Ghost objects in the…Windows Computer Class?

Ever open the computer state view and see “Not monitored’ objects you believe have no business being in your SCOM environment? You recognize them as part of your environment somewhere; however, you are positive you do not have an agent in place on the machine being discovered.

My SCOM 2012 Windows Computers State view…

I have a small environment with both SCOM 2007 R2 and SCOM 2012 installed. At this point, SCOTTMUDC2 has an agent installed; however, it’s pointed at the 2007 R2 environment. What is it doing in my 2012 environment? Taking a closer look at the machine, it clearly is only pointed at the 2007 R2 environment (OM07):

So, I know this is my other domain controller…I wonder if this has something to do with the newly imported AD MP? Opening the health explorer, I see nothing but grayness (unmonitored). Opening the AD topology view, I am able to locate the SCOTTMUDC2 server:

Now it starts to make sense. As part of the AD topology discovery, the relationship is established between the Windows Computer object and the domain for each of the DCs. What happens when the Windows Computer object isn’t part of the SCOM environment? Because of the way containment relationships are discovered, in essence a blank Windows Computer object is discovered that represents the machine. Since the Windows Computer object isn’t hosted anywhere, it simply stays in the ‘Not monitored’ state.

From the ADTopologyDiscovery.vbs script within the Microsoft.Windows.Server.Library management pack,

Set oInstance = oDiscData.CreateClassInstance(“$MPElement[Name=’Windows!Microsoft.Windows.Server.DC.Computer’]$”)

oInstance.AddProperty “$MPElement[Name=’Windows!Microsoft.Windows.Computer’]/PrincipalName$”, arrParam(0)

Set oRelationShipInstance = CreateRelationshipInstance(“$MPElement[Name=’Microsoft.Windows.Server.AD.Domain.contains.Microsoft.Windows.Server.DC.Computer’]$”, oParentInstance, oInstance, oDiscData)

And there we go. The AD Topology discovery is responsible for bringing in the ‘Not monitored’ Windows Computer objects. The topology discovery creates relationships between all of the DCs within the environment and the domain object itself.  Since the DC class is hosted by Windows Computer, we actually get a ‘Not monitored’ Windows Domain Controller as well.  Of course, this can happen with any MP where the target for the relationship itself doesn’t exist within SCOM.

Leave a Reply