Home » System Center Service Manager » Update incidents by e-mail in Service Manager 2010


Welcome to contoso.se! My name is Anders Bengtsson and this is my blog about Azure infrastructure and system management. I am a senior engineer in the FastTrack for Azure team, part of Azure Engineering, at Microsoft.  Contoso.se has two main purposes, first as a platform to share information with the community and the second as a notebook for myself.

Everything you read here is my own personal opinion and any code is provided "AS-IS" with no warranties.

Anders Bengtsson

MVP awarded 2007,2008,2009,2010

My Books
Service Manager Unleashed
Service Manager Unleashed
Orchestrator Unleashed
Orchestrator 2012 Unleashed
Inside the Microsoft Operations Management Suite

Update incidents by e-mail in Service Manager 2010

Update: you can download my scripts here

Out of the box Service Manager 2010 can generate incident based on incoming e-mails. But there is no default feature to update incidents based on incoming e-mails. In this post I will show you a solution to that. The flow of the e-mail will be

  1. A end-user sends a e-mail to scsm@scsmserver.hq.contoso.local
  2. The end-user is connected to the normal Exchange server, which will forward all e-mails for the scsmserver domain to my SCSM server
  3. On the SCSM server a vbscript will see if the e-mail contains “Contoso-IR” or not. If it does the e-mail will be moved to a “UpdateSCSM” folder, else it will be moved to a “NewSCSM” folder. As then it will generate a new incident in Service Manager
  4. Another vbscript will check all e-mails in the “UpdateSCSM folder”. The script will read “FROM” from each e-mail and which incident to update, it will then kick of a power shell script that will update the incident and attach the e-mail as related item.

Instead of having Service Manager looking at all incoming e-mails the first vbscript will look at them. If the script decides that it is a e-mail that should generate a new incident it will move them over to a another folder and let Service Manager handle it with the default feature. Before you start, make sure to enable incoming e-mails in Service Manager (Administration, Settings, Incident Settings, Incoming E-mails).

The first thing you need to configure is e-mail deliver to a folder. I use my Exchange 2010 machine to send all e-mails for the scsmserver.hq.contoso.local to my SCSM server. On my SCSM server I run IIS and the built-in SMTP feature. It will drop all e-mails to C:\Inetpub\mailroot\drop. I have schedule the following vbscript to run every five minute to sort e-mails. If the e-mail contains “contoso-IR” it will be moved to the UpdateSCSM folder, else to the NewSCSM folder.


Once the e-mail is moved to the new folder, in my case C:\Inetpub\maildrop\drop\newSCSM\, the following scripts looks into it

This script looks in all files and tries to find the incident ID. In the e-mail that SCSM send out to end-users about the incidents the subject contains Contoso-IRXX where XX is the incident ID. The script then take the file patch and the incidnet ID and starts a power shell script. This power shell script, see picture below, runs a cmdlet that my colleague Patrik has build, you can download it here. The Set-SCSMIncident cmdlet let you update a incident. The power shell script input a comment and attach the e-mail as a related item to the incident.


The following five pictures first show the notification template that sends a e-mail to the affected user when a incident is created. As you can see the subject line contains Contoso-IR<Incident ID>, that is also the string that we look for in incoming e-mails. In the last four pictures you can see the e-mail that a affected user recives when a incident is registered. The end-user replies with and includes the Contoso-IRXX in the subject line. In Service Manager the incident is updated in the action log and the e-mail is attached as a attached file.

If you have problem with open EML files, please take a look at this post.




  1. Hey,
    Firstly great post but I’m having a problem with the timestamp for the comment in SCSM being added by the powershell script. It’s adding 12 hours onto the real time. I think this is because the time-zone is UTC+12 so something is adding on the difference from UTC.
    Any Ideas on how to fix this??


  2. Hi Arne

    I havde the same isue

    It looks like its only when the subject, contains non english letters, æ ø å etc.

  3. Has anyone else had an issue with seperate reply emails being attached to the wrong incidents?

    For example: I have two seperate incidents that I request user input for, they both reply back at the same time and therefore are processed through the scripts at the same time and when processed by the PS script they are both attached to the first incident that is read by the Powershell script. Is there a way to get each reply to attach to the correct incident?

  4. Hi
    Something happened after I installed SMLets. The spaces in the Incident title are replaced with underscore. Have anyone else experinced this problem or is it just me?

    I have verified that when the e-mails are in the drop-folder/newscsm, the format is correct. Once they are imported in to SCSM, the title is altered. This started a few hours ago, after I started to config SMLets and the config in this article.

    I’m running SCSM 2010 CU3.

    Hope someone knows more about this than I do, because I’m lost at the moment.


  5. Finally I fixed it.. I had to change the update.ps1 to load the modules

    Import-Module SMLets
    Set-SCSMIncident -ID $args[0] -Comment $args[1] -AttachmentPath $args[2]
    Write-host $args[0]
    Write-host $args[1]
    Write-host $args[2]

  6. The first script runs.. it does sort the email into the correct folder.
    The second script does run no error but also no results.

    I dont seem to get this working. I have changed the prefix to Contoso-IR I see the powershell script in the wscript and it does not seem wrong.. I don’t see the attachment on the incident.. I think I need some help getting this to work.. please sent help on email address arjan.langendijk@gmail.com

  7. I don’t know if Gertjan is reading new comments posted here, but if you are, could you please send a copy of the scripts to philip.colmer@googlemail.com?

    Many thanks.

    Anders, I have modified the “update.vbs” script so that it is a bit more robust if people want to change the IR prefix string. Happy to share the changes.


  8. i have been trying to get this to work, but the email sits within the DROP folder and stays there forever.
    I have set the incoming email process folder for SCSM to “C:\inetpub\mailroot\NewSCSM” and update emails to “C:\inetpub\mailroot\UpdateSCSM”
    i have my exchange deliver emails to SCSM SMTP at “C:\inetpub\mailroot\Drop”
    i have everything setup perfectly, and emails land in the drop folder. but the handlemails.vbs does not do anything at all. the emails stay in drop folder forever. all i have is a wscript process runnig at 25% of CPU. HELP!
    my test box is a windows 2008 HPC Edition SP2.

  9. the handleemails script will sort all incoming e-mails. so when it is done, it might moves some e-mails to the drop folder that SCSM is reading. So not under the script is done, there are e-mails that SCSM can read.

  10. Hi Anders,

    A great post, very descriptive and easy to follow. I’m a little puzzled on one point though! The ‘handleemails’ script runs every 5 minutes to sort through email in the drop folder, however SCSM processes email in the drop folder in under 30 seconds, so SCSM can open tickets submitted by email much faster, before the script runs.

    Clearly from your configuration and other people posts I can see that it works so am I missing something fundimental here?


  11. Hi Anders

    Thank you for a great post.

    I’m also receiving “Type mismatch error: ‘CLng’ Line 30” when the update.vbs file runs. Not too clued up with VB. Do you perhaps have any recommendations?

    Our incident numbers are in the format of “INCxxxxxx”

    Thanks and regards

  12. I cannot find any instructions on setting up Exchange 2010 with SCSM…the newly released documents give instructions on how to setup with older versions, but not with Exchange 2010. Any topics known on how to set it up with Exchange 2010, as it is quite different.

  13. Hey,
    This is brilliant.
    I’ve got it up and running, except 1 thing.
    When the update script runs, it seems to add the attachment to the job as it should, but it’s not adding a new record to the action log.

    What could be causing this?

  14. I have 2 issues
    1. When I send a reply to with the incident ID, it creates a NEW incident, with a NEW ID
    2. The update.ps1 files – the Add-PSSnapin smcomlets – comes back with that “‘smcomlets’ is not installed on this machine”

    Another question is when you said you scheduled the VB script handlemails to run every 5 mins. You mean that you add it to the Windows Task Scheduler?

    The scripts are in c:\scripts
    I made a modifications to the handlemails and update VB, to change “Contoso-IR” to be “IR” because our incident numbers are “IRXXXX”

    OS is WinServer2008 R2
    SMSC 2010

    Love the scripts, just need to get it working. Any help would be appreciated


  15. Hi, I’ve managed to get this script set up for my environment, however I can’t seem to get it to run as a scheduled task?!? anybody had any issues with this? I’ve a sneaking suspicion it’s down to it needing an elevated command prompt to run from….

  16. Pete, sorry for the late reply.
    The script will depend on what e-mail structure you use in your environment.
    For instance, we use exchange 2007 with Outlook 2007, and I can search by script where certain empty lines are. In between these lines are the encoded parts of the eml file, being the body, and after that the possible attachments.
    First I decode the eml with a tool called b64dec.exe, and then I cut out the different parts between the empty lines (that script got a bit long because when there are no attachments, the ammount of empty lines before the body-part differ) and put them into the incident with procedure described above.
    If you are still interested in the scripts, please tell me how you want to receive them.

  17. Gertjan, I would love to obtain a copy of your final script to apply. This expected out-of-the-box type requirement is a great bolt on to satisfy business requirements of my deployment.

    How are we going to integrate this into the Exchange voting buttons however, I would love a ‘review activity’ email to be able to respond with the Exchagne Yes/No function….

    Great work guys

  18. Hi all, I have implemented this and it works great!

    Gertjan Maeckelbergh, Is it possible to get a copy of your script that adds the body of the email as a comment instead of the entire .eml file please?

    This seems like a feature that should have been included out of the box.

  19. Sorry for the premature questions. I now have the complete workflow working. (the parameter problem was solved by forcing the content to be a string with | Out-String)

    So, when an end user replies on a ‘Request for user input’ from an analyst, this reply is caught by your scripts and decoded and stripped by mine and injected in the incident action log by your cmdlets. Thanks for the great work.

    Now only MS has to integrate it in their product.

  20. Tried to use the Set-SCSMIncident with parameter -comment and the content of a reply of an enduser, but the comment parameter does not seem to handle carriage returns very well. Long text without carriage returns works fine, but not with carriage returns. Pitty.
    Error: Set-SCSMIncident : Cannot convert ‘System.Object[]’ to the type ‘System.String’ required by parameter ‘Comment’. Specif
    ied method is not supported.
    At C:\source\scripts\email\update-test.ps1:5 char:39
    + Set-SCSMIncident -ID $args[0] -Comment <<<< $comment
    + CategoryInfo : InvalidArgument: (:) [Set-SCSMIncident], ParameterBindingException
    + FullyQualifiedErrorId : CannotConvertArgument,SMLets.SCSMIncidentSet

  21. I think I found what caused the redefine of ForReading. The line Const ForReading = 1 was put under the For each, so it would be redefined with every file it would find. So I put it above the For each, and it seems to do it’s job.

  22. I now have a script that first translates the 64 coded eml text, then cuts out the first part of the decoded mail (untill the line ‘—–original message—–‘, thus the last reply of the user)
    It is this text that I want to input into the action log (I suppose with the Set-SCSMIncident -Comment switch)
    Still trying to figure out how to incorporate this decoding script with your updating scripts (some error I get about the script wanting to redefine ‘ForReading’ when more than one eml file resides in the directory)
    I am not at the stage of trying to input the -Comment, which I think will give me a hard time about the size of it, even when it is only two or some lines.

  23. I am not sure if our cmdlet can update the action log, but if not, please post it at codeplex as a request and we will look into it. Then if you read the EML with a script you could update the action log. The problem is how to know whats new? If the end-user and a analyzt do a couple of replies it will be a long e-mail and it is difficult to sort out what is actually new.

  24. Got the scripts to work, although I still wonder why MS lets an analyst push a button to ask for user input, the enduser gets the mail, but he can in no way reply to it so it would be added to the Action Log automatically, with the input of the user cut and paste into it instead of an eml file attached to it. Is MS going to solve this must-have (not nice-to-have) in the near future?

    This said, is there a way to accomplish that last part: instead of attaching the eml file to the Action log, adding the content of that reply to the Action Log?

    tx in advance

  25. Excellent work Anders. I’ve spent the past couple of hours setting this up and it works really well.

    It seems a vast hole not to have this functionality out of the box, but I guess I cant expect everything (like, say, updates via the portal) from a v1.0 product.

    I am experiencing a couple of things and I’m not sure whether the functionality isnt incorporated into your scripts and Patriks work, or if its due to my flawed implementation. The incident status remains “pending” and the eml files arent removed from the “IncidentUpdate” folder on the SMTP server. I imagine I can fix these issues with another script, but I wanted to check the functionality wasnt already there and I had just failed to implement it properly.

  26. Great job guys! You save many hours of my life 🙂

    Kristofer O: To get it work with other prefix just count letters and change this part:
    varMatch = 2
    For Each strMatch in colMatches
    varPosition = (InStr(strSearchString,”XXX-IR”))
    varNewPosition = varPosition + 4

    varNoFiguresPos = varPosition + 6

  27. Okay, so I have it setup exactly like jameshontishar and it looks like the power shell is running, but it’s not updating the incidents with the emails, the emails disappear from the Updatescsm folder, and I have no idea where they are going. I can run the update.vbs outside of a scheduled task and actually see powershell running within a cmd prompt, it picks up the email but doesn’t update the ticket with the correct information. What am I missing? I am using the exact same scripts you have made available for us to download and only changed the criteria needed for my environment.

  28. Kristofer O, have you changed the criteria from Contoso-IR, as i think this is why, does it work if you set it to contoso-IR and then change your Incident Settings to make the prefix Contoso-IR

    If this works then I believe its character dependant

  29. That’s how its setup but it does not seem to add the comments to the incident.

    I have three scripts in a folder called c:\Scripts
    my mail is flowing into the c:\inetpub\mailroot\Drop folder
    the handleemail script is set to run every 1 min and this is moving the mails to the newSCSM folder or UpdateSCSM folder which is in the Drop folder
    Then update.vbs is running every 1 min also (30 seconds after the handleemail)
    The mails move to the newSCSM and UpdateSCSM folder ok and the files are moved into SCSM, but the update mails are not reflected in the incidents?

  30. Hi, you first run the handleemail script. That script should move all incoming e-mails to either Updater or New folder.The in the Update folder you run the update.vbs, not the PS. The update.vbs will start the power shell script so you dont need to do that.

  31. I have setup this, but the update script does not seem to update the files, event though they are moved correclty?

  32. Another observation: The update.vbs script doesnt delete/move the file after it processes it. Is this an oversight?

  33. Hello,

    In your update.vbs script, you are watching c:\inetpub\mailroot\drop\NewSCSM. Shouldnt you be watching updateSCSM and let SCSM monitor NewSCSM?

  34. You should not run update.ps1 manually, instead the VB script will trigger it with the correct parameters. If you only run update.ps1 nothing will happen, you need to let the update vbscript run it and input parameters. You dont have to run it from schedule tasks during the implementation, better to run it manuall from command prompt (as administrator) to see if it works.

  35. ok, so all that is done, and the handlemails script is running correctly and SM is picking up new incidents from the NewSCSM folder and the others are going to the updateSCSM folder. The update script and powershell are the only pieces still not working. I have two seperate scheduled tasks, one is for the handlemails.vbs and the other one is for the update.vbs and the update.ps1. Should they all three be running in the same scheduled task? I have tried it but it still doesn’t seem to be working. With the powershell script I have it set to start powershell.exe with the argument -noexit c:\scripts\update.ps1 so I can pass the script as an argument in powershell. What am I missing here.

  36. Hi,
    You might have mixed up the addresses. You need the user to reply to a e-mail address that will generate a e-mail in a folder (“DROP”). That folder only the VB script “handlemails” reads. That VBscript moves the e-mail either to NewSCSM or UpdateSCSM. Service Manager iteself use the default incoming e-mail feature to read only the NewSCSM folder. The “handlemails” vbscript is the only thing that affects files/e-mails in the DROP folder. Service Manager must be configured only to look in the NewSCSM folder. Make sure Service Manager only looks in the newscsm folder to start.

  37. Anders,

    This is great. SCSM’s lack of handling email chains was holding me back from deploying the product. Once I have your scripts up and running, I’ll wrap up testing and deploy the product.

    Not being a developer, I’m confused on the VB scripts you refer to (handle email and update email). Do I have to create these or can I download them.



  38. so I have the VB scripts in place, and forgive me here as I am new to the Powershell Scripting, but I can’t get the PS that Patrik wrote to work, I can add the snapin within powershell, and mine is written exactly as yours above and placed in C:\scripts folder, and all three scripts have been added to the scheduled tasks to run every five minutes, but for some reason when I reply to an email generated by SM, it goes to the drop folder and is process as normal, it doesn’t even look like the VBScripts are looking at the incoming email. Is there a way to tell? I have two other folders setup in the default drop folder, C:\inetpub\mailroot\drop\newscsm and C:\inetpub\mailroot\drop\updatescsm. any other pointers of what i may be missing?

  39. Hi, I have all the scripts in a folder (C:\scripts) on my Service Manager management server. The are schedule by schedule tasks in Windows, so none of them is in a MP. PS v2 should be enable to read v1 without any problems, but I have not test it yet. Let me know if you have more question.

  40. Anders,

    This is great stuff and will certainly go a long way in setting up SM in my environment. quick questions though. Where are these scripts stored to allow this to work correctly, my assumption is in an MP somewhere, or do you have a more step by step guide of making this work?

    Also, being that the power shell script Patrik wrote is powershell v.1 will it still run with v.2?

Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.