SCOM 2007 R2 Subscriptions getting automatically disabled

Subscriptions getting automatically disabled every 30 minutes because of internal Microsoft.SystemCenter.ValidateAlertSubscription validation that runs every 30 minutes!





Open Operations Manager log on your RMS server and filter it to find only 11452 events. Here's the text of the event:

Log Name:      Operations Manager
Source:        Health Service Modules
Event ID:      11452
Task Category: None
Level:         Warning

Validate alert subscription data source module encountered an alert subscription data source with configuration that has gone out of scope. Disabling the alert subscription data source module.

Alert subscription name: Subscription2ea14c42_4648_46f0_8d74_135223f637b1

One or more workflows were affected by this.
Workflow name: Microsoft.SystemCenter.ValidateAlertSubscription

The root cause of the problem was the creator of this subscription, the user that was in SCOM administrators group, but then his account was moved to a different role.

Two possible solutions:
- add this user again to SCOM administrators group and reenable subscriptions
- export internal notifications management pack, update SIDs of users and reimport it again

The first method is not interesting at all.

The second method should be done in the following way:

1.  Create a new subscription, do not enable it. It will be needed to get a "good" SID for an old one which doesn't work
2.  Export "Notification Internal Library" management pack to a temporary folder
3.  Edit this .xml file:

find string with <UserSid></UserSid> tags for a new subscription
copy the value of the user SID
update  <UserSid>...</UserSid> for old subscriptions with this value
update the version of this management pack(in my case it's 6.1.7221.0, I've set 6.1.7221.1)
    4.    Import it back to SCOM

upd. The best solution is to place there any service account, for example SDK service account. That will solve this problem permanently.