Поделиться через

How to create a monitor for existence of a registry key

  • Статья

<!--[if lt IE 9]>

<![endif]-->

Comments

  • Anonymous
    September 07, 2010
    Wow! That was a lot of work just to copy what you have done. Thx for the effort in putting it all together. Above in the Target section, "Microsoft.Windows.Server.OperatingSystem" was chosen. This will by default ENable the monitor for each discovered server (Is that correct?) So, once the MP is imported, is it just a matter of finding the monitor under the Authoring tab and using Overrides to target specific servers? Thx, John Bradshaw

  • Anonymous
    September 07, 2010
    My example is enabled and targeting the Windows Server OS.... if you want this scoped to a subset of computers - the BEST practice is to create a class for those computers (based on something that makes them unique) and then targeting that class. Second option is to create the monitor as disabled by default, then enabling it via overrides for a group.

  • Anonymous
    January 29, 2014
    I previously wrote about the new agent control panel applet with SCOM 2012 here: http://blogs.technet

  • Anonymous
    December 29, 2014
    I am not very familiar with the authoring console - would the following apply to the same process:

    Monitoring for regkey autoadminlogon = 1 instead of default 0
    We have cases where developers are setting server autologons. Passwords in clear text/bad situation and account lockouts every 90 days are wasting a lot of time. Would like to proactively alert for these and set reg keys back to 0 if a user changes them to 1.

    Thanks much.

  • Anonymous
    April 22, 2015
    @kevin - In my environment we need to get an alert if a server goes into pending reboot state.Could you please suggest the idea

  • Anonymous
    August 25, 2015
    Keving, this is not working for me. I have used this to check for existence of registry key - SYSTEMCurrentControlSetControlSession ManagerPendingFileRenameOperations. However it is not working, always showing as keymissing even when exists. In health explorer, when I recalculate monitor, nothing happens. Can you please help and suggest how to troubleshoot this.

  • Anonymous
    August 25, 2015
    Recalculate will NEVER work for 99% of monitors. That button shouldn't exist - it will only work for specially written monitors with an on demand probe action.

    Post your monitortype XML.

  • Anonymous
    August 25, 2015
    Thanks Kevin, I am pasting the monitortype XML below :
    -


    -


    -










    -


    -


    -

    $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$


    -


    -

    PCRegKeyExists

    SYSTEMCurrentControlSetControlSession ManagerPendingFileRenameOperations

    0

    0





    60




    -


    -


    -


    -

    Values/PCRegKeyExists



    Equal


    -

    true










    -


    -


    -


    -

    Values/PCRegKeyExists



    Equal


    -

    false












    -


    -


    -








    -


    -













  • Anonymous
    August 25, 2015
    Kevin, Unable to post the xml here in readable format. Please suggest

  • Anonymous
    August 25, 2015
    it was plenty readable.

    You need to read through the post again. You have not set pathtype correctly. You set it to "0" which means Key. However, PendingFileRenameOperations is not a reg key - it is a reg value.

  • Anonymous
    August 25, 2015
    Thanks Kevin. I will make the change and re test.

  • Anonymous
    August 25, 2015
    It is still not working, Kevin. Perhaps I am still doing something wrong, if you have time can you please review the xml pasted below. I se pathtype to 1 and checking to see if it contains string pendingfilerenameoperations, set it to keyexists. Also I am noticing that when I flush the agent so it loads the new MP with the change, monitor is always showing this condition - Context:
    The monitor has been initialized for the first time or it has exited maintenance mode


  • Anonymous
    August 25, 2015












    $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$


    PCRegKeyExists
    SYSTEMCurrentControlSetControlSession Manager
    1
    1


    14400





    Values/PCRegKeyExists

    ContainsSubstring
    PendingFileRenameOperations







    Values/PCRegKeyExists

    DoesNotContainSubstring
    PendingFileRename




















  • Anonymous
    August 25, 2015
    You should stop making too many changes. You should have ONLY changed pathtype. Not attributetype. You should have left that to Boolean and left the expression alone.

  • Anonymous
    August 25, 2015
    Thanks Kevin ! Works like a charm now....

  • Anonymous
    September 23, 2015
    Hi Kevin, I'm trying to follow this using VS 2013 + VSAE, I don't see "Select “Type Library” and then “Monitor Types”. Right click > New > Composite Monitor Type."

  • Anonymous
    March 09, 2017
    Kevin, does this article also apply to SCOM2012R2? If so, I am stuck at the step in this article that says "Select “Type Library” and then “Monitor Types”. Right click > New > Composite Monitor Type." I simply cannot find this option to create a Composite Monitor Type. Kindly help, as i am looking for generating alerts based on the presence or absence of an Registry Key on a windows computer.

    • Anonymous
      March 09, 2017
      It does - but the SCOM 2007 R2 authoring console is a separate advance authoring tool.If you want to make life easier - go look at my MP fragments for this.https://blogs.technet.microsoft.com/kevinholman/2016/06/04/authoring-management-packs-the-fast-and-easy-way-using-visual-studio/

  • Anonymous
    July 21, 2017
    How does this work in SCOM 2016, I do not see the Type Library to be able to create this