How to create a monitor for existence of a registry key


<!--[if lt IE 9]>

<![endif]-->

Comments (19)

  1. John Bradshaw says:

    Wow! That was a lot of work just to copy what you have done. Thx for the effort in putting it all together.

    Above in the Target section, "Microsoft.Windows.Server.OperatingSystem" was chosen.

    This will by default ENable the monitor for each discovered server (Is that correct?)

    So, once the MP is imported, is it just a matter of finding the monitor under the Authoring tab and using Overrides to target specific servers?

    Thx,

    John Bradshaw

  2. Kevin Holman says:

    My example is enabled and targeting the Windows Server OS…. if you want this scoped to a subset of computers – the BEST practice is to create a class for those computers (based on something that makes them unique) and then targeting that class.

    Second option is to create the monitor as disabled by default, then enabling it via overrides for a group.

  3. Anonymous says:

    I previously wrote about the new agent control panel applet with SCOM 2012 here: http://blogs.technet

  4. Frank says:

    I am not very familiar with the authoring console – would the following apply to the same process:

    Monitoring for regkey autoadminlogon = 1 instead of default 0
    We have cases where developers are setting server autologons. Passwords in clear text/bad situation and account lockouts every 90 days are wasting a lot of time. Would like to proactively alert for these and set reg keys back to 0 if a user changes them to
    1.

    Thanks much.

  5. priyatham says:

    @kevin – In my environment we need to get an alert if a server goes into pending reboot state.Could you please suggest the idea

  6. SB says:

    Keving, this is not working for me. I have used this to check for existence of registry key – SYSTEMCurrentControlSetControlSession ManagerPendingFileRenameOperations. However it is not working, always showing as keymissing even when exists. In health
    explorer, when I recalculate monitor, nothing happens. Can you please help and suggest how to troubleshoot this.

  7. Kevin Holman says:

    Recalculate will NEVER work for 99% of monitors. That button shouldn’t exist – it will only work for specially written monitors with an on demand probe action.

    Post your monitortype XML.

  8. SB says:

    Thanks Kevin, I am pasting the monitortype XML below :

    $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$

    PCRegKeyExists

    SYSTEMCurrentControlSetControlSession ManagerPendingFileRenameOperations

    0

    0

    60

    Values/PCRegKeyExists

    Equal

    true

    Values/PCRegKeyExists

    Equal

    false

  9. SB says:

    Kevin, Unable to post the xml here in readable format. Please suggest

  10. Kevin Holman says:

    it was plenty readable.

    You need to read through the post again. You have not set pathtype correctly. You set it to "0" which means Key. However, PendingFileRenameOperations is not a reg key – it is a reg value.

  11. SB says:

    Thanks Kevin. I will make the change and re test.

  12. SB says:

    It is still not working, Kevin. Perhaps I am still doing something wrong, if you have time can you please review the xml pasted below. I se pathtype to 1 and checking to see if it contains string pendingfilerenameoperations, set it to keyexists. Also I
    am noticing that when I flush the agent so it loads the new MP with the change, monitor is always showing this condition – Context:

    The monitor has been initialized for the first time or it has exited maintenance mode

  13. SB says:

    $Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$

    PCRegKeyExists
    SYSTEMCurrentControlSetControlSession Manager
    1
    1

    14400

    Values/PCRegKeyExists

    ContainsSubstring
    PendingFileRenameOperations

    Values/PCRegKeyExists

    DoesNotContainSubstring
    PendingFileRename

  14. Kevin Holman says:

    You should stop making too many changes. You should have ONLY changed pathtype. Not attributetype. You should have left that to Boolean and left the expression alone.

  15. SB says:

    Thanks Kevin ! Works like a charm now….

  16. Anthony says:

    Hi Kevin, I’m trying to follow this using VS 2013 + VSAE, I don’t see "Select “Type Library” and then “Monitor Types”. Right click > New > Composite Monitor Type."

  17. Yatin says:

    Kevin, does this article also apply to SCOM2012R2?
    If so, I am stuck at the step in this article that says “Select “Type Library” and then “Monitor Types”. Right click > New > Composite Monitor Type.” I simply cannot find this option to create a Composite Monitor Type.
    Kindly help, as i am looking for generating alerts based on the presence or absence of an Registry Key on a windows computer.

    1. Kevin Holman says:

      It does – but the SCOM 2007 R2 authoring console is a separate advance authoring tool.

      If you want to make life easier – go look at my MP fragments for this.

      https://blogs.technet.microsoft.com/kevinholman/2016/06/04/authoring-management-packs-the-fast-and-easy-way-using-visual-studio/

  18. Paul Arbogast says:

    How does this work in SCOM 2016, I do not see the Type Library to be able to create this

Skip to main content