Contributed
By: Paul van de Ven
The suggested workaround for creating the MOMLatencyMonitors container
manually remains a workaround and does not tackle the underlying problem.
The problem lies in the fact that the MOMLatencyContainer is created under
the LocalSystem account and tries to create the container on the PDC role
holder. The account has all the rights for the local system on the Domain
Controller and not for its networked fellow DC's. Since the FSMO roles can
be separated on a larger domain with multiple DC's their roles differ. If
the script responsible for creating the MOMLatencyMonitors container is
running from a DC other than the PDC role holder, it tries to create the
container but fails due to its intrinsic rights being local. In my opinion
this is the reason why creation of that particular container fails.
Underlying containers are easily created because they are created locally.
If this story holds any good, it might be crucial to a successful
implementation of the Active Directory Management Pack and therefore
noteworthy of mentioning it in the "AD Management Pack Implementation
Guide". You wouldn't have to offer the workaround as a solution but instead
give directions on how to deploy the agents depending on their FSMO roles.
So, if the ADMP is used and the agent is run under LocalSystem, the first DC
to push the agent to would be the PDC role holder.
|