I'm seeing a strange issue our scom 2007 r2 at the minute. There are dozens of servers that are showing that the DFS Replication eventlog can't opened as the channel can't be found.

However these aren't dfs servers so it shouldn't be found really, they are a mix of application servers and web servers. After looking back through the State Change events for the servers that are being incorrectly reported it seems to have started  10/10/2012. The exact error message is:-

The Windows Event Log Provider was unable to open the DFS Replication event log on computer 'SERVERNAME.DOMAINNAME.com' for reading. The provider will retry opening the log every 30 seconds. Most recent error details: The specified channel could not be found. Check channel configuration. One or more workflows were affected by this. Workflow name: many Instance name: many Instance ID: many Management group: DOMAIN-scom 

I can put the monitor into maintanence mode however this doesn't help with getting to the cause of why the monitor is being applied. I've got a vague recollection of a windows update incorrectly adding a registry key for DFS a while ago however I don't recall the KB and bing-fu doesn't seem to be up to much today.

We are running SCOM 2007 R2 but are in the starting phases of deploying 2012 R2 and would like to get these sorts of issues resolved prior to the change over.

Any pointers would be greatly appreciated.

GUB

Hi,

By default those severs without DFS role installed should not be discovered by DFS MP, as there are registry keys for DFS, so they are discovered, you may delete those keys and check the result. (Note, before changing registry keys, backup first)

I would like to suggest you disable DFS discovery for those servers which does not have DFS role installed to workarround this issue.

Regards,

Yan Li

Thanks Yan_Li,

I've disabled the discovery for the moment. I think I may have found the source of the issue. KB2663685 was installed and then the erroneous collection started.

I've removed the patch from a few test servers and bounced the health service, this has removed the DFS MP from the server and cleared the associated alerts.

I'm doing a task sequence now for the bulk of the servers as manually removed a patch from ~1000 servers would be far too time consuming.

GUB

You can write a script to bulk remove the patch from those servers.

wusa /uninstall /kb:<kbnumber>

Regards,

Yan Li