SCOM alert The Health Service could not log on the RunAs account DOMAIN\root for management group . The error is Logon failure: unknown user name or bad password.(1326L). This will prevent the health service from monitoring or performing actions using this RunAs account

Dashboard Server
,
1

SCOM Alert

The Health Service could not log on the RunAs account DOMAIN\root for management group . The error is Logon failure: unknown user name or bad password.(1326L). This will prevent the health service from monitoring or performing actions using this RunAs account

checked the SCOM accounts , there is no such account in the SCOM console under DOMAIN\root.

there is no unix account on the name DOMAIN\root.

Checked the Active directory , there is no account on the name DOMAIN\root

 

The alert is generating from only scom management servers

1 Like
2

How many systems are reporting this alert? Open the Operations Manager Shell and run Get-SCOMRunAsAccount and see if it is listed.

1 Like
3

Try running this SQL Query and see if you can find the account. The value from securestorageid (without 0x) should be present in the Microsoft.SystemCenter.SecureReferenceOverride managementpack as well.

/****** Script for SelectTopNRows command from SSMS ******/
SELECT TOP (1000) [SecureStorageElementId]
,[SecureStorageId]
,[Name]
,[Description]
,[UserName]
,[Domain]
,[Type]
,[Data]
,[DataHash]
,[IsSystem]
,[AssemblyQualifiedName]
,[ConfigurationXml]
,[ConfigExtensionData]
,[LastModified]
FROM [OperationsManager].[dbo].[CredentialManagerSecureStorage]
2 Likes
4

The alert is generating from only scom management servers

5

Have you checked if any Linux account has that account used when elevating?

6

found the account . thank you