{"id":1980,"date":"2010-12-12T02:51:24","date_gmt":"2010-12-12T01:51:24","guid":{"rendered":"http:\/\/contoso.se\/blog\/?p=1980"},"modified":"2010-12-12T02:51:24","modified_gmt":"2010-12-12T01:51:24","slug":"state-based-on-logon-status","status":"publish","type":"post","link":"http:\/\/contoso.se\/blog\/?p=1980","title":{"rendered":"State based on logon status"},"content":{"rendered":"

I read a question this week about presenting a state based on if a service account was logged on to a machine or not. There are a couple of different ways to do that. We will need a monitor in both of them, as we want to present a state. You could solve it with a monitor running a script, checking current logged on users. You could also solve it with a monitor checking log-on and log-out events.<\/p>\n

If you want to do it with two events and running server 2008 you could look at even 4624 (an account was successfully logged on) and 4647 (User initiated log-off). To configure a monitor like that you follow the steps below. This example will configure a monitor to generate an alert if not the CONTOSO\\svc-contoso-service account is logged on.<\/p>\n

    \n
  1. In the console, navigate to Authoring\/Management Pack Objects<\/li>\n
  2. Right-click monitors and create a new Simple Event Detection\/Windows Event Reset monitor<\/li>\n
  3. Choose a suitable management pack, not the default management pack. Click Next<\/li>\n
  4. Input a name, a target and choose a parent monitor. Click Next<\/li>\n
  5. Event Log (Unhealthy Event). Select Security as event log name. Click Next<\/li>\n
  6. Event Expression (Unhealthy Event). Select Event ID equals 4647 and EventDescription Contains CONTOSO\\svc-contoso-service. Click Next
    \n\"\"<\/a><\/li>\n
  7. Event Log (Healthy Event). Select Security as event log name. Click Next<\/li>\n
  8. Event Expression (Healthy Event). Select Event ID equals 4624 and EventDescription Contains CONTOSO\\svc-contoso-service. Click Next<\/li>\n
  9. Configure Health. Click Next<\/li>\n
  10. Configure Alert. Check the “Generate alerts for this monitor” check box. Click Create<\/li>\n

    By default this new monitor will be forced to healthy state first. This mean we will not get an alert until the account log off. In other words, if there is a\u00c2\u00a0machine where this account is not logged on right now, Operations Manager will not notice it. It is only looking for the log-in and log-off event. To generate an alert we first need to log-on with the account, in this example CONTOSO\\svc-contoso-service, then log-out again. The monitor will then go into unhealthy state.<\/p>\n

    \"\"<\/a><\/p>\n

    \"\"<\/a><\/p>\n

    The second way to solve this is with a script. To configure a monitor like that you follow the steps below<\/ol>\n

      \n
    1. In the console, navigate to Authoring\/Management Pack Objects<\/li>\n
    2. Right-click monitors and create a new Scripting\/Generic\/Timed Script Two State Monitor<\/li>\n
    3. Choose a suitable management pack, not the default management pack. Click Next<\/li>\n
    4. Input a name, a target and choose a parent monitor. Click Next<\/li>\n
    5. Schedule. Configure how often you want the script to run, to see if the account is logged on. Dont configure it to run to often, check your organization requirements. Click Next<\/li>\n
    6. Script. Input a script name, for example accountcheck.vbs. Paste the script into the script text field. You can download the script here<\/a>. One of the first lines in the script configure which account to check. Don’t forget to update it. Click Next<\/li>\n
    7. Unhealthy Expression. Input
      \nProperty[@Name=’Status’] Does not equal OK
      \nClick Next<\/li>\n
    8. Healthy Expression. Input
      \nProperty[@Name=’Status’] Equals OK
      \nClick Next<\/li>\n
    9. Health. Click Next<\/li>\n
    10. Configure Alert. Check the “Generate alerts for this monitor” check-box and input a alert description. Click Create<\/li>\n<\/ol>\n

      \"\"<\/a><\/p>\n

      If you need to display the account status in a distributed application it is easiest if you can target the monitor to a new customer class.\u00c2\u00a0The health model of the class will then be only this\u00c2\u00a0monitor, in other words the class instance health\u00c2\u00a0it will only show the status of the account. \u00c2\u00a0<\/p>\n

      \"\"<\/a><\/p>\n

      Thanks to Guy Thomas for his script that I\u00c2\u00a0adapted.<\/p>\n","protected":false},"excerpt":{"rendered":"

      I read a question this week about presenting a state based on if a service account was logged on to a machine or not. There are a couple of different ways to do that. We will need a monitor in both of them, as we want to present a state. You could solve it with … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[19],"tags":[],"class_list":["post-1980","post","type-post","status-publish","format-standard","hentry","category-operations-manager-2007"],"_links":{"self":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1980"}],"version-history":[{"count":15,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1980\/revisions"}],"predecessor-version":[{"id":2001,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1980\/revisions\/2001"}],"wp:attachment":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1980"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}