WS2016E Computer Monitoring Errors

Question

Windows Server 2106 Essentials

Beginning on August 31, 2021 my servers began to report "Computer Monitoring Errors." From what we have been able to determine so far, it appears that the fwlink hardcoded within the Essentials source code: https://go.microsoft.com/fwlink/?LinkID=785361 is BROKEN and is being redirected within the Microsoft backend to Microsoft Bing: www.bing.com/?ref=go&linkid=0 As a result, the servers are attempting to download the Bing HTML (resulting in gibberish or nil) instead of the expected actual "OnlineServicesConfigFile-US.xml." file. For reference the file is stored on the servers at: ProgramData/Microsoft/Windows Server/Data/Cloud

Is anyone else experiencing this problem? Anyone know where/how to address/discuss this issue with Microsoft? Thanks!!!!

Answer 1

I have found a temporary "workaround" to quiet the alert. It is working successfully for me across all my servers. Unfortunately, I can't and won't guarantee success for everyone since I do NOT work for Microsoft and I don't have access to the same resources; so please PROCEED AT YOU OWN RISK! You fully assume all risk, responsibility, and liability with this workaround and it's installation. Please read and understand what this workaround does and PROCEED AT YOUR OWN RISK. I recommend you make sure you backup your server and data.

Some background........ Microsoft has created dozens and dozens of health definitions in Essentials that scan the server (and clients) for particular issues (such as firewall problems, disk space problems, server role configuration problems, etc., etc.). Within all of that, there’s actually a specific health definition that checks for updates to just the online services integration stuff in Essentials. The health definition runs every thirty minutes where it downloads the language-specific config file. The config file contains the version information for the online services integration (which hasn’t actually changed from version 1.0.0.0 in all the years that 2016 Essentials has been out), and that’s what’s checked in order to see if an update needs to be downloaded from Microsoft. Since the config file on the server is now corrupt due to a broken or missing link on the Microsoft backend, Essentials falls over when it attempts to read the version information from it and then it tosses up the “Computer Monitoring Error” health alert.

The Workaround... It's actually quite simple and can be easily reversed if Microsoft decides to fix the broken backend.

1.) Use the Essentials "Restore Files or Folder" (NOT A Full Drive) wizard to REPLACE the "OnlineServicesConfigFile" contained within: ProgramData/Microsoft/Windows Server/Data/Cloud. You MUST use a backup from prior to the Microsoft failure on or about August 31, 2021. (I successfully restored my config file using backup from August 29, 2021.)

2.) Quickly (before the next Health Alert Evaluation runs and overwrites the file) right click the config file, select properties and set the Attribute to READ ONLY. (This should prevent the config file from being overwritten with corrupted information again due to the missing or broken backend.)

Answer 2

What errors are in the event logs?

Answer 3

1281 Warning Alert: !Warning is raised at ORION. <Title> Computer monitoring error. <Description> Can only partially assess the health of this computer. The failing components are: MicrosoftSecurity!OnlineServicesPackageUpdate. <AdditionalInfo> 'doctype' is an unexpected token. The expected token is 'DOCTYPE'. Line 1, position 3.

Answer 4

Not much to go on. Usually the event source and event ID are needed, or simpler method is the in event properties General tab then copy and paste text in the body of a post.

Answer 5

Log Name: Microsoft-Windows-ServerEssentials/Admin
Source: Microsoft-Windows-Windows Server
Date: 9/9/2021 11:13:03 AM
Event ID: 1281
Task Category: None
Level: Warning
Keywords:
User: N/A
Computer: Orion.DOMAIN.local
Description:
Warning Alert: !Warning is raised at ORION. <Title> Computer monitoring error. <Description> Can only partially assess the health of this computer. The failing components are: MicrosoftSecurity!OnlineServicesPackageUpdate. <AdditionalInfo> 'doctype' is an unexpected token. The expected token is 'DOCTYPE'. Line 1, position 3. .
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Windows Server" Guid="{26a2f182-2ead-423f-9d7d-500b74ff9295}" />
<EventID>1281</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2021-09-09T15:13:03.644212300Z" />
<EventRecordID>16413</EventRecordID>
<Correlation />
<Execution ProcessID="5392" ThreadID="9748" />
<Channel>Microsoft-Windows-ServerEssentials/Admin</Channel>
<Computer>Orion.DOMAIN.local</Computer>
<Security />
</System>
<EventData>
<Data Name="AlertDefinitionName">!Warning</Data>
<Data Name="AlertMachineName">ORION</Data>
<Data Name="AlertTitle">Computer monitoring error</Data>
<Data Name="AlertDescription">Can only partially assess the health of this computer. The failing components are: MicrosoftSecurity!OnlineServicesPackageUpdate</Data>
<Data Name="AlertAdditionalInfo">'doctype' is an unexpected token. The expected token is 'DOCTYPE'. Line 1, position 3. </Data>
</EventData>
</Event>