System Center, Automation, Powershell and other Thoughts

Set Resolution State directly in SCOM 2012 Beta

Ok, most of you might not care about those little things that changed inside of SCOM 2012 beta, but there are really nice changes.
The first thing I regcognized was the Deauft MP is not set as default.

Second, little but nice, extra:

You can set the resolution state of an alert directly without opening the properties of an alert.

At many of our customers, there are custom resolution states established. So alerts are set to “In Progress” for example. So everybody knows the alert isn’t new and a supporter has started to resolve it.

Before SCOM 2010 Beta, the user had to open the alert to set these value.

Default Management Pack – not Default in SCOM 2012 Beta

Since a few years, every consultant for SCOM is on it’s way to tell the customers: “Do not save anything into the Default Management Pack”

There where tips like renaming the Default Management Pack into something like: “Do Not Use This On”
And the best practise in every MP documentation to use a new MP instead of the Default MP.
Also there is a comunity MP that monitors the changes on the Default MP to give an early hint that there where things saved on.
And there are a lot of guides how to manually clean up the Default MP.

In SCOM 2012 Beta there was done some nice thing, helping keeping the Default MP clean.
If you disable a rule or a monitor, in SCOM 2007 it was save into the Default MP.
In 2012 Beta, it is not. But see your self:

As you can see:
Disabling a rule leads to the same dialog as overriding a rule does.
In here “Enabled” is checked and set to “false” 

And the best thing in here is: You have to select a Management Pack!
The Default MP isn’t selected by default. 

Thanks a lot Microsoft!

‘Database connection failed’ – System Center Orchestrator 2012 Beta installation

After trying to install the System Center Orchestrator 2012 Beta on an Hyper-V testsystem,
I stumbled over an error in the Wizard.

While the sql server was up and running I inserted it into the field.
After selecting “Next” the wizard said: “Database connection failed”

The next steps where:

  • Checking the sql server firewall
  • Checking all sql services are up and running
  • Ping and connection are successfull
  • Access with the domain accounts where successfull

After checking all possibilities, I remebered, that the active directory computer account was recycled.

There where an Installation of the Orchestrator beta with the same computername in that active directory before.
So I decided to rejoin the computer. 

Now the wizard did the installation.


If you have a “Database connection failed”-error on installation, check the active directory computer object also.
Perhaps clearing the service principal name attribute will also help you out.

DFSR: Powershell script for removing “temporary file” flag to replicate a file

At a customer we decided to remove the need of backing up files in the branches, so theres no need for the employees to switch tapes or usb drives.
To get all data backed up nevertheless, we implemented DFSR between the branches and the head quarter. In the head quarter the data are backed up.

A quick look in the DFSR reportings showed up, that there are files, that where not backed up.

With a little search in a famous serach engine, we stumbled throughwards that blog:

At the customer, there are some scanning devices responsible to convert all paper mail into digital files. Those devices are generating its output directly on the file server.
All files generated that way do not loose the temporary file attribute after saving the file.

So we buidled a powershell script that run’s as scheduler to remove these flags on a daily base.

If you are interested in this on,

here you are:


This script is for determing files with  "Temporary File" attribute set.

The script shows files where the "Temporary File"-attribute is set. Those files are not synchronised by Microsoft DFSR.
Also the script can remove the attribute, based on the file extension.
The common extensions are a set as default, but can be overridden by command.

.PARAMETER startpath
    Specifies the file path to start the search for files with "Temp File"-attribute set.

    Required?                    true
    Default value
    Accept pipeline input?       false

    If this switch is used, the "Temp File"-attribute is removed from the file.

    Required?                    false
    Default value
    Accept pipeline input?       false
.PARAMETER extensions
    Specifies the file extensions that should be inspected.

    Required?                    false
    Default value   (".pdf",".xls",".doc",".docx",".xlsx",".ppt",".pptx",".bmp",".jpg")
    Accept pipeline input?       false

.PARAMETER countOlny
    If given, only the count of the affected file is shown.

    Required?                    false
    Default value  
    Accept pipeline input?       false

.\tempfiles.ps1 -startpath D:\

This Example lists the files where the "Temp File"-attribute is set located on the hole D:\ - Drive

.\tempfiles.ps1 -startpath D:\ -removeTemp

This Example lists the files where the "Temp File"-attribute is set and removes the "Temp File"-attribute.

.\tempfiles.ps1 -startpath D:\ -removeTemp -extensions ".exe",".jpg"

This Example lists the files where the "Temp File"-attribute is set if the file extension is exe or jpg only.
See Link for further description.


<a href=""></a>


param([string]$startpath=(read-host "Start Pfad"),[switch]$removeTemp,[string[]]$extensions=(".pdf",".xls",".doc",".docx",".xlsx",".ppt",".pptx",".bmp",".jpg"),[switch]$countOnly)

if(!($startpath -eq ""))
if(test-path -path "$startpath" -ErrorAction SilentlyContinue)
Get-childitem $startpath -recurse | `
ForEach-Object {
 if (($_.attributes -band 0x100) -eq 0x100)
  foreach($ext in $extensions)
  if($_.extension.tolower() -eq $ext.tolower())
     $_.attributes = ($_.attributes -band 0xFEFF)
$count = @(Get-childitem $startpath -recurse | where-object { $_.attributes -band 0x100 }).count
"There are $count files affected in $startpath with seleted extensions: `"$extensions`""
"Path $startpath not found!"
 get-help .\tempfiles

Monitoring conhost.exe with SCOM 2007 R2 – KB977648

Actually there is a bug within an update, that replaces the conhost.exe on Server 2008 R2 systems that do not have SP1 installed.
At these serversystems the eventlog for application is flooded with “EventID 33,  SideBySide” pointing towards conhost.exe and a missing assembly.

For further details on that error see the following KB article:;EN-US;977648

 The corresponding hotfix can be found here:

At a customer, there are many servers with 2008 R2 installed.
So we decided to build a monitor in SCOM that displays an information for every system that hasn’t been updated with the hotfix or an sp1 installed.

The monitor fires the following script, checking the fileversion of conhost.exe.

Dim oAPI, oBag
Set oAPI = CreateObject("MOM.ScriptAPI")
Set oBag = oAPI.CreatePropertyBag()

Set objFSO = CreateObject("Scripting.FileSystemObject")
conhostVersion =  objFSO.GetFileVersion("c:\windows\system32\conhost.exe")

If InStr (1,conhostVersion, ".16823", 1) > 0 Then
 Call oBag.AddValue("Status","BAD")
 Call oBag.AddValue("Status","OK")
End If

Call oAPI.Return(oBag)

So after enabling the monitor, we have 138 servers left to patch.

Kind regards and happy patching.

OperationsManager DB is growing fast

A customer installed a new instance of Operations Manager 2007 R2 CU 4 and added some management packs for monitoring server, sql, active directory and exchange.

Also the agent was deployed to 10 servers in the infrastucture to tune the managment packs.

After round about one week, the OperationsManager database size was 4GB.

Five days later, it was at nearly 8GB big.

So the customer asked, if that growing is as expected and was surprised, that we told him, it should be quite below 1GB with this amount of management packs and agents.

To get a handle on the fast growing of the database site, I stumbled over a create blog from Kevin Holeman about “Useful Operations Manager 2007 SQL queries”.

Yes, it is an old article, but it is the best for finding spammers that fill up the database by running some queries against it.

In conclusion:

The unexpected database growing was caused by the event collection rule from the exchange management pack and a leftover form exchange troubleshooting that traced verbose into the eventlog on a mailbox server.

Thanks Kevin for an other very usefull blog post.

Error 19 (0×80070013) in Tasksequence

Did you ever saw a error 19 in a tasksequence for rolling out office 2010 or other apps with SCCM 2007 R3?

The error 19 is pointing towards “drive is read only” and the smsts.log looks that way:

In our case, the issue was pointing towards the office 2010 installation files, because it is installed using an cusomtized msp created with /admin argument.
And in there where several things in the msp pointing towards this direction like custom template stores and so on.

But Office wasn’t the culprit. All was caused by bitlocker.
Yes, bitlocker.

If you ask why bitlocker, here is the answer:
The files for the installation of office 2010 where cached for local deployment and support of roaming users.
The bitlocker GPO in the active directory domain was set to:
Deny write access to fixed drives not protected by BitLocker

As the tasksquence tries to store the data on the drive with the highest avaiable free space, the second partition was used.
But as the partition wasn’t encrypted yet, the creation of the _SMSTaskSequence folder failed with “drive is read only” error 19.

We have decided to submit a but report on this error as we couldn’t understand why the cache tries to place the files on a read only drive.

So, if anyone else stumbles on that, check you GPOs and as a best practise, apply the GPO after installation hast finished…

Scheduled reports are not generated: Error: Thread was being aborted

A customer had the error that scheduled reports where not sent out from the SCOM 2007 R2.
In that case, the status of these schedules where: Error: Thread was being aborted.

There was no more error in the eventlog or any other location that pointed out to an error.
Also if the reports where opened from the opsmgr console, they where shown fine.

So one thing we figured out was, that the time slot for the reports was really big.
For example: Get CPU-Usage Performance for 5 Servers for the last year.

So we had a look at the server usage at the time when the scheduled report should have run and found that the server was under big pressure at that moment.
We recommended to move the reportingservices to an other machine for running the reporting services only and to spread the reports all over the days.

Now also big reports are generated as requested.

Reports do not show graphs when scheduled


After having that issue at a customer,
I found a blog (  
and a corresponding kb article at Microsoft that describes that behavior.

Not mentioned in the kb article is, that the written code has to be place between the <runtime> </runtime> section of the reportingservices.exe.xml file.
Also you have to be sure that the code is placed next to existing <dependentAssembly></dependentAssembly> sections if they already exist.
And, at least, the reporting services have to be restarted.

If the reporting services do not start up right after your modification, you wrecked up the xml structure.

When everything works fine, the report shows the graph like it does in the interactive view.

System Center Operations Manager 2007 R2 Cumulative Update 4 released

Yesterday, Microsoft released the cummulativ update pack number 4.

Before you are going to install it, read the corresponding documentation twice.
Also make sure, you follow the steps written in the KB article.

I would recommend to install it at a test environment at first (if you have).
For production environments, wait round about 2 weeks to get the most issues found by the community.

But after that time don’t miss to install the CU4.

Kind regards,