7016 - The Health Service cannot verify the future validity of the RunAs account

Question

Hi,
We have several gateways set up on our other domains (DMZ, Test and Dev) using certificates to connect to the RMS with a few agents reporting to the gateway in it's domain. I am recieving this warning for all gateways and agents that are being monitored (in the other domains).  All our servers are either Win 2003 32bit or Win 2003 64bit.
The Health Service cannot verify the future validity of the RunAs account PRODUCTION\username for management group PRODMGMT due to an error retrieving information from Active Directory (for Domain Accounts) or the local security authority (for Local Accounts). The error is The network path was not found.(0x80070035).
From the searching that I've done on the net, a couple of people have mentioned that if you set the password expiration flag on AD users and computers for the account the problem will go away.. This hasn't happened for me.
I have checked the logs on the gateway servers and they report the following messages:
Event Type: Error
Event Source: HealthService
Event Category: Health Service
Event ID: 7016
Date:  15/03/2010
Time:  6:05:25 AM
User:  N/A
Computer: DEMOMMS003
Description:
The Health Service cannot verify the future validity of the RunAs account PRODUCTION\username for management group PRODMGMT due to an error retrieving information from Active Directory (for Domain Accounts) or the local security authority (for Local Accounts).  The error is The network path was not found.(0x80070035).
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Warning
Event Source: HealthService
Event Category: Health Service
Event ID: 7020
Date:  15/03/2010
Time:  6:05:25 AM
User:  N/A
Computer: DEMOMMS003
Description:
The Health Service has validated all RunAs accounts for management group PRODMGMT, except those we could not monitor.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
However a few hours later I don't get any error messages and it seems to be working happily.
Event Type: Information
Event Source: HealthService
Event Category: Health Service
Event ID: 7026
Date:  15/03/2010
Time:  9:02:28 AM
User:  N/A
Computer: DEMOMMS003
Description:
The Health Service successfully logged on the RunAs account PRODUCTION\username for management group PRODMGMT
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Information
Event Source: HealthService
Event Category: Health Service
Event ID: 7023
Date:  15/03/2010
Time:  9:02:28 AM
User:  N/A
Computer: DEMOMMS003
Description:
The Health Service has downloaded secure configuration for management group PRODMGMT successfully.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Information
Event Source: HealthService
Event Category: Health Service
Event ID: 7025
Date:  15/03/2010
Time:  9:02:28 AM
User:  N/A
Computer: DEMOMMS003
Description:
The Health Service has authorized all configured RunAs accounts to execute for management group PRODMGMT.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Information
Event Source: HealthService
Event Category: Health Service
Event ID: 7024
Date:  15/03/2010
Time:  9:02:28 AM
User:  N/A
Computer: DEMOMMS003
Description:
The Health Service successfully logged on all accounts for management group PRODMGMT
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Despite the successful logs that appear the gateway still shows up with the same warning.
If i stop and start the service on the gateway it then shows up as healthy in SCOM, but then the next day it the warning comes back.
Is the problem caused by different domain acounts and when it tries to find it in the domain it can't find it?
Cheers, 
Phil

Answer 1

I also have the same problem with my scom 2012 system.
I am getting 7021 and 7016 events.
as mentioned by Jonathan, i am able to open notepad with the user account for which we are getting error.
another thing noted, when we run setspn -l domain\acc , we are getting error 
Ldap Error(0x51 -- Server Down): ldap_open
or
FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x00000525
Could not find account DOMAIN/account
Another point to add, my server is ABC.XXX.company.com and acc i am using us YYY\acc_name. I mean to say my account is of diff domain.
This config is working fine no issues at all in another server which was setup earlier with 2007 r2.
Manish
I recently had the same issue in our Forest. Did you try YYY.company.com\acc_name? If you use the netbios name, setspn (and scom does on account validation as well, if you just pick the domainname from the list) will try to resolve the dc via netbios. Two
alternatives: add the other domain to the dns searchlist for your network adapter (I won't do this one, this does not resolve the cause of the problem) or configure your action accounts with fqdn [email protected] The funny thing is, in scom event
you will see scom validated account "\[email protected]" (still add's the backslash)
Correction: this did not solve the issue as mentioned before, the error reappeared again... :(