SCOM – Powershell Recovery Action – Stopped Windows Service

August 31, 2017


Today I was at a customer who had a really specific question regarding monitoring of Windows Services with Operations Manager (SCOM).

We had already set up some basic recovery actions which restart the service automatically after it was stopped.

For some other services the customer wanted to add extra functionality: The recovery action should retry starting the service a maximum of 3 times, if the service wasn’t started after 3 tries the customer wanted to receive an email telling them the recovery action failed. Out-of-the-box SCOM is unable to do stuff like that, therefore I used Powershell to accomplish this.

Sidenote: To be able to use Powershell as a recovery action you can use the free management pack provided by the community & SquaredUp, it can be downloaded from this website: This management pack adds Powershell everywhere it is missing in Operations Manager, this is one of the default management packs I always install at customers.


To be fully functional different components are needed:

  • A monitor that checks the status of the service
    • This monitor can be created from the Authoring pane of the SCOM console using the Windows Service template


  • A recovery action for the monitor created previously
    • The recovery action can be created from health explorer1
  • A rule that picks up the event created by the recovery action Powershell script
    • This is an Alert Generating Rule (NT Event Log), the configuration is linked to the type and location of the event logged during the script2
  • A subscription on the rule to send the email.

The powershell script:

# Fill in the service name here

$ServiceName = “LPD Service”

$ServiceStarted = $False

$i =0;

#Create Eventlog source, erroraction Ignore is neededbecause once the source is created an error is thrown because the source already exists

New-Eventlog -LogName Application -Source “Powershell – Restart Service” -ErrorAction Ignore


# In second or third run, wait a minute before trying
to start the service

if ($i -gt 0){Start-Sleep -s 60}

#Try to start the service

Start-Service $ServiceName

$Service Get-Service -Name $ServiceName

     if($Service.Status -eq “Running”)


    $ServiceStarted = $true



    if (($i -eq 3) -and ($ServiceStarted $false))


    $eventmessage = $Servicename failed to restart after $i attempts, exiting script”

    #Log error event in eventviewer

    Write-Eventlog -LogName Application -Source “Powershell – Restart Service” -EntryType Error -Eventid 101 -Message $eventmessage




Until ($ServiceStarted = $true)

 $eventmessage = $ServiceName restarted after $i attempt(s)”

Write-Eventlog -LogName Application -Source “Powershell – Restart Service” -EntryType Information -Eventid100 -Message $eventmessage

 If you have any difficulties doing this, don’t hesitate to drop a comment below.

If you find this post useful, please consider buying me a virtual beer with a bitcoin donation: 3QhpQ5z5hbPXXRS8x6R5RagWVrRQ5mDEZ1


Best regards,



Quick tip ! Azure Automation

November 19, 2014


Want to save some money on your cloud infra ? Make sure to put it off when you’re not using it.

And now you have the ability to use some automation features for this.

Compare it to orchestrator here :


Log on to the azure management portal and open automation



Create an account


Fill in accountname and select region


Ok now we can create a new runbook . You can create one from scratch or use an existing runbook.


In this case we want to shut down the environment.


You can review the script presented.


And modify the name, account or subscription.



Ok now go to the runbook and modify the required parameters.

Use the author command.



Test the runbook



And verify the result




As you can see we need to create a connection Asset. So back to to the runbooks -> Assets.

Additional information about the assets can be found here

And add a setting. Make sure to copy your subscription ID before starting the wizard !


Select a connection, Azure, give it a name.


And create a cert and paste your subscription id.



Now create a self signed certificate for uploading to Azure.

Use server 2012 R2 web services.


Open IIS -> Server certificates



Create a self signed certificate



Modify name and leave it in personal store




Click view details and copy to file



Export once as cer without private key.


And once as .pfx with the private key.



Now add the .cer file to Azure management certificates.



Now back to Azure Automation and create an additional credential asset.



Next up browse for your .pfx file and enter your password.




Now go to the runbook and modify the parameters using the author tool.



$MyConnection -> This your Automation connection created in the assets section

$MyCert = This is the name of the new imported credential in the assets section


Also correct the Azure subscription name hardcoded in the script.




Save , test and verify result.


Haleluja ! Success !

Now all we need to do is add a schedule and that’s it.



Now create a new schedule


Name it.


In this case set to Friday , 19:00 each 7 days.


That’s it , imagine the possibilities.



Gino D

Additional info can be found here :


Application Approval Request Notification from Configuration Manager 2012 using Powershell

May 27, 2014

Hi all,


Today I was working at a customer and configuring the Application Catalog using Configuration Manager 2012 R2. The customer was interested in the application approval process but was a little disappointed that out-of-the-box it’s not possible to receive notifications when an approval request arrives in Configuration Manager.

As the customer only has Configuration Manager it’s not possible to use any other System Center product like Orchestrator or Service Manager to get things going.

I created an alternative under the form of a Powershell script that runs on a specific schedule (eg. Once every day) to gather all application requests that have a pending approval. This report is emailed to the IT mailbox of the customer. This also makes sure that an administrator doesn’t have to check every now and then in the approval request section of the Configuration Manager console to see if anything new has arrived.

What the script does is basically the following:

  • Reading all data from the WMI class SMS_UserApplicationRequest
  • Filtering all requests which have a current state of 1 ( which means requested)
  • Creating an HTML document which displays a table with all pending requests
  • Sending an email to the IT mailbox with the table as contents. The table contains per request: username, application name, comments and last modified date

The report looks as follows


Anyone that might be interested in this script can comment below and I’ll be happy to help.