Creating custom dynamic computer groups based on registry keys on agents

<!--[if lt IE 9]>


Comments (25)
  1. Kevin Holman says:

    @Fahim – I understand exactly what you are asking. Which is why I explained that this example is using an unfiltered registry discovery. Discovered inventory shows instances of a class. This discovery is unfiltered, so it will contain a class instance for each computer that runs the discovery, regardless of the property value. That is by design. If you WANT a filtered discovery – then I’d recommend changing it to a filtered discovery provider and adding the required filter expression, where value = true. However, if you are going THAT far – stop extending Windows Computer altogether, and just create your OWN class based on the Local Application class and use a filtered reg discovery provider. I have several examples of this.

  2. Kevin Holman says:

    @ DSloyer2015 –

    Why can you just use groups, if you are already discovering this registry data in SCOM, and use dynamic expressions?

  3. Kevin Holman says:

    This example uses a unfiltered registry discovery. It will add a property and discover the value of that property for all instances. If you want to filter on specific machines, then you need to use a filtered registry discovery provider, and provide a filter expression in XML.

  4. Kevin Holman says:

    You nailed it – that is exactly correct – as I am sure you found out by testing.  Boolean or "check if exists" will always be "attributename" equals "true"

  5. Anonymous says:

    Thanks Kevin we have been using this method successfully for about a year.  It was recommended by our MS Consultant.  I found your article because we are experiencing the issue that you described near the end of the post, we need a way to tie this registry key to the Health Service Watcher class so that we can control the Heartbeat alerts.  

    So far I have been able to extend the Health Service Watcher class, but the value of the registry key for the class is set to the value on the MANAGEMENT SERVER that manages the server, not the value on the server itself.

    Not sure how to work around this issue, the only idea I have so far is that when looking at the Health Service Watcher class and the Windows Server class, the only attributes in common are Display Name which is inherited from Entity.  Somehow you would have to extend the Health Service Watcher class with the attribute from Windows Server_Extended where



    Hoping I explained this well, I would be interested in any feedback you could give.  TIA

  6. Kevin Holman says:

    You cannot extend the HSW class.  It is special and you really cant treat it like any other class.

    You cannot add the HSW instance to a group in the UI:

    You must edit the XML for your group.

    Here is an example:

  7. Fahim2010 says:

    Hi Kevin,
    Sorry. I guess I was not clear on my post. What you described is totally fine for us. And I can see that the property value and am able to create dynamic group using the attribute. —- But I do not understand why changing ‘target type’ under Discovered Inventory would still show all monitored servers instead of showing servers where the property value is ‘true’. Seems like it is including the ones where the property value is false.
    Thanks again for your input.

  8. Kevin,

    This is great but it stills requires the manual creation of groups for very possible registry key.

    What we are exploring right now is how to create a dynamic group and scoped role based on different string values of defined registry keys.

    Say a registry key contains the name of the business group who owns the server. Lets say say the value is SupportTeamX. This registry key will be read by OpsMgr, create a computer group called SupportTeamX and create a scoped role called SupportTeamX that is scoped to just that computer group.

    Active Directory group membership of the role can be managed separately.

    Would you have any examples of something like this? Based on the work so far I think the dynamic group and role creation is going to require managed code to handle.

  9. David says:

    Nice post Kevin, the art helps 🙂

  10. Marnix Wolf says:

    Again a masterpiece. Thanks for sharing this information.

  11. José Fehse says:

    Kevin, how should we convert a formula to scom that uses boolean conditions (Check if exists). It doesn’t seem to have an option in SCOM for that. Should we use "Equals True", like below for example?

    ( Object is Windows Server Operating System_Extended AND ( MOSS 32bit Equals True )

    José Fehse


  12. Phil says:

    Firstly thanks for a great easy to follow example but I still have a few issues to make this work with clusters.

    Is there anyway for the support value of the underlying cluster node to be set for the virtual nodes it hosts?

    They are discovered by the extended class but the supportlevel is always blank. Which of course means if you use these groups to limit for example to level 1 SQL DB Engines then any SQL instances on a cluster are missing.

  13. Jav says:


    I am trying to do something similar, adding attribute "Forwarders" to DNS servers to be able to create a group containing DNS servers with specific addresses as forwarders.

    I then point to the value "HKLMSystemCurrentControlSetServicesDNSParametersForwarders" where there will typically be one or more ip addresses. (in this case I am using "string" as type.

    The discovery works, but I only get the first ip address populated (in most cases there are two).

    Is there any way to set string to multi-string to support this?

    thanks in advance!!!

  14. funzel says:

    This article is very helpfull, many thanks

    We have at the moment a workshop and discussed the same problem, handling machines groups based dynamic on different classifications defined from us itself

  15. CD says:

    Hi Kevin, thanks for this post – we've been using this method successfully to create groups, using the string method, we're finding a handful of our servers are just not populating into any groups, the reg keys are right, they are reporting in SCOM and the remote registry service is running, but the query doesnt catch them for some reason – apart from resorting to making the problem servers explicit members, have you got any ideas as to what it may be?

    Thanks again, for this article – saved us a lot of work!

  16. ilans says:

    i need some help for doing something similar for Database class, i want to have two dynamic groups, PROD Databases and DEVTEST Databases. i can put a registry key for each database that will hold that value. i need an idea on how to do the discovery for this attribute.

    any idea if there are other ways then registrywmi Discovery, i thought on using one XML file on each SQL server that will hold list of all databases on that server, but it seem that i cannot use POWERSHELL script for the discovery.

    any idea ?

  17. Help with SCOM 2012 says:

    Hi Kevin,
    I have done it with 2007 successfully but with 2012, the extended target is not showing servers of our interest. It still shows all monitored servers instead of showing blank page or server of our interest. We tried registry key to discover. Changed target. But Computer_Extended target shows all machines. Am I missing something here?
    Your input is much appreciated.

  18. Help with SCOM 2012 says:

    Hi Kevin,
    To add to what I posted a moment ago, I can see that the attributes (true or false) are being listed under agent object property but the view is still showing all computers. Any help?

  19. How far can SCOM bend says:

    Hi Kevin,
    Apologies for getting greedy on this but is there a way to get the Service Level details from a SQL Server table instead of registry entry? This will allow us managing service levels in a flexible and dynamic way. SQL server with these details is in a management
    VLAN so only SCOM can talk to it. Any ideas how this can be done ?

    Thanks for a lot of help on all topics. They have been a life saver.

  20. DSloyer2015 says:

    Firstly, Kevin this is a great example and I have used it in the past, very thoroughly explained.

    However, I am trying to create dynamic groups and a scoped roles based on an array of registry values. There was a request for something similar back in 2009 and you stated you may update this guide to include that example.

    In our environment, we publish data to the registry at build time that captures the maintenance windows, support owner of the server, SLA, and other other company specific data. I’m collecting this data with SCOM and I’d like to automatically create groups
    and possibly a role based on each Support group name. Is this something you’ve run into before?

  21. Anonymous says:

    I wrote a post explaining Run As accounts a while back here:

  22. Pavithra says:

    I am trying to create an Attribute using Registry discovery for the value “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Operations Manager\3.0\Machine Settings\ChannelCertificateHash”, but seems to be not working. I am checking if the registry exists or not. Please assist.

  23. Torben Andersen says:

    Hi Kevin, everything went fine until dynamic members group creating screen – I can’t see/find my “Windows Computer_Extended” class – can you please help?

  24. Kevin Holman says:

    this means you are creating a group in some other MP, other than the unsealed MP the extended class is in. One unsealed mp cannot reference another unsealed mp.

    I recommend when you extend classes, that MP be kept simple with the extended classes and discoveries only, and sealed. So it can be used anywhere.

Comments are closed.

Skip to main content