Task Scheduler Event IDs

Event ID	Task Category
100	Task Started
101	Task Start Failed
102	Task completed
103	Action start failed
106	Task registered
107	Task triggered on scheduler
108	Task triggered on event
110	Task triggered by user
111	Task terminated
118	Task triggered by computer startup
119	Task triggered on logon
129	Created Task Process
135	Launch condition not met, machine not idle
140	Task registration updated
141	Task registration deleted
142	Task disabled
200	Action started
201	Action completed
203	Action failed to start
301	Task engine properly shut down
310	Task Engine started
311	Task Engine failed to start
314	Task Engine idle
317	Task Engine started
318	Task engine properly shut down
319	Task Engine received message to start task
322	Launch request ignored, instance already running
329	Task stopping due to timeout reached
332	Launch condition not met, user not logged-on
400	Service started
411	Service signaled time change
700	Compatibility module started

SCOM Action Account changed- Getting Event ID 31551 and 31561 on Management Server

Cause
========
Still old sccount

Solution
==========

1.Log onto the SQL server that the OperationsManagerDW db is located on. Go to the dbo.ManagementGroup table.
2.Right Click and go to Edit Top 200 Rows.
3.Go to the WriterLoginName check out whether the old account is associated with this.
4.If it is, then change it to the new account

DPM 2016 Agent install fails with Error 347: An error occurred when the agent operation attempted to create the DPM Agent Coordinator service

Symptoms
=============
When you try to protect Windows Server 2008 or Windows Server 2008 R2 by installing the Microsoft System Center 2016 Data Protection Manager (DPM) Agent, the installation fails, and you receive one of the following error messages:

• When you try to install the agent from the DPM console:

Install protection agent on %servername% failed:
Error 347: An error occurred when the agent operation attempted to create the DPM Agent Coordinator service on %servername%.
Error details: The service did not respond to the start or control request in a timely fashion
Recommended action: Verify that the Agent Coordinator service on %servername% is responding, if it is present. Review the error details, take the appropriate action, and then retry the agent operation.

• When you try to install the agent manually on the protected server:

The program can’t start because mi.dll is missing from your computer. Try reinstalling the program to fix this problem.

Cause
=============
This issue typically occurs because a prerequisite is not installed. Most frequently, Windows Management Framework (WMF) needs to be updated.

Workaround
=============
To work around this issue, follow these steps:

1. Upgrade Windows Management Framework (WMF) on the production server to version 4.0.
2. Make sure all other prerequisites are installed.
3. Again try to install the DPM Agent.

Service Manager Install Fails with: An Error occurred while executing a custom action:RollbackCleanup.

An error occurred while executing a custom action:_CreatePortalWebSite.11EE91AB_EABF_48A6_9973_4DCD73190AC6
This upgrade attempt has failed before permanent modifications were made. Upgrade has successfully rolled back to the original state of the system. Once the correction are made, you can retry upgrade for this role.


Solution
=======
1.Open regedit from the Start menu.
2.Browse to the following subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
3.Create a new DWORD value named ServicePipeTimeout.
4.In the properties of ServicePipeTimeout, select Decimal, and give a value of 600000. (This is milliseconds).
5.Restart the Computer.

How to Clear the Outlook Cache

How to Clear the Outlook Cache

Removing the cache in Outlook doesn't delete emails, contacts, or other useful information

1. Save any work and close outlook
2. Press Windows key+R.
3. In the Run dialog box, enter %localappdata%\Microsoft\Outlook and press Enter.
4. Double-click the RoamCache folder to view the cache files.

      Note:
      Back up the cache files so that you can restore the files if something goes wrong.

5. To delete the cache files, press and hold the Shift key while selecting all of the files. Then press the Delete key, or right-click the highlighted files and select Delete.
6. Outlook automatically makes new cache files when you open Outlook.

Network Monitor TCP Filtering

Data Fields:

Field	Description	Example
TCP.Port	Filters on the Source or Destination port.  Used to find traffic based on port which is often associated with an application.	TCP.Port==80
TCP.Flags.Reset	Can be used to test and see if the reset flag is set.	TCP.Flags.Reset==1
TCP.Window	Window Size of the current TCP frame, but ignoring the scale factor. See Property.TCPWindowSize below.	TCP.Window == 0

 Properties:

Property	Description	Example
TCPRetransmit	A property that is set when a TCP retransmit is found.  Retransmits are often an indication of a network infrastructure problem and network congestion.	Property.TCPRetransmit == 1
TCPPayloadLength	Represents the TCP Payload Size.	TCPPayloadLength == 0
TCPCheckSumStatus	This is a string that represents if the check sum is valid or not.  This could be "Good" or "Bad".	TCPCheckSumStatus != "Good"
TCPDescription	A property to show the TCP Description for the current frame as opposed to the top most protocol description.  This is useful as a frame summary column.  You can also use it to search for specific retransmitted frames by searching for the text in the TCP summary, as the example shows.	TCPDescription.Contains("#472")
TCPAckNumber	The current frame's Acknowledgement Number	TCPAckNumber==1234
TCPSeqNumber	The current frame's Sequence Number	TCPSeqNumber==1234
TCPSeqeunceRange	The TCP Sequence range, as a string, which is the current seq number to the current seq plus the length of the TCP payload.	TCPSequenceRange.Contains("1234")
TCPShortAckNumber	A WORD representation of the Ack number to make it easy to compare and remember.	TCPShortAckNumber==1000
TCPShortSeqNumber	A WORD representation of the Seq number to make it easy to compare and remember.	TCPShortSeqNumber==1000
TCPFlags	A string representation of the various TCP flags for the frame: CWR, ECE, Urgent, Ack, Push, Reset, Syn, Fin.	TCPFlags.Contains("R")
TCPWindowSize	The Window Size for the current frame including the scaling factor if the 3 way handshake is available in the same trace.	TCPWindowSize==0

AD RMS - Unable to connect using cluster name (AD RMS console) - The request failed with HTTP status 401: Unauthorized.

Enable the following registry settings on the RMS server and reboot.

• HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
  Name:  DisableStrictNameChecking
  Type:  DWORD
  Value: 1
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
  Name:  DisableLoopbackCheck
  Type:  DWORD
  Value: 1

Disable Mixed Content Warning in Internet Explorer

If you would like to disable this security warning forever,
go to Tools -> Internet Options and select the Security tab. Make sure the “Internet” zone is selected and then click the “Custom Level” button. Scroll-down the list of options and
set the “Display mixed content” setting from “Prompt” to “Enable.”

SCOM : UNIX/Linux Heartbeat Failures After Applying KB2585542

The OpsMgr UNIX/Linux monitoring team at Microsoft is currently investigating an issue that results in heartbeat failures on Operations Manager UNIX/Linux agents after the security update KB2585542 is applied to a Management Server or Gateway.  This update fixes a vulnerability in SSL/TLS1.0, but appears to cause WS-Management connections to UNIX/Linux agents to fail. 

There are two viable workarounds (which must be applied to all Mgmt Servers and Gateways that manage UNIX/Linux agents):

1. Uninstall the update KB2585542 
2. Make a registry modification to disable the SecureChannel changes implemented in the update

Note: the registry modification described here and in the KB article effectively disables the security fix that the update implements, so the modified system is subject to the same vulnerability as an unpatched system.

Modifying the registry to disable the SecureChannel changes:

• A “FixIt” package is available in the KB article under the Known Issues section that can be used to disable the security update
• Alternatively, you can add the 32bit DWORD value:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
  \SecurityProviders\SCHANNEL\
   SendExtraRecord = 2

These changes take effect immediately and do not require a reboot.

Query notification processing failed due to a sql exception

Analysis

=========

Event Type: Error

Event Source: DataAccessLayer
Event Category: None
User:  N/A
Computer:
Description:
Query notification processing failed due to a sql exception.

Action Plan

==========

This is caused by a high number of sql queries to the Datawarehouse database. 

The work around is to add an override for the Event Data Collector rule in the Data warehouse connection server scope.

The Execution Attempt Timeout Interval Seconds property was changed from 0 to 6 and the Max Execution Attempt Count was set from 0 to 10.

Restart the System Center service on the SCOM and any gateway servers.