Dreaded "Operations Manager failed to start a process" error (2012 R2)

Question

I know this error has been covered many times, and on many topics, but this time mine is slightly different.   It's
NOT the
"SCOMpercentageCPUTimeCounter" error covered by Kevin Holman.
Also, I am running SCOM 2012 R2 UR4 (7.1.10226.1046) and everything seems correctly patched (MS and agents), like
suggested by Nicole Welch and Kevin Holman as well.
So my environment is a fresh installation of SCOM 2012 R2, and I am transferring to this new Management Group, the monitored servers from our old SCOM 2012 "R1" (which I did not upgrade but rather made a brand new independent install).  So
all servers aren't migrated yet, but I would like to solve this error before. This error did NOT happen in "R1", nor was it overridden (I imported the exact same Management Packs anyway).
On 2012 R2, it happens on almost all new monitored machines, mainly Read-Only Domain Controllers (RODCs).
Here is the kind of alert text I am getting:
Het om 10:10:15 gestarte proces is beëindigd als gevolg van een uitvoerverzamelfout als gevolg van fout 0x80070057 :
The parameter is incorrect.
; mogelijk zijn er gegevens verloren gegaan.
Opdracht die is uitgevoerd: "C:\Windows\system32\cscript.exe" //nologo "C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 193\24788\AD_Global_Catalog_Search_Response.vbs"
RODC02.mydomain.be (objectCategory=DMD) false 4 {9E253FCB-8AAF-491F-CCA3-E632C6C2800C}
Werkmap: C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 193\24788\
Dit is van invloed op een of meer werkstromen.
Werkstroomnaam: Microsoft.Windows.Server.2008.AD.DomainController.GCSearchTime.Monitor
Exemplaarnaam: RODC02
Our servers have Belgian (Dutch) regional settings, hence the language. But check out the highlighted info in bold.
The related event Number (in Alert Context) is 21404. Most other articles about this, mention 21402 or 21403. I suppose they all must be related but still, it's a new one here.
There you have the failing VBS file. I checked all alerts and there seem to be different files concerned overall. Other examples:
C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 233\22737\AD_Database_and_Log.vbs    (from almost all RODCs)
C:\Program Files\Microsoft Monitoring Agent\Agent\Health Service State\Monitoring Host Temporary Files 196\19876\Microsoft.Windows.Server.Legacy.FreeSpace.vbs
  (also from an RODC)
C:\Program Files\Microsoft System Center 2012 R2\Operations Manager\Server\Health Service State\Monitoring Host Temporary Files 5891\338282\Microsoft.Windows.Server.CPUUtilization.Monitortype.vbs 95 15
SCOM02.mydomain.be 1.4119384288787842     (this one is from my second Management Server..)
Repeat count of the alert is 1 to 2 a day, so it's not nightmareish, but still, requires to be fixed. I suspect that even if there is a different VBS file concerned, since the eventID and the alert text are the same, the repeat count will just increase,
not showing the last actual VBS concerned.
I connect to each of these servers, and browse to the directory containing the file, and the folder is there, the file is there.  The error text mentions incorrect parameters but they still seem OK to me. 
I found something which might be worth noting:  when browsing to the directory, be it on an RODC or on the SCOM server, I get a permission popup requiring some admin rights to do so - although I am using my domain admin (+SCOM+SQL+local
admin everywhere) account:
SCOM services use the Local System account to run, on every machine. I thought Local System shouldn't be concerned with these permissions popups, but normally the domain/local admins aren't either, yet I am.
The "Health service" folder is the only one from the "C:\Program Files\Microsoft Monitoring Agent\Agent" folder to be concerned with this; I can browse without trouble to any other directory there.
After a SCOM service stop, I renamed the "Health Service state" folder (as you can see on the screenshot, there is a "Health Service State bak" folder) and let the service recreate it after a restart, to ensure it was clean and with
appropriate permissions , but it doesn't help.
Might that be a clue?
Or else what?  I'm getting confused and don't find a suitable solution.
dd
Bix

Answer 1

On Thu, 4 Dec 2014 14:20:22 +0000, Bixessss wrote:
I know this error has been covered many times, and on many topics, but this time mine is slightly different.   It's*NOT* the "SCOMpercentageCPUTimeCounter" error covered by Kevin Holman <http://blogs.technet.com/b/kevinholman/archive/2010/02/23/a-new-script-error-scompercentagecputimecounter-vbs-invalid-class.aspx>.
Also, I am running *SCOM 2012 R2 UR4* (7.1.10226.1046) and everything seems correctly patched (MS and agents), likesuggested by Nicole Welch <http://nicolewelchscom.wordpress.com/2013/10/01/operations-manager-failed-to-start-a-process/>
and Kevin Holman as well.
This forum is for security issues related to Windows Server and not for
System Center questions.
Post your question in one of the following forums:
https://social.technet.microsoft.com/Forums/systemcenter/en-US/home?category=systemcenteroperationsmanager
Thanks.
Paul Adare - FIM CM MVP
Never trust a computer you can't lift. - Stan Masor