Windows Server

Zeno · Guest

Frequently on my agent desktops I get the following message. The
problem is initially when the agents are first installed they work
fine.... but after awhile..... they start logging the following message
it has happened to 3 of my WinXP agents:

Description:
The response processor was denied to execute a response. The action
account the MOM Agent is using doesn't have enough privileges. Returned
error message: Access is denied.

Response Details:

Rule ID: {BF1A8709-2D08-40DB-B435-61C39E163863}
Response description: script: {0C9EE4BF-FB06-451A-8853-CCE297D5F602}

I haven't changed any of the agent service or action account IDs
either........

Stumped............

James Hedrick [MSFT] · Guest

This is the MOM Agent Service Discovery Rule. Have the action accounts had
their passwords change? How often does the alert fire?
--
James Hedrick
Microsoft Operations Manager

Log a bug or Feature Request directly to the MOM Product Team by going to
http://www.microsoft.com/mom/feedback.
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Godzilla · Guest

Occurs whenever a full discovery of MOM Agent machines is
run............ which is one every day........

Can't figure out why... though......... it comes up on machines that
are in the same domain and some that are in a non-trusted domain as
well.........

James Hedrick [MSFT] · Guest

You are only getting one failure per server per day correct? This rule is
set to run its script every 30 minutes, so I am a little baffled.

Try this.
1. Create a task in the Admin console
- Run on agent
- Run "MOM Agent Service Discovery" script
- Target to "Computer"
2. Run the task from the Ops console (will have to press Ctrl-F5 to see task
if not available)
3. Check the "Task Status" view for a 9898 event (or 9899 if the script
catastophically fails)
4. There should be some trace information

Does the trace information give any further infromation?
When run this way, is the "Access is denied" event generated?

--
James Hedrick
Microsoft Operations Manager

Log a bug or Feature Request directly to the MOM Product Team by going to
http://www.microsoft.com/mom/feedback.
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Godzilla · Guest

I've checked that the desktops are receiving rule config. changes but
it just keeps on logging the above errror

Godzilla · Guest

James,

Thanks for your help...........

Did as suggested and it did come back with error status 9898 as
mentioned. Here's the exact message from the event

The task 'Microsoft Operations Manager\MOM Agent Service Discovery' has
failed to execute against 'Computer:Test2\B000BCD47D0F2'.
Task Id: {B89991EE-E7A6-4A05-BF12-6C44E13336D6}
Execution Id: {C3279150-BA99-4187-8A9E-4F7CDE7E7177}
Launched By: Test2\nbe7q8r
Reason to fail: Access is denied. (0x80070005)

Any other ideas .......... what I have done on some of the agent
machines is trying reinstalling them.... but then after awhile this
message starts appearing again...... I have already checked the
"action account" already has admin on the machines and the MOM Service
is running as Network Service....

Cheers

Godzilla · Guest

I've made some new findings.......

The error mainly occurs on our WinXp SP1 machines which use the NEtwork
Service for the MOM Service, I changed the service acct to Local System
and it seems to run fine....

But on our Win2k3 machines even though they're also using the Network
Svc acct they don't give any errors, although we have setup the a GPO
"impersonate" for the network service acct. But we haven't set the
impersonate on WinXp policies....

Would the reason be.... the "network service" has inadequate
permissions on the desktops.....?

Godzilla · Guest

Ahh this is driving me nuts........ as mentioned before changed to the
Local Sys account and ran the "MOM Agent Svc Disc" it worked once and
returned the data.....

Tried running it again and it doens't work and comes back with the same
errors.......

Sorry.........

Thanks for ur time...........

James Hedrick [MSFT] · Guest

Have you tried using a local admin account?

--
James Hedrick
Microsoft Operations Manager

Log a bug or Feature Request directly to the MOM Product Team by going to
http://www.microsoft.com/mom/feedback.
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Godzilla · Guest

Will try to see if that works..........thanks...............

macallen · Joined: 28 Jul 2006 Posts: 2

I'm having very similar problems. Here's my environment:
* MOM 2k5 SP1
* 600+ XPSP2 systems being monitored, all completely identical in every sense
* Agent is running as local system (default out of the box)
* MOM domain account (used to install the agent remotely) is a local Admin

On about 20% of my systems, I receive the following errors:

The response processor failed to execute a response. The response returned the error message: The handle is invalid. (rule info is a GUID that I don't recognize, occurs every 10 min)

The response processor failed to execute a response. The response returned the error message: The object exporter specified was not found. (as above, GUID and every 10 minutes)

The response processor was denied to execute a response. The action account the MOM Agent is using doesn't have enough privileges. Returned error message: Access is denied. (lists a CMD or script that it won't run, does this on several scripts, but not all, and occurs randomly...sometimes the script runs successfully, sometimes it does not)

Some systems get all 3, all the time. Some get them randomly. They have no local security policies, they are all controlled and locked down by a central GPO, they are all identical hardware, built from a Gold disk, etc. They're commodity systems, completely replacable by a new box in minutes.

This is baffling me, and any aid you can provide will be greatly appreciated.

	Windows Server Forum Index -> MOM	All times are GMT
Page 1 of 1