After upgrading our SCOM version to 2007 R2, I start to receive the error “Login failed for user ‘NT AUTHORITY\ANONYMOUS LOGON’” on the BizTalk database server. The login failure was occurring every 5 minutes. First I read the standard trace from SQL to get more information. In the standard trace I could see the process ID that was causing the login failure. The next step was to login on the BizTalk server and see which process was generating the login failures; I then found out that the process generating the error was the “wmiprvse.exe”. Then together with one of the system engineers we looked in the event viewer to see if there were other errors occurring at the time of the login failures. We saw that the in the operations manager event log were a lot of warnings and the times were exactly the same as the login failures time. There were three warnings; below you can see the warnings:
Event Type: Warning
Event Source: Health Service Modules
Event Category: None
Event ID: 10409
Date: DD/MM/YYYY
Time: HH:MM:SS
User: N/A
Computer: SERVERNAME
Description:
Object enumeration failed
Query: ‘SELECT * FROM MSBTS_GroupSetting WHERE Name = ‘BizTalk Group”
HRESULT: 0xc0c025ca
Details:
One or more workflows were affected by this.
Workflow name: Microsoft.BizTalk.Library.BizTalkGroup.Discovery
Instance name: Microsoft.BizTalk.2006.BizTalkServer.ServerRole
Instance ID: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
Management group: Management group name
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Warning
Event Source: Health Service Modules
Event Category: None
Event ID: 10409
Date: DD/MM/YYYY
Time: HH:MM:SS
User: N/A
Computer: SERVERNAME
Description:
Object enumeration failed
Query: ‘SELECT * FROM MSBTS_server’
HRESULT: 0x80131904
Details:
One or more workflows were affected by this.
Workflow name: Microsoft.BizTalk.2006.BizTalkServer.LocalApplication.Discovery
Instance name: Microsoft.BizTalk.2006.BizTalkServer.ServerRole
Instance ID: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
Management group: Management group name
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Warning
Event Source: Health Service Modules
Event Category: None
Event ID: 10409
Date: DD/MM/YYYY
Time: HH:MM:SS
User: N/A
Computer: SERVERNAME
Description:
Object enumeration failed
Query: ‘SELECT * FROM MSBTS_HostSetting’
HRESULT: 0x80131904
Details:
One or more workflows were affected by this.
Workflow name: Microsoft.BizTalk.Library.Host.Discovery
Instance name: Microsoft.BizTalk.2006.BizTalkServer.ServerRole
Instance ID: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
Management group: Management group name
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
At that moment we knew the problem was caused by SCOM, but we still didn’t know how to solve the problem. Then my colleague found a post on Microsoft TechNet where the solution to the problem was explained. After following the steps shown in the Microsoft TechNet post the problem was solved. You can find the TechNet post on this link http://social.technet.microsoft.com/Forums/en-US/operationsmanagermgmtpacks/thread/cb63fb92-41e7-495e-9e1c-cf790a37ff82. If you are experiencing this problem I hope this post will help you. In case you have any questions don’t hesitate to contact me.
IgnacioSalom.com 