SCOM Agent Causing Login errors with LSAsrv

Question

Bit of background:
We have numerous servers within a separated secure environment which are getting flagged as having failed login attempts every 4 hours. The exact same issue is presented in our normal estate.
Initially it presents itself as an error in the event log with EventID 6037 and the following information (this is what is flagging in our security system).
The program svchost.exe, with the assigned process ID 1876, could not authenticate locally by using the target name HOST/.. The target name used is not valid. A target name should refer to one of the local computer names, for example, the DNS host name.
This actually turns out to be controlling RemoteRegistry.
The following link is a work around for this, but preferably, I don't want to disable loop back checking or strict name checking. 
https://social.technet.microsoft.com/Forums/systemcenter/en-US/05cedf19-cd02-4c26-9651-4b5d5f46d58b/event-6037-lsasrv?forum=operationsmanagergeneral
(For some reason I now can't find the actual MS KB describing the work-around)
The other alternative is to then amend a registry key for BackConnectionHostNames [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0] (Sorry can't find the KB where I saw the work around for this now). However, given the number of servers affected,
I'm reluctant to go down this route. 
I've disabled the SCOM agent and this is definitely the culprit; so the final option is to work out which ManagementPack has been incorrectly setup and then either override it or amend it for the servers. 
I've run ETL tracing on one of the servers and get the following output (I believe the two relevant lines are the [13080] [8644] lines, and the timings coincide exactly with the LSASrv.exe eventIDs.
[1] [13080] [8644] [03/09/2015-15:10:06.978] [HealthServiceCommon] [] [Warning] [] [CFileUtility::_CheckAndCreateDirectory] [FileUtility_cpp202]GetFileAttributesEx on path "C:\Program Files\System Center Operations Manager 2007\Health Service State\Monitoring Host Temporary Files 59\2438\" failed with code 2(ERROR_FILE_NOT_FOUND).
[0] [13080] [8644] [03/09/2015-15:10:07.000] [HealthServiceCommon] [] [Warning] [] [CFileUtility::_CheckAndCreateDirectory] [FileUtility_cpp202]GetFileAttributesEx on path "C:\Program Files\System Center Operations Manager 2007\Health Service State\Monitoring Host Temporary Files 59\2434\" failed with code 2(ERROR_FILE_NOT_FOUND).
[1] [13080] [8644] [03/09/2015-15:10:07.012] [HealthServiceCommon] [] [Warning] [] [CFileUtility::_CheckAndCreateDirectory] [FileUtility_cpp202]GetFileAttributesEx on path "C:\Program Files\System Center Operations Manager 2007\Health Service State\Monitoring Host Temporary Files 59\2430\" failed with code 2(ERROR_FILE_NOT_FOUND).
[1] [13080] [8644] [03/09/2015-15:10:07.017] [ModulesLibrary] [] [Error] [] [MOMXmlSupport::LoadElement] [MOMXmlSupport_cpp823]`VariantChangeTypeEx(&bstrVar, &bstrVar, LOCALE_INVARIANT, 0, VT_R8)` failed, returning ERROR: {hr= 0x80020005(DISP_E_TYPEMISMATCH)}
[0] [13080] [12132] [03/09/2015-15:10:07.038] [ModulesPerformance] [] [Error] [] [McPerformance::Snapshot::getNextObject] [McPerfSnapshot_cpp2115]makePerfPtr returned NULL
[2] [13080] [10612] [03/09/2015-15:10:07.134] [ModulesLibrary] [] [Error] [] [MOMXmlSupport::LoadElement] [MOMXmlSupport_cpp823]`VariantChangeTypeEx(&bstrVar, &bstrVar, LOCALE_INVARIANT, 0, VT_R8)` failed, returning ERROR: {hr= 0x80020005(DISP_E_TYPEMISMATCH)}
[2] [13080] [9540] [03/09/2015-15:10:07.138] [ModulesLibrary] [] [Error] [] [MOMXmlSupport::LoadElement] [MOMXmlSupport_cpp823]`VariantChangeTypeEx(&bstrVar, &bstrVar, LOCALE_INVARIANT, 0, VT_R8)` failed, returning ERROR: {hr= 0x80020005(DISP_E_TYPEMISMATCH)}
[0] [13080] [8644] [03/09/2015-15:10:07.451] [ModulesCommon] [] [Warning] [] [CModuleUtility::IsLocalMachine] [ModuleUtility_cpp135]Unable to find the address for the specified machine (.), assuming remote monitoring, error = 11002(WSATRY_AGAIN)
[0] [13080] [12628] [03/09/2015-15:10:07.460] [ModulesLibrary] [] [Error] [] [MOMXmlSupport::LoadElement] [MOMXmlSupport_cpp823]`VariantChangeTypeEx(&bstrVar, &bstrVar, LOCALE_INVARIANT, 0, VT_R8)` failed, returning ERROR: {hr= 0x80020005(DISP_E_TYPEMISMATCH)}
[0] [13080] [8644] [03/09/2015-15:10:07.769] [ModulesCommon] [] [Warning] [] [CModuleUtility::IsLocalMachine] [ModuleUtility_cpp135]Unable to find the address for the specified machine (.), assuming remote monitoring, error = 11002(WSATRY_AGAIN)
[0] [13080] [7060] [03/09/2015-15:10:10.097] [ModulesExpressionEvaluator] [] [Error] [] [RegExExpression::Evaluate] [MOMExprEvaluator_cpp2787]`EXPR: m_pValue->Evaluate(pitfEvaluateValue, pitfReportError, pitfProcessTrace, &spValue) FAILED` {setting hr= HRESULT=80FF0059}
So essentially my question is now that I've narrowed it down to it being a management pack of SCOM, whats the best process to work out which particular management pack is causing this? 
Is there a way to get a list of all management packs that apply to a computer object? If I can get this, I can then work out which ones are on a 4 hour timer to narrow the list down and then systematically create overrides to work out which one it is. 
Kind Regards,
Kevin

Answer 1

Hi,
If there is something wrong with the agent, we should get alerts in SCOM console for this agent. Please also check is there any errors or warnings in operation manager event log on this agent.
And here are two links about geting monitors, rules runnin on an agent, hope it can be helpful for you
What Monitors, Rules and Discoveries are running on an OpsMgr Agent?
http://blogs.technet.com/b/stefan_stranger/archive/2010/11/30/what-monitors-rules-and-discoveries-are-running-on-an-opsmgr-agent.aspx
How to View All Rules and Monitors Running on an Agent-Managed Computer
https://technet.microsoft.com/en-us/library/hh212748.aspx?f=255&MSPPError=-2147217396
Regards,
Yan Li
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]