SQL Server 2012 or newer - SCOM Monitoring using SID's

When installing SCOM agents on servers the agent is typically installed to run under the LocalSystem account to access resources and run scripts. Starting with SQL Server 2012 and newer the NT AUTHORITY\SYSTEM account no longer is part of the sysadmin role preventing scripts and discoveries from running properly. Causing alerts due to failures for discoveries and monitoring.


There are a few ways to overcome this issue; either assigning LocalSystem Sysadmin rights in SQL or to modify the SCOM Service to utilize a service SID to grant access to the SCOM Service process.


To Create the appropriate service SID for the SCOM Service run the following command.

sc sidtype HealthService unrestricted

To add the Service SID "NT SERVICE\HealthService" run the following SQL query on the SQL server to create a new login for the service or manually create the security login.

USE [master]
GO
/****** Add a login in SQL Server for the service SID of System Center Advisor HealthService ******/
CREATE LOGIN [NT SERVICE\HealthService] FROM WINDOWS WITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]
GO
/****** Add the HealthService Service SID login to the sysadmin server role ******/
ALTER SERVER ROLE [sysadmin] ADD MEMBER [NT SERVICE\HealthService]
GO

To manually add the user by opening SQL Server Management Studio, opening Security > Logins > Right click and select New login.

1. Under Login Name type in "NT Service\HealthService" without the quotes.
2. Make sure Default Database is set to "Master"
3. Click on the Server Roles page on the left hand list.
4. Checkmark the "sysadmin" role and then click OK.

To finish up, restart the SCOM Service. You can monitor the OperationsManager event log to verify the scripts can properly login and run discoveries and scripts against SQL Server.




Further details can be obtained from a few other Blog posting by Kevin Holman and TechNet.


How to configure SQL Server 2012 to allow for System Center Advisor monitoring


SQL MP Run As Accounts – NO LONGER REQUIRED