meeting Leon, who is a very passionate about sharing his knowledge with the community and help others! He is definitely one of those guys that you go to to get your stuff done! Let’s get to know him better:

Q: Please tell us a little about yourself and your background.
A: My name is Leon Laude, I work as a full time consultant in mid-size company in Stockholm, Sweden. My focus is mainly on Microsoft products, such as Windows Server, System Center, Hyper-V, Azure, Active Directory and a few others. I started working with these roughly 7 years ago, I started my IT career as a help desk agent, then I moved on to 2nd line support for workstations and printers, and eventually I ended up working with everything within the data center such as servers, firewalls, networks and storage within the Windows environment.
Q: I see you are very active on Technet Forums and also run your personal blog. What attracted you to get involved into community contributions?
A: I like to help people, I have always liked helping others, it brings me joy in life and I can also learn many new things by helping others.
I’ve known the Microsoft TechNet community for quite some time now, and I’ve noticed how many questions get asked there, but there are also many questions that are struggling to get some answers. There is clearly a big need of more help there, so I thought that I can share my knowledge with others, and maybe it could be useful or help them out, so I ended up contributing to the community by answering and troubleshooting people’s questions and also writing Wiki articles.
Q: What technologies do you think are on the rise dominantly in near future? 
A: This is always an interesting question, but I think we can all agree on that the cloud is growing bigger and becoming more popular.
From what I hear and experience from current customers and colleagues, many companies want to go with the hybrid model, meaning having both on-premises and cloud services.
Another technology that is rising is containers, I believe this will also play a bigger role in the future.
Q: What advice would you give to the new IT professionals to be successful in their journey?
A: What you need to know about IT is that it’s constantly changing, find something you feel comfortable to work with and something you enjoy doing.
Don’t get stuck with some tool, because it won’t last forever, try to be open to new things and keep yourself up-to date with where the IT industry is heading.
It is also very important to keep a good balance between your work and your personal life.
Q: What do you enjoy to do when you’re not working?
A: I spend a lot of time contributing to the Microsoft TechNet community, because I enjoy doing it, which doesn’t actually leave me that much time to do other things.
My other passions are travelling around the world, doing sports to keep myself fit, being with my girlfriend, family and friends. I do love the nature and I’ve always liked exploring and trying out new things!
Thanks for the interview! 🙂
Thanks a lot Leon for chatting with us! 
You can get in touch with him here:

Enable SCOM subscriptions with Powershell with “Fewer messages”

This is one widely known “inconvenience” with working with Powershell to manage your subscriptions in a big SCOM environment. Consider the following widely common scenario:

You have a SCOM environment with a fairly large number of subscriptions. You have a planned maintenance scheduled, and so you plan to disable all your subscriptions so that the support teams aren’t bothered with unnecessary alerts. There is a simple quick way of doing this:

Import-Module OperationsManager
Get-SCOMNotificationSubscription | Disable-SCOMNotificationSubscription

This will disable all your subscriptions and stop sending notifications out. This is simple enough. The issue lies with enabling them back. The catch here is when you enable the subscription using Powershell, you start getting all the notifications that were “cached” during the time of the maintenance mode, and your support teams are bombarded with tens or even hundreds of such spam notifications. This is because when you enable the subscriptions with Powershell, it enabled it using the default option of “More messages”. Moreover, there is no apparent parameter/switch to change it to “Fewer messages”.

Get-SCOMNotificationSubscription | Enable-SCOMNotificationSubscription

If you are not familiar with these two options, here’s what they mean:

More Messages: This option means all the notifications that were cached since the subscription was disabled are forwarded to subscribers.

Fewer Messages: This option means only the notifications that are generated after the subscription was re-enabled are forwarded to the subscribers.

This discussion was actually happening a few days ago on the SCOM Community Gitter Lobby (make sure to join!), and Dimitry K. suggested an excellent workaround on this issue (Kudos, Dimitry!). There’s no parameter in the cmdlet to switch options but you can actually do this using a method. Here’s the code:

$sub = Get-SCOMNotificationSubscription | where {$_.displayname -like "SUBSCRIPTION_NAME"}
$sub.Enabled = $true

Note the last line – $sub.Update($true)

The value you pass to this method actually determines the option to choose more or fewer messages. If you choose Update($true), it is equivalent to fewer messages, and if you choose Update($false), it is equivalent to more messages in the GUI.

Hope this helps, and save you and your support teams from a bunch of spam emails!


Service Uptime Report in SCOM

This is a question that I often get asked by the customers I work with and apparently a lot of others as evident by the related questions on the forums.

One way of doing it is to author your own service monitor, but that involves considerable amount of knowledge and experience of management packs and the underlying coding. It usually takes a lot of time as well. Not everyone has the right knowledge or the time to spend on it so I thought I’d share a quick trick I do to measure uptime of a service and also be able to present it to the concerned parties in the form of a report.

It often happens that you have a service running on your servers and many organizations use it as a “proof” to show that the application was running, or maybe as analysis for troubleshooting, hence it becomes necessary to be able to measure the uptime of the service accurately and to be able to show it to the management and/or to pass it around.

The thing is, when you’re creating a monitor to measure availability of a service in SCOM, you usually choose a “Basic Service Monitor”. This monitor is not very “intelligent” and simply places an instance of itself on every server belonging to the class that you choose. However, you do have another option to monitor your service with, and it is the “Windows Service Template”. This type provides you much more features and finer control on your service monitoring. I wrote a blog earlier comparing these two options of service monitoring and when to use what.

SCOM basic service monitor Vs Windows Service Template

So the way the Windows Service template works is that it creates a discovery of it’s own and hence creates an actual class. This class can further be used to target other workflows that you may have to monitor this class of servers. Another advantage of that is you can now use this class to fetch a “Service Availability” report. For example:

Let’s say I’m monitoring the Spooler service on a bunch of servers, and I need to be able to see the uptime of this service on each of these servers. So I create a Windows Service Template monitor, call it “Test Spooler”.

Now once it’s done, go to “Discovered Inventory” tab under Monitoring. Click on “Change the target type” and you can see that now the “Test Spooler” is a class available for targeting.

This means you can also target your availability report to this target as well and measure the uptime of the service it is monitoring.

You can also fetch a report for a group of service monitors created this way. There’s a good discussion we had a while back regarding this exact requirement:

Service Availability Report

Hope that helps!