SQL Server 2012 syspolicy_purge_history fails step 3 "Erase Phantom System Health Records."

Question

I recently installed SQL Server 2012 Ent (x64). The install is a stand alone default instance.
The syspolicy_purge_history job fails on step three with the following error:
Executed as user: <DomainName>\sql_xxx_agt_svc. A job step received an error at line 1 in a PowerShell script. The corresponding line is 'set-executionpolicy RemoteSigned -scope process -Force'. Correct the script and reschedule the job. The error
information returned by PowerShell is: 'Security error.  '.  Process Exit Code -1.  The step failed.
Here is the code that is in the step:
if ('$(ESCAPE_SQUOTE(INST))' -eq 'MSSQLSERVER') {$a = '\DEFAULT'} ELSE {$a = ''};
(Get-Item SQLSERVER:\SQLPolicy\$(ESCAPE_NONE(SRVR))$a).EraseSystemHealthPhantomRecords()
The domain user is the account that SQL Agent is running as.
What permissions need to be granted to this account?
Here is the link to the Connect post:
https://connect.microsoft.com/SQLServer/feedback/details/754063/sql-server-2012-syspolicy-purge-history-job-step-3-fails-with-security-error

Answer 1

I'm putting this in the connect post as well, but putting here in case somoene else comes across it.
I was having the same problem with the syspolicy_purge_history job right after a standalone SQL 2012 (with SP1 and cu4,
11.0.3368.0 (X64)) install that happened to be on a cluster but was not going to be a clustered instance. After trying all the different suggestions here around the ExecutionPolicy, I was still getting nowhere.
Turns out, having a named isntance with a static port number and the SQL Browser service disabled was causing my problems. Apparently that was not allowing PowerShell to find the SQL instance. When I would navigate the SQLSERVER:\SQLPolicy folder
in PowerShell (sqlps), I could get to the server root, but not the instance. If I even tried to list the subdirectories under the server folder, I would get an error:
PS SQLSERVER:\> cd .\SQLPolicy\SRVR
PS SQLSERVER:\SQLPolicy\SRVR> ls
WARNING: 'INST' not available: Failed to connect to server. --> A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: SQL Network Interfaces, error: 26 - Error Locating Server/Instance Specified)
PS SQLSERVER:\SQLPolicy\SRVR> cd .\INST
cd : Failed to connect to server .
At line:1 char:3
+ cd <<<< .\INST
+ CategoryInfo : NotSpecified: (:) [Set-Location], ConnectionFailureException
+ FullyQualifiedErrorId : Microsoft.SqlServer.Management.Common.ConnectionFailureException,Microsoft.PowerShell.Commands.SetLocationCommand
To solve this issue, I had to open SQL Server Configuration Manager and create an alias under the SQL Native Client 11.0 Configuration (I didn't need to set the 32-bit one):
Alias
[server name]\[instance name]
Port
[my static port]
Protocol
TCP/IP
Server
[server name]\[instance name]
Once this was done, I was able to set the ExecutionPolicy registry settings, and the job completed. Here are my registry settings:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\ExecutionPolicy = Restricted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.SqlServer.Management.PowerShell.sqlps110\ExecutionPolicy = RemoteSigned
From PowerShell (as Admin):
PS C:\Windows\system32> Get-ExecutionPolicy -list
Scope ExecutionPolicy
MachinePolicy Undefined
UserPolicy Undefined
Process Undefined
CurrentUser Undefined
LocalMachine Restricted
PS SQLSERVER:\> Get-ExecutionPolicy -list
Scope ExecutionPolicy
MachinePolicy Undefined
UserPolicy Undefined
Process RemoteSigned
CurrentUser Undefined
LocalMachine Restricted