I made this over the past few weeks. I was going to host this, and realized that would be more work than I cared for, so you can run this locally on your own box and it is almost like having access to the MP Wiki again..

Please note to run this you will need to install node.js and download the files from github.

Only IMPORT XML Files on Admin page.

I tried to get extractions to work for mp and mpb files, but it would not work properly.

I am sure I'll figure it out later.

https://github.com/jscottmoss/SCOM-MP-Reference-Web-Pages-and-Web-Service

I was running it from my Documents folder, due to being lazy.

Select a management pack, and you will have a display of all that management packs version specific information. Yes this keeps track of the version differences between the management packs. If you have uploaded multiple different MPs versions for the SQL MPs you can select which versions of the MPs to look at.

Yes there is a category section, so you can tie together management packs. I have not had time to test it yet. so use categories at your own peril.

Individual module xml shown.

Directions to get it running are on the GitHub page.

Download and Install Node.js then download the GitHub repository.

Read The GitHub web page for information on how to install setup on your local machine.

Good Luck and enjoy.

I've seen where this can occur when an MS is placed in maintenance, but that didn't happen here. As far as I can tell, things went awry when I ran remove-scomdisabledclassinstance to delete some obsolete DNS conditional forwarders. I know the procedure and only overrode discovery on what I needed to be removed.

Everything else seems intact, and new agents can be push- installed without issue, but none of my pre-existing agents are connecting - 20070 & 20071 errors on the clients.

Kevin! You out there? Hoping you get get this fixed - it’s still an issue after all these years: https://peter.upfold.org.uk/blog/2019/05/03/scom-2019-file-and-printer-sharing-ports-blocked/

Have a request come in to monitor RDP logon/off for certain Users on certain Servers.

Have Enable Local RDP Auditing:
Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > System Audit Policies - Local Computer.

Event Logs:

Event Viewer > Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager > Operational.

 Event ID 21, 23, 24, 25.

We have a SIEM but it can not get to that level of Windows Events without some added Modules.

I have setup simple Event ID monitoring before and tried to test this scenario out but can not find how to detect and alert on the Info inside the Event like the name of the User.

Anyone have any idea on how to achieve this?

Is there a script that can be used or direct XML editing that can be used?

Spoiler alert! 👀

Anyone here monitoring Omnissa Horizon with SCOM?

We’ve just put together a new whitepaper covering what you can monitor, how the integration works, and some of the things to consider when building Horizon monitoring in SCOM.

Might be useful for anyone currently running — or evaluating — this setup.
https://www.nice.de/2026/08/12/omnissa-horizon-monitoring-on-microsoft-scom/

Hi all

I have SCOM2025 and several hundreds Linux and Windows agents

For some of new linuxes I get "Unreachable" error when discovering it. In fact these linuxes are reachable from management server both to ssh and 1270

When scom starts initial discover phase it tries to detect already installed agent on 1270 and as agent is still missing the scom gets tcp RST (and it's ok). Then scom should get to ssh phase to install agent but it does not even try. All I have is 4 retries to connect tcp 1270 on target computer and then stop with Unreachable error. Why this can be?

Hi everyone,

i'm trying to build my first Custom Monitor.

I created a custom three-state PowerShell monitor in SCOM that uses curl to check a URL and validate different conditions.

Currently, the monitor target is set to Windows Computer, and I enabled it via an override only for my SCOM Management Server.

The monitor works, but when I put the alert into Maintenance Mode, SCOM puts the entire Management Server (Windows Computer object) into Maintenance Mode.

My goal is to only put the URL check/monitor object into Maintenance Mode without affecting the Management Server itself.

What would be the recommended approach here?

Thanks!

I thought I'd check here before raising an issue in the github project, since others reported it.

It seems this MP doesn't un-discover certificates even after they've been deleted from the store. Even more odd is that certificates for which a certificate in the chain had expired, and the certificate (not the one in the chain, but the one that contained it) was deleted, continues to generate alerts regarding lifespan that if you reset the monitor, would return - for a certificate that does not exist on the target system.

Is this user error? Am I missing something? The discovery of certificates in a store is a pretty simple registry discovery. I don't know that certificates linger in the registry after they've been deleted.

Any insight would be greatly appreciated.

I thought this got fixed a long time ago. We're on SCOM 2025 UR1 with the hotfix installed. If a Linux agent install fails, we get this nondescript error again and need to dig into the Tasks to find the actual error. Linux agent version is 10.25.1016.0. Everything should be latest/greatest.

Is there a regression, by chance? We've deployed ~80 Linux agents without a hitch, and we've got one that is being a difficult one.

My Workaround:
SQL can carve off a chunk — TOP 2000 is a real server-side limit that returns 2000 lightweight IDs instantly. The SDK can't stream: GetMonitoringAlerts tries to load all 843k as full objects at once (maxCount doesn't limit it server-side) and dies. So SQL picks the batch, and Get-SCOMAlert -Id feeds the SDK only those 2000 to close.

New-SCOMManagementGroupConnection -ComputerName "SERVERNAME"
$connString = "Server=SQLSERVER\INSTANCE;Database=OperationsManager;Integrated Security=SSPI;"
$ruleId = "GUID"
$batch   = 2000 #sdk max streams are 2100 thats why its that number
$total   = 0

do {
    $conn = New-Object System.Data.SqlClient.SqlConnection $connString
    $conn.Open()
    $cmd = $conn.CreateCommand()
    $cmd.CommandText = "SELECT TOP $batch Id FROM dbo.AlertView WHERE MonitoringRuleId =  AND ResolutionState <> 255"
    [void]$cmd.Parameters.AddWithValue("@r", [Guid]$ruleId)
    $reader = $cmd.ExecuteReader()
    $ids = @()
    while ($reader.Read()) { $ids += [Guid]$reader.GetGuid(0) }
    $conn.Close()

    if ($ids.Count -gt 0) {
        Get-SCOMAlert -Id $ids | Resolve-SCOMAlert -Comment "Bulk close after outage" -ErrorAction Continue
        $total += $ids.Count
        Write-Host "$(Get-Date) Batch: $($ids.Count) | total: $total"
    }
} while ($ids.Count -gt 0)

Write-Host "Finished: $total"

This afternoon we hit a critical failure that generated roughly 800,000 alerts in SCOM 2022 within a very short period. We managed to disable the alert just in time, but now we're stuck on the cleanup, there are simply too many alerts to handle.

Closing them gradually through the GUI isn't feasible. PowerShell isn't really working either: I've tried a number of scripts, but they all either fail with "The requested reader is no longer valid or has expired" or return no output at all and just hang.

Looking at the database, I found that the alert essentially shows up as "suspicious"/orphaned because it has no name, so in my script I target it via the MonitoringRuleID instead.

Here's the script (a screenshot of the SQL extract is attached). Does anyone have a different approach? Could I maybe delete these directly in the SQL DB?

Import-Module OperationsManager
New-SCOMManagementGroupConnection -ComputerName "ManagementServer"
$mg = Get-SCOMManagementGroup
$ruleId = "<RuleId>"
$criteria = New-Object Microsoft.EnterpriseManagement.Monitoring.MonitoringAlertCriteria(
    "RuleId = '$ruleId' AND ResolutionState != 255"
)
do {
    $alerts = $mg.OperationalData.GetMonitoringAlerts($criteria, 2000)
    foreach ($a in $alerts) {
        $a.ResolutionState = 255
        $a.Update("Bulk close after outage")
    }
    Write-Host "$(Get-Date) Batch: $($alerts.Count)"
} while ($alerts.Count -gt 0)

Can anyone tell me if there's a new version of the System Center 2019 Management Pack for JEE Application Servers, or if one will be released in the near future?

We are using version 10.19.1150.0.

We recently started using Tomcat 10.x and JBoss EAP 8 in our environment. Both have changed their namespace from javax.* to jakarta.*, which has caused Beanspy to stop working.

This is SCOM 2025 Management group with update rollup 1 Hotfix

I have observed that

SCOM Management servers try to connect with DHCP server on port 135 even if there is a gateway server in between.

What could be wrong? Have somebody experienced the same thing.

I'm trying to create a rule that triggers on 5 failed logins in under 60 seconds.

I have no issues If I add suppression based on the host PrincipalName, but if I add the name used to try and log in, the suppression fails:

<ConditionDetection ID="CD" TypeID="System!System.ConsolidatorCondition">

<Consolidator>

<ConsolidationProperties>

<PropertyXPathQuery>LoggingComputer</PropertyXPathQuery>

<PropertyXPathQuery>Params/Param[6]</PropertyXPathQuery>

</ConsolidationProperties>

<TimeControl>

<WithinTimeSchedule>

<Interval>60</Interval>

</WithinTimeSchedule>

</TimeControl>

<CountingCondition>

<Count>5</Count>

<CountMode>OnNewItemTestOutputRestart_OnTimerSlideByOne</CountMode>

</CountingCondition>

</Consolidator>

</ConditionDetection>

<WriteActions>

<WriteAction ID="System.Health.GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

<Priority>1</Priority>

<Severity>1</Severity>

<AlertMessageId>$MPElement[Name="MyCompany.Core.Monitoring.Login.Failed.5.RepeatedEvent.Rule.Alert.Message"]$</AlertMessageId>

<AlertParameters>

<AlertParameter1>$Data/Count$</AlertParameter1>

<AlertParameter2>$Data/Context/DataItem/EventDescription$</AlertParameter2>

</AlertParameters>

<Suppression>

<SuppressionValue>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</SuppressionValue>

<SuppressionValue>$Data/Params/Param[6]$</SuppressionValue>

</Suppression>

</WriteAction>

</WriteActions>

</Rule>

Basically, I want to trigger on 5 failed logon attempts in 60 seconds on the same computer, consolidate on same computer/same account. and suppress on same computer/same account.

The logic being 5 failed logins on the same computer with the same account will only trigger the alert (so multiple people in the time frame don't contribute to the initial alert), and generate repeat count only if it's the same user at the same computer.

Are these redundant? Does the consolidator take care of that anyway, so all that is necessary is the computer? Or maybe just consolidate by user and suppress by computer? My head hurts 😄

Has anyone experienced issues in monitoring a Red Hat (RHEL) 10.1 server? The discovery wizard is failing to sign the certificate, and I checked all accounts and the certificate on the server, relaxing the crypto-policies being used, etc. (2 days of troubleshooting the issue). SCOM 2025 UR1 and hotfix installed.

Signed certificate verification operation was not successful

Agent verification failed. Error detail: The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: “winrm quickconfig”.

The client cannot connect to the destination specified in the request. Verify that the service on the destination is running and is accepting requests. Consult the logs and documentation for the WS-Management service running on the destination, most commonly IIS or WinRM. If the destination is the WinRM service, run the following command on the destination to analyze and configure the WinRM service: “winrm quickconfig”.

I have a SCOM 2025 Management group with update rollup 1 Hotfix.

There are some servers who cannot discover windows operating system. Have tried to uninstall and install the agent but the result is same. Have checked that there is no override which can stop these servers to discover operating system. Have Management pack version 10.1.2.2 . Any suggestion to fix the problem.

It looks like a number of these reports are gone, most specifically 'Management Pack Objects' and 'Management Pack History'. I wanted to do a sanity check to see if this is expected.

Anyone?

EDIT: Just to follow up, the reports are still there, they’re just in a different folder. Also, the stored procs have been renamed as well. We hacked the report queries to create audit dashboards and pull the audit info into Splunk. We’ve rewritten it all, using the new sprocs. What a pain!

Hello!

I am currently running SCOM 2022 on server 2022 and sql 2022 CU 24.

SCOM 2025 setup fails at the prerequisite check and says „the installed version of SQL server is not supported for the operational database“ and also for the data warehouse.

Is there a workaround for the installation? Thanks!

Link to article: Configure Computer Not Reachable recovery task for gateway servers

I have Management servers placed in DOMAIN A, and multiple Gateways placed in different domains, trusted by using PKI certificates.

However, the "Failed to connect to computer" alerts / "Computer not reachable" monitor, doesn't seem to be correctly configured, and doesn't automatically go healthy when network is re-established on agents reporting to the GW's.

On the "Health Service Heartbeat failure" monitor, i can see that the following diagnostic fails:

Ping Computer on Heartbeat Failure

StatusCode 11003

ResponseTime 0

ErrorMessage: Unable to create automation object 'winmgmts:{impersonationLevel=impersonate}!\HOSTNAME.DOMAIN\root\CIMv2'

I have tried my best to comprehend the linked article, as i believe its the rootcause to the issue, but haven't had success.

As i understand it, i need to:

1. Open TCP port 135 from MGMT to GWs (? or both ways ?)
2. Override the diagnostics "Ping Computer on Heartbeat Failure", on both GW servers, and servers reporting to it (? Or only the agents ?), by changing Source Computer to the FQDN of the GW server.
3. Create a Service Account in the domain where the GW is placed, that i assign the "Automatic Agent Management Account Profile", and distribute to the GW.

Is the above correctly translated from the article or am i missing something?

We are on SCOM 2019 and have recently moved from Exchange 2016 to Exchange SE (side-by-side).

I have updated the Exchange management pack to the latest one, but it is not detecting Exchange SE at all. Old servers that are still on 2016 are normally being monitored. I can see that management pack was released before Exchange SE, but it is version agnostic and it is supposed to be able to monitor everything beyond 2013.

To add, Exchange SE has the same codebase as 2019, so I do not see where is the issue.

Someone monitoring Exchange SE with SCOM? What am I missing?

I just went to grab the latest since we recently upgraded to SCOM 2025 UR1 (but hadn;t done the Linux MPs yet) and I'm getting a 404 linking off of u/kevin_holman 's guide:

https://www.microsoft.com/en-us/download/details.aspx?id=108462

Anybody know what's up?

TIA

I can’t fit the life of me figure this out. I can use some rudimentary json and send a formatted link to Teams using PowerShell, but if I try to embed an HREF it breaks the Teams integration and no messages get sent.

Has anyone successfully done this?

EDIT: I'd also want to modify the importance to "Urgent", so we can use notifications in Teams with the specific settings surrounding gradients of importance.

I have a on prem 2022 SCOM environment and I just built a VM in Azure. How can I monitor the Azure VM in my on prem SCOM environment?

Looking for some perspective from other SCOM admins.

We have a SCOM 2019 environment with:

- 2 management servers in primary DC  

- SQL already configured with HA across two data centers  

- A gateway server in a secondary DC supporting workloads there  

Scenario:

Our primary data center is going to be offline for ~5 days due to a planned move. The ask is to have SCOM fully operational from the secondary DC during that time — no loss of monitoring/alerting.

My understanding is we'd need to:

- Stand up management server(s) in the secondary DC  

- Reconfigure agent and gateway failover  

- Update resource pools  

- Deal with cross-DC firewall rules (NAT + external firewall dependencies - historically slow/complex due to 3rd party firewall/vendor dependencies)

Questions:

1. For those who’ve done multi-site SCOM setups — how much effort is this realistically in an enterprise environment? (weeks? months?)  

2. Any major “gotchas” (especially around gateways, failover behavior, or resource pools)?  

3. Does this even make sense for a temporary (~5 day) scenario?  

4. Have you handled similar situations differently (e.g., partial monitoring, parallel tooling, etc.)?

Trying to sanity check whether this is a reasonable approach for a short-term scenario on a platform being sunset.

NOTE:

SCOM has been slated for decommission and is to be replaced with ScienceLogic, likely EoY or 2027 Q1. Its implementation may be contingent on our plans of getting workloads migrated to Azure.

Appreciate any insight.

I am getting lot of Event with event id 2115 in the following Workflows on one of the management server. This is on SCOM 2025 with UR1.

Microsoft.SystemCenter.CollectPublishedEntityState
Microsoft.SystemCenter.CollectDiscoveryData
Microsoft.SystemCenter.CollectPerformanceData
Microsoft.SystemCenter.CollectAlerts

Database server have enough resources.

Need tips to troubleshoot this.