How to fix ENTSSO “Access is Denied” warnings on Biztalk Server
Problem
Description
=================
In this situation, there are two ENTSSO warnings as
below, which are always occurring at the same time (as a pattern) in the
application log.
Event Type: Warning
Event Source: ENTSSO
Event Category: Enterprise
Single Sign-On
Event ID: 10536
Date: 16/04/2009
Time: 1:04:00
p.m.
User: N/A
Computer: AAAA183
Description:
SSO
AUDIT
Function: GetConfigInfo
({9494BA4B-CB0A-4C8C-8A29-E6AA848BD665})
Tracking ID: d0e06038-cce5-401d-95c6-ce63a14148a6
Client Computer: aaaa183.bbbbb.cccc.dd
(wmiprvse.exe:2504)
Client User: AAAA\AAAA183$
Application Name: {06E0DD2B-3550-465A-AD77-DF903144289C}
Error Code: 0x80070005,
Access is denied.
Event Type: Warning
Event Source: ENTSSO
Event Category: Enterprise
Single Sign-On
Event ID: 11042
Date: 16/04/2009
Time: 1:04:00
p.m.
User: N/A
Computer: AAAA183
Description:
Access
denied. The client user must be a member of one of the following accounts to
perform this function.
SSO Administrators: AAAA\AaaaGrSSOAdministrators
SSO Affiliate Administrators: AAAA\AaaaGrSSOAffiliateAdministrators
Application Administrators:
AAAA\AaaaGrBizTalkServerAdministrators
Application Users: -
Additional Data: AAAA\AAAA183$
{06E0DD2B-3550-465A-AD77-DF903144289C} FILE_TL_BizTalkNbrsMoh
Problem
Analysis
===============
The error means there is an application using ‘local
system’ account to try to access the ENTSSO. In our case, the application is
the SCOM agent.
The trouble shooting steps are:
1. Stop the OpsMgr
health Service on this BizTalk computer, to check whether the error will
disappear. If it does, that means the SCOM is the application with problem. We
can go to the next step.
2. Check the "BizTalk Server Monitoring Account"
& "BizTalk Server Discovery Account" under "Run As
Profiles" in SCOM console, if it is empty, not configured., So SCOM agent
which is on BizTalk side will use default action account “local system” as the
account to monitor BizTalk Server.
Problem
Solution
===============
1. Stop the OpsMgr health Service
on this BizTalk computer
2. Create a new action account which has access to BizTalk Server, this
account should be the member of some BizTalk Group then it will has the
permission to access the ENTSSO or other BizTalk resource.
Also, use one existing account, e.g. Domain\BTSADM.
3. In the SCOM console, give this account to "BizTalk Server Monitoring
Account" & "BizTalk Server Discovery Account" under
"Run As Profiles" for the client computer (AAAA183).
4. Go back to the BizTalk machine, using the account which is added to
"BizTalk Server Monitoring Account" & "BizTalk Server
Discovery Account" to run OpsMgr
health Service.
5. Start the OpsMgr health Service.
Regards,
Jarrod Huang