You may encounter the following alert if SCOM's System Center Data Access Service is (re)started:
This alert is logged if the required SPNs for the SDK/DAS service (OMSDK service) are not present, and the account running the service is unable to create them automatically because of insufficient permissions.
This article contains fictional account and server names. Be sure to replace them according to whatever names you have running!
Verify the existence of the required SPNs using the command prompt and setspn -L:
setspn -L CONTOSO\s_scom_das Registered ServicePrincipalNames for CN=s_scom_das,OU=Users,DC=contoso,DC=com: MSOMSdkSvc/SCOM01 MSOMSdkSvc/SCOM01.contoso.com setspn -L CONTOSO\SCOM01 Registered ServicePrincipalNames for CN=SCOM01,OU=Computers,DC=contoso,DC=com: MSOMHSvc/SCOM01 MSOMHSvc/SCOM01.contoso.com
If you have more than one management server, verify the existence of all SPNs for all of the servers (4 per server, as in the above example output).
Note that the SPNs MSOMSdkSvc/SCOM01 and MSOMSdkSvc/SCOM01.contoso.com should not be present on the computer account, unless you are running the SDK/DAS service as LOCAL SYSTEM.
If the SDK/DAS service is running as LOCAL SYSTEM instead of a domain service account, the output of setspn -L should be:
setspn -L CONTOSO\SCOM01 Registered ServicePrincipalNames for CN=SCOM01,OU=Computers,DC=contoso,DC=com: MSOMHSvc/SCOM01 MSOMHSvc/SCOM01.contoso.com MSOMSdkSvc/SCOM01 MSOMSdkSvc/SCOM01.contoso.com
If any of the SPNs are missing, you can manually create them with setspn -S:
For the service account (only if running as a domain service account):
setspn -S MSOMSdkSvc/SCOM01 CONTOSO\s_scom_das MSOMSdkSvc/SCOM01.contoso.com
And for the computer account (although less likely to be missing):
setspn -S MSOMHSvc/SCOM01 CONTOSO\SCOM01 setspn -S MSOMHSvc/SCOM01.contoso.com CONTOSO\SCOM01
If the service is running as LOCAL SYSTEM, the SPNs (MSOMSdkSvc/SCOM01 and MSOMSdkSvc/SCOM01.contoso.com) that are supposed to be registered on the service account (CONTOSO\s_scom_das), will have to be registered on the computer account (CONTOSO\SCOM01) instead.
In SCOM 2012, you may get an alert about this every time the SCOM server is restarted. This is normal as SCOM wrongfully checks the presence of the MSOMSdkSvc/SCOM01 and MSOMSdkSvc/SCOM01.contoso.com SPNs on the computer account. This alert would not appear if the SDK/DAS service is running as the LOCAL SYSTEM account, but this is bad practice.
This alert is technically a bug. Your best bet is to ignore this alert, or create an override for it.
« ‹ | October 2024 | › » | ||||
Sun | Mon | Tue | Wed | Thu | Fri | Sat |
1 | 2 | 3 | 4 | 5 | ||
6 | 7 | 8 | 9 | 10 | 11 | 12 |
13 | 14 | 15 | 16 | 17 | 18 | 19 |
20 | 21 | 22 | 23 | 24 | 25 | 26 |
27 | 28 | 29 | 30 | 31 |