Thomas Ellermanns view on System Center

This blog will discuss features, functions and views on Operations Manager and Service Manager

Automatically close incidents after x number of days

Automatically close incidents after x number of days

  • Comments 5
  • Likes

I had a request from a customer that the would like a workflow to close all resolved incidents, 7 days after they were resolved.

Several solutions exists on the internet, but I think this one is the most simple.

First you need to install the SCSM Powershell Cmdlets, as it includes a cmdlet called Get-SCSMIncident and Set-SCSMIncident. You can download it here, just follow the guide on how to install it on your SCSM Server. 


  1. Start the Service Manager Authoring Tool. (Download it here, and make sure you have the latest SCSM CU applied)
  2. Create a new management pack, for example Close.Resolved.Incidents
  3. Rigth click Workflows and select Create
    1. Name: Closed_Resolved_Incidents
    2. Trigger: Run at Scheduled time
    3. Schedule: Everyday at 10:00 PM
  4. Drag and drop the “Windows PowerShell Script” activity from the activities toolbox to your workflow
  5. Name the script CloseResolvedIncidents



6. In the Details pane, click “..." in the Script body

7. Insert the following script:

Import-Module SMLets

Get-SCSMIncident -Status Resolved -InactiveFor 7.0:0:0 | Set-SCSMIncident -Status Closed -comment “Autoclosed after 7 days of being inactive and resolved”

Note: -InactiveFor 7.00:00:00 is a Powershell-TimeSpan and therefore means Days.Hours:Minutes;Seconds. You can change to InactiveFor to what timespan you need.

8. Save the Management Pack

9. In the Folder where you saved the Management pack, you will also have a dll-file located, for this example Closed_Resolved_Incidents.dll, copy the dll to C:\Program Files\Microsoft System Center\Service Manager 2010 directory on your Management Server

10. Import the management pack into Service Manager, either via the console or Powershell

11. Whenever you have scheduled the workflow to run, goto Administration, Workflows and check the status.

This will now run once a day and close all resolved incidents that have been inactive for e.g 7 days. The comment will be added as a an Analyst Comment.

Recently Cireson released a free MP that allows you to do the same, including SR, PR, CR and RR, and also with the ability to scheduled the workflow within the console. So if you don't want to created the MP, try to have a look at this one:




  • When doing this in authoring tool i get an error stating "Invalid character in the given encoding"

  • Note: Apparently it does not take well to end of line characters... ;-)

  • When I try to execute this Cmdlet Get-SCSMIncident -Status "Resolved" -InactiveFor "5.0:0:0" , from the example above, this error occurs:
    Get-SCSMIncident : The criteria could not be parsed. See inner exception for details.
    At line:1 char:1
    + Get-SCSMIncident -Status "Resolved" -InactiveFor 5.0:0:0
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo : NotSpecified: (:) [Get-SCSMIncident], InvalidCriteriaException
    + FullyQualifiedErrorId : Microsoft.EnterpriseManagement.Common.InvalidCriteriaException,SMLets.SCSMIncidentGet

    Also, if I try save this management pack I get error "Invalid character in the given encoding"

  • Hi, i made a workflow to set status closed with a comment, however the private attribute is set to null and no mail with a comment is sent to the user. Any way to set private to not null or false?

  • I got the same error about invalid characters. Its the quotes, they are encoded in Chrome as open and close quotes opposed to just a normal keyboard double quote. I replaced and it works.

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment