Hi Kevin

Did you ever get a chance to look at this in more depth?

"Yes - that will be a soon to come post - I am going to get some assistance and figure out a good way to handle dynamic run as account distribution using the SDK - since the UI leaves a lot to be desired.  Stay tuned. "

Cheers

Graham

I went through your directions..  Now I just got dozens of alerts saying "An account specified in the Run As profile "Microsoft.SQLServer.SQLDefaultAccount" cannot be resolved."

What is causing that?

And how do I distribute it?

You wrote: "Our goal is to make the initial discoveries – which target the “Windows Server” class, run under the default agent action account.  THEN – ALL subsequent discoveries should run under the SQL Discovery Profile/Run As account.  Therefore – we should add the “SQL DB Engine” class."

Most of my sql servers can be monitored using the default action account (local system), but I have some sql servers that need to be monitored using another account (domain account). How do I target this runas account? I can not use the SQL DB Engine class because then all sql servers will use this run as account.

Regards,

Chris

Hi Kevin, thanks for this information. My concern is if you are using the Local System account for the “Default Agent Action Account”, what would stop someone from making the agent run scripts that could potentally do damage to the system?

Kevin,

Thanks for your work here.  I am having a problem recently where a SQL instance was recently encrypted and as a result the SCOM agent is not able to query the MSCluster namespace via WMI.  I am getting repeating event 5605 in the app log of the cluster node.  Here is an article that appears to describe the problem I am having.

support.microsoft.com/.../2590230

As a nice bonus for me, this seemed to cause all SQL and cluster monitors on that SQLcluster to thrash offline and online causing an impressive state storm filling up our Ops DB and taking the RMS offline.  Temporarily placing the SQL/cluster objects in maintenanace mode addressed the state storm and allowed me to free space and make sure the RMS was back online again.  However now I am not monitoring the SQL or clustered objects on that cluster so I need to find a way to address the root cause.  

I am not sure, but could perhaps you could confirm if setting up a Run as account with higher level permissions to execute the SCOM SQL/Cluster workloads on these encrypted instances would address this issue?

I am concerned that it won't because the eventid suggests that the resolution has to do with changing the authentication level to Pkt_Privacy.  

Any thoughts?

Thanks,

Keith

Great and very interesting blog. I think it’s also an informative. Thanks for sharing.

Please, also remember that, as stated by the MP documentation, the use of run as profiles - Low Privilege Environment - is not supported in clustered environment.

By the way : why isn't it supported ?

Kevin,

    Awesome post!  I am almost ashamed I have only recently been able to implement RunAs for SQL in our environment.  But I do not understand why RunAs setup seems to double the work.  Distributing the creds to certain systems from the account, then setting up the profile to apply the account to those same systems seems duplicitous.  I do not understand but am glad it works to optimize our monitoring capabilities.  We are in a decentralized environment where SQL team is not responsible for every SQL server in our enterprise, distribution of specific RunAs creds to specific SQL servers.  I was able to point the profile config to a group but you can't push RunAs account creds to a group.  But one of the options for adding systems to RunAs cred distribution is 'Show suggested computers'.  I picked that and hit Search and the agents for each of the systems from the group were listed.  A quick way to add all the correct agents to get those creds!  Thanks very much!

Hi Kevin, Do you have any update about a way to do a dynamic run as account distribution. Thanks so much in advance

Hi Kevin, I have SCOM 2007 R2 in my environment & I am using a SQL Action account as specified above for the SQL monitoring. I have noticed that we are not getting any alerts from the DB, we tested this by decommissiong the DB also, but no alert from the host server on SCOM. We feel, there is no monitoring happening for the SQL DB. How can I troubleshoot this issue?