Running SCOM 2012 with CU1, Windows Server and AD MPs installed. I'm wondering if there's a way to override the Collection rule for Service or Driver Failed to Start events? I have a service that fails on every server several times a day and is owned by a separate product support group who don't have a real fix for the issue. It isn't affecting the server performance and it almost seems like a false positive. Is there any way I can tune out just that service from the rule? It looks to be all or nothing when I go into Authoring.

HI Carl You can only make changes that have been exposed as overrides as the rule is in a sealed management pack. It looks for a variety of event ids (a range within 7000 -> 7041) with Event Source service control manager. The only override though is enable \ disable. Your only solution would be to disable this rule and create your own identical rule tweaked to exclude the service that you didn't want. Regards GrahamRegards Graham New System Center 2012 Blog! - http://www.systemcentersolutions.co.uk View OpsMgr tips and tricks at http://systemcentersolutions.wordpress.com/