Example of setting up a custom monitor in SCOM with a Powershell Script – Monitor NIC teams in SCOM

In this blogpost, I’ll run through an example of how to configure a monitor from the ground up, going through every step, for making a monitor in Powershell for SCOM. It’s a very basic script, but it have a value we measure on, so you have all the basic building blocks. But first…

What time is it? ADVENTURE TIME!

The other day I was transferring an OS Image to one of our new Hyper-V servers, and the transfer speed was around 10 Mbit on our internal network. Asking the guy responsible for the server if there was something wrong, and the answer was immediately “YOU!”… Well, it turned out that there was something more behind it. We did some diagnostic, and one of the network cards was only working at a very low speed, and since the NIC was teamed, I was just unlucky getting connected on the slow NIC. So how do we take those kind of problems before they grow into larger problems? We monitor our NICs and the speed on the combined team.

So we have 2 NICs in our physical servers, those 2 are combined into a NIC Team, and since they are 1 Gbps we know the combined linkspeed should be 2 Gbps.

Getting the speed of the NIC Team in Powershell

If we run the following line on the server in Powershell:

Get-NetAdapter -Name CTLAN-TEAM | select LinkSpeed

We get the following response:

2016-02-25 14_20_53-CTHVP111 - Remote Desktop Connection

This is what we want, this is the healthy state. However, when we want to do a comparison in SCOM, we don’t want the header included, so we want to run the following line:

Get-NetAdapter -Name CTLAN-TEAM | select LinkSpeed –ExpandProperty LinkSpeed

So now the reply is:

2016-02-25 14_25_33-CTHVP111 - Remote Desktop Connection

Configure a monitor in SCOM using Powershell script

Now let’s configure a monitor in SCOM with our simple Powershell script. Firstly, if you don’t already have the “Sample Management Pack”, which is used for creating Powershell script in SCOM, go ahead and download and install that first. It can be fetched from here: https://gallery.technet.microsoft.com/Sample-Management-Pack-17b76379

  • Open SCOM
  • Click on Authoring
  • Click on “Monitors”
  • Right-click and select “Create a monitor” -> “Unit monitor”
  • Expand: “Scripting”->”Generic”->”Sample Powershell Script 2 State Monitor”
  • Select a management pack for it, or create a new one. Usually I’ll create a new management pack since it’s easier for an export to a customer and easier to pick out a package/function.
  • You should now end up on the first page in the “Sample Powershell Script 2 State Monitor” as pictured below:
    2016-04-12 09_59_33-ctom01 - Remote Desktop ConnectionLet’s rundown through the different fields. Name is what the monitor will be called when we’re looking for it in SCOM. Monitor Target is the target for the monitor, since we want to monitor our Windows Servers. Parent monitor is the 4 different overall monitors: Availability, Configuration, Performance and Security. For this select: Performance, since we want to measure the performance of the NICs in the server, since that what’s dropped from  2 Gbps to 1.01 Gbps. And one final important step, remove the checkmark in: Monitor is enabled. We want to disable the monitor, since it’s rare that we want a monitor to run on all instances of a target. This might sound counter-intuitive, but instead we want to do an override, especially when testing a new monitor, so we only enable it on a very specific amount of servers.


  • In the next step “Schedule”, we specify how often we want the monitor to run, 15 minutes should be sufficient for this type of monitor.
  • Now in the next step, we insert the actual script:
    2016-02-25 10_13_25-ctom01 - Remote Desktop ConnectionOkay, let’s run through the script:


$api = New-Object -comObject “MOM.ScriptAPI”  

$PropertyBag = $api.CreatePropertyBag()


$speed = Get-NetAdapter -Name CTLAN-TEAM | select LinkSpeed -ExpandProperty Linkspeed




The first two lines:

$api = New-Object -comObject “MOM.ScriptAPI”  

$PropertyBag = $api.CreatePropertyBag()


These lines create a “propertybag” which can be used for transfering information back to SCOM.


The next line:

$speed = Get-NetAdapter -Name CTLAN-TEAM | select LinkSpeed -ExpandProperty Linkspeed

This is the command we tried earlier, we just write the result to the variable $speed.


Next we have the following lines:



First we add the value from the variable $speed to our propertybag in a field called: “Speed”. Next we just transfer the fields and values from PropertyBag back to SCOM so we can perform test on the values.

  • Let’s go on to the next step, we want to specify what an unhealthy expression look like for SCOM.
    2016-02-25 10_15_24-ctom01 - Remote Desktop Connection


Here the tricky thing is the parameter name, to refer to the field speed, we use the following command:


When the value of the field Speed is not equal to 2 Gbps, then the NIC team is an unhealthy state.

  • On the next page we specify that a healthy state for parameter: Property[@Name=”Speed”] is when it’s equal to 2 Gbps. So now just “Create” the monitor.


Overriding a monitor

Now we actually want to use the monitor on a server. So we create an override:

  • Navigate to: Authoring -> Management Pack Objects -> Monitors
  • Search for the monitor name.
  • Right-click on the monitor and select: Overrides -> Override the Monitor -> For a specific object of class: Windows Server. See the image below:
    2016-04-12 10_54_17-ctom01 - Remote Desktop Connection

  • Now, change the value of enabled to true, and now the monitor is activated for the specific object you selected:
    2016-04-12 10_54_53-ctom01 - Remote Desktop Connection

So now, you have a simple monitor for SCOM which uses a Powershell script.

In case you were wondering, >someone< used a defective cable in one of the NICs.

Comments (6):

  1. Kolbi says:

    Thanks for creating this article!

    I created a powershell configuration monitor, targeted it to the group of servers I want to monitor, enabled it and put in the override as you depict. After that I am expecting that when I go to monitoring, double click on one of the servers in my target group I am expecting that monitor to show up under Entity Health-Configuration-(New configuration monitor). It’s not though and I’ve been banging my head against this all afternoon. Figure I’m missing something really simple.

    Thanks for your help!

  2. Kolbi says:

    Figured it out…

  3. marinemonk says:

    Trying to apply this method to an Azure PS script

    PS C:\Windows\system32> Get-AzureRmResource -ResourceGroupName xxx -ResourceType Microsoft.Network/expressRouteCircuits -ResourceName XXXX -ApiVersion 2016-09-01 | select Properties


    Try to apply this to your example – and i just want a healthy alarm if the result is enabled and Critical if anything else

    $api = New-Object -comObject “MOM.ScriptAPI”

    $PropertyBag = $api.CreatePropertyBag()

    $status = Get-AzureRmResource -ResourceGroupName xxx -ResourceType Microsoft.Network/expressRouteCircuits -ResourceName -ApiVersion 2016-09-01 | select Properties



    i then add unhealthy if enabled not present and healthy is present.
    Added the Monitor to the Azure Resource monitor under availabilty.

    I can’t see anything – no monitor.
    A folder is created in the monitoring pane and i added a status view – but nothing.

    How to troubleshoot the script and where does it log errors ?


  4. Jared says:

    Where are errors logged? Should I add language to the script to log errors to a file somewhere?

  5. Tech Guy says:

    Does this really work ?
    I created the same way as you did, But it does not work.

    I have the screenshots uploaded in the below link,


    I get this event id on the computer where it executes:

    Event id: 21405

    he process started at 22:40:14 failed to create System.PropertyBagData, no errors detected in the output. The process exited with 1

    Command executed: “C:\Windows\system32\cscript.exe” /nologo “Servicemon.ps1”
    Working Directory: C:\Program Files\Microsoft System Center 2012 R2\Operations Manager\Server\Health Service State\Monitoring Host Temporary Files 93\51099\

    One or more workflows were affected by this.

    Workflow name: UIGeneratedMonitor3180f81488dc48bb82aed10cc3ee6f3a
    Instance name: MymanagementserverFQDN
    Instance ID: {7763C0F5-60AA-362A-4225-5D45C89E21BB}
    Management group: MYMG

    Any one knows whats wrong.

Leave a Reply