Using SCOM to Automatically Stop MOM Agent Service

I’m currently working on a MOM 2005-to-SCOM 2007 migration project for a client. after months of work, we are finally ready to stop MOM service.

We created a new GPO to set MOM service (MOM agent) to “Disabled” and linked to the top of the domain. we also wanted to make sure all MOM service are actually STOPPED on domain member servers AS WELL AS standalone SCOM agents. Traditionally, I’d create a package in SMS/SCCM with a script that firstly detect if SCOM agent service (HealthService) is running, and secondly, if so, stop MOM service. However, this particular client I’m currently working for does not have SCCM infrastructure for their servers. I didn’t want to run a script to go out stop the MOM service on all servers because there are firewalls located in different segments of the network and running a script does not ENFORCE this setting…

To achieve my objective, I have created a basic service unit monitor in SCOM to detect the status of MOM service and created a recovery task for this monitor. The monitor generates an alert if MOM service is running and Recovery task will be executed to stop MOM service!

Below is what I’ve done:

1. Create a basic service monitor targeting Windows Operating System:

This monitor is targeting MOM service

If the service is NOT running, the health state is considered as healthy, otherwise, it is in warning state

We only subscribe to critical and warning alerts, I didn’t want get too much attention so I configured the alert severity to only Information:

Lastly, I created a diagnostic and a recovery task associated to this monitor.

The Diagnostic task is simply checking the state of MOM service:

And the recovery task stops MOM service:

So now the monitor is created. note from the first screen shot, I did not enable this monitor. I wanted to test it first! So I created an override to only enable it to a particular Windows 2003 server.

After few minutes, I could see the health state change in Health Explorer:

1 minute after the health state changed from Healthy to Warning, it changed back to Healthy - because the recovery task kicked in and stopped MOM service. Below are the results from Diagnostic and Recovery Tasks:

Diagnostic Task:

Recovery Task:

And now, the alert is automatically closed:

I logged on to the target server, checked MOM service, it is stopped:

Now, I can go ahead and enable this monitor!