Health Checker how to setup schedule task doc

[techieweenie]

Provide Version Number
Provide the version of the script that has the issue.
Version 22.04.26.1650

Describe the issue
A clear and concise description of the issue.
Script works great when run manually. However, I am tasked with running it as a scheduled task monthly. I have tried setting up as a scheduled task on the Exchange Server with these parameters in the action tab:
Start a program:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
argument:
-NonInteractive -WindowStyle Hidden -command ".'C:\Program Files\Microsoft\Exchange Server\V15\Bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto; 'C:\Admin Tools\HealthChecker\HealthChecker.ps1 -server MQSGMQEXCHPRS01 BuildHtmlServersReport'"

Expected behavior
A clear and concise description of what you expected to happen.
What I would like is to have the script to update, run, and generate the html of the report.

Script Output
If applicable, add the exception that wasn't handled.
Task history shows task completes with an operational code of (2).

Additional context
Add any other context about the problem here.
I have the task configured on the Exchange server itself, using my credentials. Ideally I would like to have it run from our task scheduling cluster (which uses SYSTEM accounts to run.) The nodes of the task scheduling cluster are local admins on the Exchange server but would I need to add them to a role group for the permissions?
Once the html has been output to the folder, I have another script run to pick it up and email it to our ticketing system.

[dpaulson45]

You need to do something like this within your task:

.\HeathChecker.ps1 -ScriptUpdateOnly; .\HeathChecker.ps1 -Server "ServerName"; .\HealthChecker.ps1 -BuildHtmlServersReport

This will allow you to get what you want done.

[lusassl-msft]

You can also skip 'C:\Program Files\Microsoft\Exchange Server\V15\Bin\RemoteExchange.ps1'; Connect-ExchangeServer -auto as this is automatically performed by the script.

[dpaulson45]

@techieweenie does the above comments provide the information you are looking for?

[dpaulson45]

@lusassl-msft to create a doc page on how to do this task.

[techieweenie]

Hi David and Lukas, Thank you for your recommendations. I am trying to get each individual script to run in the task scheduler but so far have been unsuccessful. Obviously I'm doing something wrong, whether it's in the syntax of how I have the argument set up, the script path, not sure. Trying a couple of different tests. Right now it looks like this: Start a program C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Argument -command 'C:\Admin Tools\HealthChecker\HealthChecker.ps1' -ScriptUpdateOnly If you spot the problem, please let me know. Thank you, Kim Vogel

…

On Tue, May 10, 2022 at 7:21 AM David Paulson ***@***.***> wrote: @techieweenie <https://github.com/techieweenie> does the above comments provide the information you are looking for? — Reply to this email directly, view it on GitHub <#1008 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AEACJ3DG2MBN6IKXQYDRR2DVJJBDZANCNFSM5VPO2P5Q> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[lusassl-msft]

@techieweenie we will create a doc page to cover this topic. Will keep you posted here when it's done.

[techieweenie]

Sounds good, thanks!

…

On Fri, May 13, 2022 at 5:46 AM Lukas Sassl ***@***.***> wrote: @techieweenie <https://github.com/techieweenie> we will create a doc page to cover this topic. Will keep you posted here when it's done. — Reply to this email directly, view it on GitHub <#1008 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AEACJ3A2JZJN6MSWHVRLOF3VJYQGDANCNFSM5VPO2P5Q> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[lusassl-msft]

I'm working on this now.

[lusassl-msft]

@techieweenie Please have a look and let me know what you think: https://microsoft.github.io/CSS-Exchange/Diagnostics/HealthChecker/RunHCViaSchedTask/

[techieweenie]

@lucassl-msft

Thank you so much! We are checking it out.

[JeremyTBradshaw]

@lusassl-msft I'm taking a look at scheduling task for HealthChecker.ps1 and running into Local System (Exchange 2016 server) unable to successfully get into a PSSession due to AuthZ error:

[AuthZRequestId=72fa92b8-4ef1-452a-8ff5-bdf141268094][FailureCategory=AuthZ-CmdletAccessDeniedException] The operation
couldn't be performed because 'DOMAIN\SERVER_NAME$' couldn't be found. For more information, see the
about_Remote_Troubleshooting Help topic.

Looks like this is the solution: https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/authz-fails-access-denied-error-application-access-check

I see in HCScheduledTask that the first step mentioned is to create a service user account. I'm wondering if that is because of this issue which I'm encountering (assuming it's common). The reason I ask is that the main docs page for HealthChecker.ps1 says:

Required Permissions:
Please make sure that the account used is a member of the Local Administrator group. This should be fulfilled on Exchange servers by being a member of the Organization Management group.

Question is: Can you please confirm my understanding is correct? If it is, I'd submit a PR to update the HealthChecker.ps1 and HCScheduledTask pages to include some notes about this. Thanks in advance.

[lusassl-msft]

@JeremyTBradshaw I don't think that you can run the scheduled task as local system as this would lead to failures querying the Exchange organization information from AD. Therefore, the recommended way to go is to create a dedicated service account, add it to the Organization Management group or to View-Only Organization Management group and run the scheduled task by using this account.

If you decide to use View-Only Organization Management, you must also add the account to the local administrators group on each Exchange Server (e.g., by the help of a group which is then added to the local administrators or by using a GPO to deploy the account).

[JeremyTBradshaw]

@lusassl-msft Thanks, and I see now what I was misinterpreting... The "This should be fulfilled on Exchange servers by being a member of the Organization Management group." line in the main docs page for HealthChecker.ps1, I was reading that as if it meant the server itself. I get it now and see it means the user running the script, if they are a member of Org.Mgmt, then they'll also naturally be local admins. It was wishful thinking taking over :).

[lusassl-msft]

No problem. If you think that we should improve the wording, feel free to provide a suggestion to make it more clear.

[JeremyTBradshaw]

I won't bother updating the wording as I do think it's fine as-is and just had an oversight. But I will paste this link here in case anyone stumbles upon it and finds it useful:

HealthChecker.runHelper.ps1