[SCOM] Error 0x8007000e in alerts for windows service template

Hello all,

If you see alerts that were generated by a windows service template based monitor for a uncommon instance type (like non windows computer) this article might apply to you.
These type of alerts get generated almost hourly and have the following format:

Error when calling service status
Service: ServiceName
Error: 0x8007000e
Details: There is not enough memory to complete this operation
At least one workflow is affected

Workflow name: ServiceStateProbePage_GUID.DiscoveryRule
Instance name: Here you will have an unhosted instance like SQL AG Listener
Instanz-ID: {GUID}
Management group: MG_Name

The false positive alerts occur due to the design of the Windows Service discovery based on the template which targets all windows computers, not only ones hosted on agents. The discovery is also marked with remotable=true so the discovery runs also on agentless windows computer.
As a workaround you can create an override which disables the discoveries sending out false positive and as a target select the instance which should not raise the alerts (for example SQL AG listener windows computer object).
After this it is important to run the PowerShell-Cmdlet „Remove-SCOMDisabledClassInstance“ otherwise the change will not be applied.