{"id":2002,"date":"2010-12-17T22:03:29","date_gmt":"2010-12-17T21:03:29","guid":{"rendered":"http:\/\/contoso.se\/blog\/?p=2002"},"modified":"2010-12-17T22:03:29","modified_gmt":"2010-12-17T21:03:29","slug":"override-runas-logon-check-failed","status":"publish","type":"post","link":"http:\/\/contoso.se\/blog\/?p=2002","title":{"rendered":"Override RunAs Logon Check Failed"},"content":{"rendered":"<p>The other day I needed to configure a web application check against a web service in a DMZ. This DMZ had its own Active Directory domain with no trust or connection to the internal domain where Operations Manager was installed. One of the criteria of the web application monitoring was to verify that we could log on to the web service. We ran into a\u00c2\u00a0challenge when\u00c2\u00a0configure the run as account for the web service. Operations Manager is trying to verify the account, as we didn\u00e2\u20ac\u2122t have a trust or any connection to the DMZ domain that was not possible. We tried to override only for this account on the watch node, but unfortunately it was all account checks or none.<\/p>\n<p><a href=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2010\/12\/20101217_RunAs_Override1.jpg\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-2005\" title=\"20101217_RunAs_Override1\" src=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2010\/12\/20101217_RunAs_Override1-300x185.jpg\" alt=\"\" width=\"300\" height=\"185\" srcset=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2010\/12\/20101217_RunAs_Override1-300x185.jpg 300w, http:\/\/contoso.se\/blog\/wp-content\/uploads\/2010\/12\/20101217_RunAs_Override1.jpg 704w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>After some investigation we found that the event generated on the agent (the watch node in this case) included the account that did pass the check.<\/p>\n<p><a href=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2010\/12\/20101217_RunAs_Override3.jpg\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-2007\" title=\"20101217_RunAs_Override3\" src=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2010\/12\/20101217_RunAs_Override3-300x179.jpg\" alt=\"\" width=\"300\" height=\"179\" srcset=\"http:\/\/contoso.se\/blog\/wp-content\/uploads\/2010\/12\/20101217_RunAs_Override3-300x179.jpg 300w, http:\/\/contoso.se\/blog\/wp-content\/uploads\/2010\/12\/20101217_RunAs_Override3.jpg 616w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p>The solution to this was to disable the monitor for the watch node, then create a new monitor only for the watch node with the same criteria, but with one extra criteria, not to include events where event description includes LITWARE\\Administrator. LITWARE\\Administrator was the account that we didn&#8217;t want an alert on.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The other day I needed to configure a web application check against a web service in a DMZ. This DMZ had its own Active Directory domain with no trust or connection to the internal domain where Operations Manager was installed. One of the criteria of the web application monitoring was to verify that we could &hellip; <a href=\"http:\/\/contoso.se\/blog\/?p=2002\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[19],"tags":[],"_links":{"self":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2002"}],"collection":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2002"}],"version-history":[{"count":7,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2002\/revisions"}],"predecessor-version":[{"id":2012,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/2002\/revisions\/2012"}],"wp:attachment":[{"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2002"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2002"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2002"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}