OpsMgr 2007: DFS Management Pack Generates Bogus DFS Link Monitor Alerts

Here's an interesting Operations Manager tip that comes from Michael Sadoff, a real life Support Escalation Engineer from Charlotte, North Carolina.  If you're running the DFS Management Pack and getting some false-positives then you'll want to check this out:


Issue: When you using the Microsoft Windows Server DFS 2003 Management Pack in System Center Operations Manager 2007 you may receive alerts with details that are similar to the following:

DFS Link Monitor
Source: Groups\SCS
Path: <full path of DFS link>
Alert Monitor: DFS Root Monitor
Created: <date> <time> 
Alert Description: DFS Link [<UNC of DFS link>] is unavailable.

If you manually test availability of corresponding DFS links, you are able to open the links without a problem.

Cause: This can occur when the DFS servers use Local System for the Default Action Account. Computer accounts do not have permission for file shares unless the share and NTFS security ACLs include the Authenticated Users principal. Therefore, if the
DFS Link Monitor runs using Local System credentials, the monitor will detect the shares as being unavailable.

Resolution: Change the Default Action Account for all DFS servers to use an account with permissions for all DFS shares. To do this, create a Run As Account of type: Action Account. When creating the Run As Account, specify the credentials of a user
account with permissions for all DFS shares. Next, open properties for the Run As Profile named Default Action Account, click the Run As Accounts tab, and edit the entry for each DFS server in the list, so that each uses the new Run As Account.


Thanks Michael!

J.C. Hornbeck | Manageability Knowledge Engineer