Hi,
With SCOM 2016 (+/-UR1) sometimes when trying to create a new maintenance mode schedule the following error is displayed:
The EXECUTE permission was denied on the object 'sp_help_jobactivity', database 'msdb', schema 'dbo'.
The data access service account might not have the required permissions
As a workaround for this, we can grant this right. Please note that if the System Center Data Access service is running under local system , the permission will have to be granted for the computer account ( of all management servers)
use msdb
go
Grant Execute ON OBJECT::[dbo].[sp_help_jobactivity] To [domainusername]
Further, when proceeding with the creation of the MM schedule a further error appears:
Microsoft.EnterpriseManagement.Common.ServerDisconnectedException: The client has been disconnected from the server. Please call ManagementGroup.Reconnect() to reestablish the connection. ---> System.ServiceModel.CommunicationObjectFaultedException: The communication object, System.ServiceModel.Channels.ServiceChannel, cannot be used for communication because it is in the Faulted state. Server stack trace: at System.ServiceModel.Channels.CommunicationObject.ThrowIfFaulted() at System.ServiceModel.Channels.ServiceChannel.Call(String action, Boolean oneway, ProxyOperationRuntime operation, Object[] ins, Object[] outs, TimeSpan timeout) at System.ServiceModel.Channels.ServiceChannelProxy.InvokeService(IMethodCallMessage methodCall, ProxyOperationRuntime operation) at System.ServiceModel.Channels.ServiceChannelProxy.Invoke(IMessage message)
To solve this, grant the following rights for the SDK/DAS account(or if local system to the MS computer accounts) to the MSDB database:
- SQLAgentOperatorRole
- SQLAgentReaderRole
- SQLAgentUserRole
What I saw is that if these rights are not added the error is not displayed if the SDK is running under a local system account, but will create a bulk of maintenance schedules and will cause a flood of data and SQL agent jobs. Trying to add/delete maintenance schedules from the SCOM console will just time out after this. It does not make a difference if powershell commandlets are used instead.
So if a lot of "invalid" maintenance schedule entries and jobs are created, make sure the above rights are added for the MS computer account on the MSDB database.