Hi Everybody, After uninstalling Authoring console R2 from my SP1 SCOM2007 and fixing the DLL's with DotNet 2.0 SDK. The agent managed computers is greyd out, even the management server is grey and I can't change or update anything. Regards, Francois Regards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

Hi Have you tried flushing the health service folder on the Management Server? - Stop the System Center Management Service on the Management Server - Go to Program Files\System Center Operations Manager 2007\Health Service State - Rename the Health Service State folder - Start the System Center Managemetn Service on the Management Server Check the operations manager event log on the Management server for errors. Cheers Graham View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Hi Graham, Did what you said, here are two different errors I received: Event Id: 7022 The Health Service has downloaded secure configuration for management group HERNIC, and processing the configuration failed with error code Cannot find the certificate and private key for decryption. (0x8009200B). Event Id: 26338 The SDK service is not able to generate auditing events for SDK operations. Verify that the SDK service account has the correct rights to generate security audits. The SDK service will continue without generating auditing events. Details: System.ComponentModel.Win32Exception: A required privilege is not held by the client Regards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

Hi 1) This looks similar to what you are seeing for event 7022: http://www.dreamension.net/index.php?option=com_content&view=article&id=84:opsmgr-2007-secure-storage-configuration-error-&catid=1:latest&Itemid=9 I wouldn't delete keys - just rename them so that you can rename them back if it doesn't work. 2) It seems the SDK account is lacking all the required rights - "The SDK service is not able to generate auditing events for SDK operations. Verify that the SDK service account has the correct rights to generate security audits." and "The SDK service will continue without generating auditing events." Is the SDK account running as local system or a domain account? If the latter, is it a local administrator on the Management Server? Does it have the local privileges to generate auditing events? Do you just have the one Management Server? If not, do all Management Servers have the same problem? Cheers GrahamView OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/

Hi, I exported the key and then removed the default values as specified in the website. Still waiting for changes. The sdk is using a domain account that is a domain admin, local admin, OpsMngr Admin, OpsMngr Advanced operator, OpsMngr Authors. I'm using a single server. Cheers FrancoisRegards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

Hi Graham, I have rebooted the server after removing the values from those reg keys as shown in the website. I've left it over the weekend but everything is still greyd out. Kind Regards, FrancoisRegards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

Have you checked this link: http://support.microsoft.com/kb/2288515 Regards, Marc Klaver http://jama00.wordpress.com/

Hi Marc, I have run through all the relevant scenario's in the website. Everything is still greyd out. There is no performance bottle necks on the server, the sql or the network. SCOM has its own dedicated server and SQL. Here is some of the event ID's I have: 7005 7022 20022 1220 26338 7021 7015 Thanks for the response. Kind Regards, FrancoisRegards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

Hi, Based on my research, I would like to suggest the following: 1. Regarding the Event 7022, please try the methods in the following Knowledge Base article: The Health Service does not process configuration files, and events 7022 and 1220 are logged every 30 minutes on a domain controller on which you installed the Operations Manager 2007 agent http://support.microsoft.com/kb/946428 2. Check the SDK Service account referring to: How to change the credentials for the OpsMgr SDK Service and for the OpsMgr Config Service in Microsoft System Center Operations Manager 2007 http://support.microsoft.com/kb/936220 OpsMgr security account rights mapping - what accounts need what privileges? http://blogs.technet.com/b/kevinholman/archive/2008/04/15/opsmgr-security-account-rights-mapping-what-accounts-need-what-privileges.aspx Meanwhile, I would like to share the following with you for your reference: Troubleshooting gray agent states in System Center Operations Manager 2007 and System Center Essentials http://support.microsoft.com/kb/2288515 Fixing troubled agents http://blogs.technet.com/b/kevinholman/archive/2009/10/01/fixing-troubled-agents.aspx If the issue persists, please check the Event Log on both the servers and agents; if there are any related errors, please let us know the details. Hope this helps. Thanks. Nicholas Li - MSFT Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Nicholas After completing all the steps on the website for point number one, the management server is no longer greyd out. This is the critical error that it is reporting on itself: Summary The Audit Collection Service has entered a stopped state. When the Audit Collection Service is not running, no audit data forwarded by the Agent will be written to the database. Causes The Management Server Audit Collection is not configured properly. Resolutions • Check System event logs to determine why the Audit Collection Service has entered a stopped state. • Configure and start the Audit Collection Service on the Management Server. I am busy with number 2 on your list. Will keep you updated. Regards Francois Regards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

HI, I get the following error when trying to start the Audit Collection Service: Event ID 7023 The Operations Manager Audit Collection Service service terminated with the following error: Access is denied. Francois Regards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

Hi Francois, Thank you for your update. Regarding the error, please try the methods in the following artciles: The Operations Manager Audit Collection Service does not start and Event ID 4668 is logged after you install Audit Collection Server from a read-only source http://support.microsoft.com/kb/936579 Audit Collection Server (AdtServer) fails to start when ACS installed from CD Media (Access Denied 0x00000005) http://blogs.technet.com/b/cliveeastwood/archive/2007/04/09/audit-collection-server-adtserver-fails-to-start-when-acs-installed-from-cd-media-access-denied-0x00000005.aspx Hope this helps. Thanks.Nicholas Li - MSFT Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Nicholas, After completing the above mentioned steps the service starts and then stops directly after that. Here is the new error message: Event Id 4618 Event Type: Error Event Source: AdtServer Event Category: None Event ID: 4618 Date: 5/10/2011 Time: 9:58:44 AM User: N/A Computer: HFC11 Description: Error occured on database connection: Status: 0x04080000 ODBC Error: 15151 ODBC State: 42000 Message: [Microsoft][ODBC SQL Server Driver][SQL Server]Cannot find the user 'AdtServer', because it does not exist or you do not have permission. Database: SqlWriter Connection: Maintenance Statement: /********************************************************** For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Thank You Francois Regards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

Hi, At this time, please check the account settings referring to the following documents: How to Move the OperationsManagerAC Database in Operations Manager 2007 http://technet.microsoft.com/en-us/library/cc540397.aspx Please see step 5 and 6 under “To move the OperationsManagerAC database” OpsMgr security account rights mapping - what accounts need what privileges? http://blogs.technet.com/b/kevinholman/archive/2008/04/15/opsmgr-security-account-rights-mapping-what-accounts-need-what-privileges.aspx Meanwhile, regarding the Event 4618, please also refer to: AdtServer Event ID 4618 - Logon Failed http://blogs.technet.com/b/jonathanalmquist/archive/2008/03/13/adtserver-event-id-4618-logon-failed.aspx Thanks again for your time and efforts.Nicholas Li - MSFT Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Nicholas, Sorry for getting back to you only now, we had some electricity supply problems and I was down for a couple of days. I have tried everything on the three websites you sent me. The Operations Manager Audit Collection Service starts and then stops directly after. Here is some of the event ID's and descriptios: Event ID 4680 Event Type: Error Event Source: AdtServer Event Category: None Event ID: 4680 Date: 5/16/2011 Time: 11:32:30 AM User: HERNIC\momservices Computer: HFC11 Description: The Operations Manager 2007 audit collector service encountered a fatal error while attempting to perform a database operation. The Operations Manager Audit Collector service is unable to continue operation and is stopping. Please check the log for previous events describing the nature of the problem. To restore the collector to operation, you must troubleshoot Microsoft SQL Server or the Microsoft SQL data access components to find the cause of the error and resolve it, then restart the collector service. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Error Event Source: AdtServer Event Category: None Event ID: 4619 Date: 5/16/2011 Time: 11:32:30 AM User: HERNIC\momservices Computer: HFC11 Description: Database partition created: Guid: fdd4c598_6440_4280_b5a8_a87f003f566c Status: 0x00000005 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Event Type: Error Event Source: AdtServer Event Category: None Event ID: 4618 Date: 5/16/2011 Time: 11:32:30 AM User: N/A Computer: HFC11 Description: Error occured on database connection: Status: 0x04080000 ODBC Error: 2760 ODBC State: 42000 Message: [Microsoft][ODBC SQL Server Driver][SQL Server]The specified schema name "AdtServer" either does not exist or you do not have permission to use it. Database: SqlWriter Connection: Maintenance Statement: /********************************************************** For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Thanks, Regards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

Francois, For how long were you experiencing this issue? and how many days do you have configured as retention days? The data from the forwarders to the collectors and to the db is transferred almost realtime, so even if you fix this permissions error, you may have already inconsistent or obsolete data in the database. You may want to check that, and if needed, you may want to recreate a new ACS db. If you want to recreate the DB, the easiest way to do so is by running the opsmgr setup and select the option "Create a new database". Jose

HI Everybody, I was not paying attention when executing the above mentioned fix and I uninstalled my management server, user interfaces and the web console. When trying to re-install them I get the following error. Event Type: Error Event Source: MsiInstaller Event Category: None Event ID: 11334 Date: 5/30/2011 Time: 11:34:27 AM User: HERNIC\momservices Computer: HFC11 Description: Product: System Center Operations Manager 2007 -- Error 1334.The file F_custsat.dll.41712086_AFA9_408D_84D8_5884F692B6CD cannot be installed because the file cannot be found in cabinet file Data.Cab. This could indicate a network error, an error reading from the CD-ROM, or a problem with this package. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 7b 46 46 45 35 45 36 46 {FFE5E6F 0008: 44 2d 45 35 33 30 2d 34 D-E530-4 0010: 43 36 36 2d 39 39 31 37 C66-9917 0018: 2d 35 35 44 33 36 39 41 -55D369A 0020: 41 45 30 44 34 7d AE0D4} Please help, as my scom has been down for weeks.Regards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

Wow, you have actually uninstalled the management server? Well alright, so now you have to get back to installing it again. If you get errors from media (which this looks like) please try to extract those media (copy files) to the local disk in a temp folder and install from there. Just to make sure it is not due to access problems to the media. Bob Cornelissen - BICTT (My BICTT Blog)

Hi BOB, Sorry for only getting back now, here is the error I get when trying to install the management server: Event Type: Information Event Source: MsiInstaller Event Category: None Event ID: 11729 Date: 6/6/2011 Time: 2:01:01 PM User: HERNIC\momservices Computer: HFC11 Description: Product: System Center Operations Manager 2007 -- Configuration failed. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 7b 46 46 45 35 45 36 46 {FFE5E6F 0008: 44 2d 45 35 33 30 2d 34 D-E530-4 0010: 43 36 36 2d 39 39 31 37 C66-9917 0018: 2d 35 35 44 33 36 39 41 -55D369A 0020: 41 45 30 44 34 7d AE0D4} Regards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

Hi Graham, Since our last conversation I have completely destroyed my SCOM server. I uninstalled all the componants except the database. I then edited the registry to reset the current installed version for scom because it did not want to run the installer at all. After this it tries to install but only gets to a certain point and then does a rollback. This is the only event that gets written to the event log. Event Type: Information Event Source: MsiInstaller Event Category: None Event ID: 11729 Date: 6/6/2011 Time: 2:01:01 PM User: HERNIC\momservices Computer: HFC11 Description: Product: System Center Operations Manager 2007 -- Configuration failed. For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Data: 0000: 7b 46 46 45 35 45 36 46 {FFE5E6F 0008: 44 2d 45 35 33 30 2d 34 D-E530-4 0010: 43 36 36 2d 39 39 31 37 C66-9917 0018: 2d 35 35 44 33 36 39 41 -55D369A 0020: 41 45 30 44 34 7d AE0D4} Is there any way I can send you the install log for scom as I do not understand what it says. Kind Regards, Francois Kaljee Regards Francois Kaljee IT Systems Administrator MCITP Svr2k8 Direct: +2712 381 1000 Cell: +2782 852 2367 Fax: +2786 602 8482 GPS: S 25 39.639 E 27 50.699 Hernic's Street Address: R/E of PTN 103 De Kroon 444 JQ Brits 0250 South Africa Hernic's Postal Address: P.O.Box 4534 Brits 0250 South Africa

HI Francois, did you get this fixed already?Bob Cornelissen - BICTT (My BICTT Blog) - Microsoft Community Contributor 2011 Recipient