Home » System Center Service Manager » Update incidents by e-mail in Service Manager 2010

Update incidents by e-mail in Service Manager 2010

Update: you can download my scripts here

Out of the box Service Manager 2010 can generate incident based on incoming e-mails. But there is no default feature to update incidents based on incoming e-mails. In this post I will show you a solution to that. The flow of the e-mail will be

  1. A end-user sends a e-mail to scsm@scsmserver.hq.contoso.local
  2. The end-user is connected to the normal Exchange server, which will forward all e-mails for the scsmserver domain to my SCSM server
  3. On the SCSM server a vbscript will see if the e-mail contains “Contoso-IR” or not. If it does the e-mail will be moved to a “UpdateSCSM” folder, else it will be moved to a “NewSCSM” folder. As then it will generate a new incident in Service Manager
  4. Another vbscript will check all e-mails in the “UpdateSCSM folder”. The script will read “FROM” from each e-mail and which incident to update, it will then kick of a power shell script that will update the incident and attach the e-mail as related item.

Instead of having Service Manager looking at all incoming e-mails the first vbscript will look at them. If the script decides that it is a e-mail that should generate a new incident it will move them over to a another folder and let Service Manager handle it with the default feature. Before you start, make sure to enable incoming e-mails in Service Manager (Administration, Settings, Incident Settings, Incoming E-mails).

The first thing you need to configure is e-mail deliver to a folder. I use my Exchange 2010 machine to send all e-mails for the scsmserver.hq.contoso.local to my SCSM server. On my SCSM server I run IIS and the built-in SMTP feature. It will drop all e-mails to C:\Inetpub\mailroot\drop. I have schedule the following vbscript to run every five minute to sort e-mails. If the e-mail contains “contoso-IR” it will be moved to the UpdateSCSM folder, else to the NewSCSM folder.


Once the e-mail is moved to the new folder, in my case C:\Inetpub\maildrop\drop\newSCSM\, the following scripts looks into it

This script looks in all files and tries to find the incident ID. In the e-mail that SCSM send out to end-users about the incidents the subject contains Contoso-IRXX where XX is the incident ID. The script then take the file patch and the incidnet ID and starts a power shell script. This power shell script, see picture below, runs a cmdlet that my colleague Patrik has build, you can download it here. The Set-SCSMIncident cmdlet let you update a incident. The power shell script input a comment and attach the e-mail as a related item to the incident.


The following five pictures first show the notification template that sends a e-mail to the affected user when a incident is created. As you can see the subject line contains Contoso-IR<Incident ID>, that is also the string that we look for in incoming e-mails. In the last four pictures you can see the e-mail that a affected user recives when a incident is registered. The end-user replies with and includes the Contoso-IRXX in the subject line. In Service Manager the incident is updated in the action log and the e-mail is attached as a attached file.

If you have problem with open EML files, please take a look at this post.




  1. Mark says:
    April 20, 2011 at 1:00

    We are encountering the same problem but we have an addition of 2 hours. We are GMT +1 but caused by summer time we now have +2

    anyone has a fix for this yet?

Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.