kb5009546 seems to break SCOM console

Question

I look after quire a large SCOM (2019 RU3)environment, recently the management console of 2 of 7 management servers are unable to open the management console (after install of update (kb5009546)) with the message
“Application: Operations Manager
Application Version: 10.19.10505.0
Severity: Error
Message: Failed to connect to server 'mgrscom3.domain.com’
Microsoft.EnterpriseManagement.Common.ServiceNotRunningException: The Data Access service is either not running or not yet initialized. Check the event log for more information. ---> System.ServiceModel.EndpointNotFoundException: Could not connect to net.tcp://'mgrscom3.domain.com':5724/DispatcherService. The connection attempt lasted for a time span of 00:00:02.0051592. TCP error code 10061: No connection could be made because the target machine actively refused it 10.192.0.1:5724. ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 10.192.0.1:5724
at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)

and some more info very similar to other posts I have seen , I have tried to follow the advice and nothing seems to work so far.
Trying
$testport = new-object System.Net.Sockets.tcpclient("'mgrscom3.domain.com","5724")
$testport.Connected
I get
new-object : Exception calling ".ctor" with "2" argument(s): "No connection could be made because the target machine actively refused it 10.192.0.1:5724"
At line:1 char:13

• $testport = new-object System.Net.Sockets.tcpclient("mgrscom3.

Same test from other server (to their own name) work
Same test to server with issues from other servers give the same error.
Why is port 5724 not listening
There is no firewall rules in between servers , windows fire wall is disabled.
There are a few events that repeat like ->
-System Center Data Access Service and/or System Center Management is unresponsive because Authorization Manager is unable to recover from database errors. Please restart services System Center Data Access Service and System Center Management.
And
The System Center Data Access service failed due to an unhandled exception.
The service will attempt to restart.
Exception:

Microsoft.EnterpriseManagement.Common.SdkServiceNotInitializedException: The Data Access service has not yet initialized. Please try again.
at Microsoft.EnterpriseManagement.ServiceDataLayer.DispatcherService.get_Container()
at Microsoft.EnterpriseManagement.Mom.Sdk.Service.SdkSubService.SdkChannel.Start()
at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()

if I point the management console to another server it works, if I try to point another console to the troubled server it also fails.

To me the issue is port 5724

Tried netstat on bad server and can see 5723 everywhere, but no 5724

On other good servers I can see stuff like
TCP [::1]:5724 mgrscom3.domain.com:51269 ESTABLISHED
TCP [::1]:5724 mgrscom3.domain.com:55008 ESTABLISHED
TCP [::1]:5724 mgrscom3.domain.com:55400 ESTABLISHED
TCP [::1]:5724 mgrscom3.domain.com:55403 ESTABLISHED
TCP [::1]:5724 mgrscom3.domain.com:57823 ESTABLISHED
TCP [::1]:51269 mgrscom3.domain.com:5724 ESTABLISHED
TCP [::1]:55008 mgrscom3.domain.com:5724 ESTABLISHED
TCP [::1]:55400 mgrscom3.domain.com:5724 ESTABLISHED
TCP [::1]:55403 mgrscom3.domain.com:5724 ESTABLISHED
TCP [::1]:57823 mgrscom3.domain.com:5724 ESTABLISHED

I have looked through numerous articles and tried some suggestions but the issue persists.

Uninstalling the patch does not fox the issue for me

Answer 1

Well it was sorted out, it was the TLS1.0 version that was the issue, not the patch, the reboot after the patch just facilitated the change to the TLS settings.

the TLS version is not specified on most of our servers but it seems itls1.0 was explicitly disabled by group policy then enabled later leaving the regkeys on the operational database

for some reason on the server key DisabledBydefault was set to 0 but so was Enabled, and on the client key DisabledBydefault was set to 1 and Enabled set to 0

changed to DisabledBydefault set 0 and Enabled set to 1,

rebooted and consoles all worked again

seems like it was simple enough to fix but I was looking at the management servers which were all ok, when the issue was on the Operational Database.

Why was tls1.0 disabled and then enabled? I have no idea, but My SCOM servers and consoles are back.

Answer 2

You may consider moving to TLS 1.2 https://kevinholman.com/2018/05/06/implementing-tls-1-2-enforcement-with-scom/