Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 21006 Source: OpsMgrConnector

The OpsMgr Connector could not connect to <server>. The error code is 10061L (No connection could be made because the target machine actively refused it). Please verify there is network connectivity the server is running and has registered it's listening port and there are no firewalls blocking traffic to the destination.
From a Microsoft support forum: "The "OpsMgr Connector" error 21006 may occur if SCE Agent communication port does not open or related two SCE certificates are not correctly installed on the problematic agents.

The "Userenv" 1058 error usually occured when there are DNS/network/proxy setting problems.

Make sure you have run the "Feature Configuration Wizard" on the SCE server, it will create one SCE managed computer group and WSUS related two GPO;  Run gpresult and check whether the “SCE Managed Computers Group Policy” is applied on those clients.

Also, please check the following factors:

1. Make sure the clients and SCE server can be resolved by each other in your domain network environment;

Run IPconfig to check if DNS settings are all right. The clients should has correct DNS namespace. Check all software/hardware firewall to make sure following ports are open:

TCP 135, TCP 139, TCP 445, TCP 5723(Agent communication port), TCP  8530/8531, UDP 137, UDP 138; (you may use telnet or netstat command to test opening ports.)

2. Please check if you are using Proxy server on the clients and the configurations are all right. If Microsoft Proxy Server 2.0 Client Software has been installed. If so, please temporarily uninstalled it to have a check.

Please check if the issue still persists now. If it does, go on with Step 3 below:

3. Run "gpupdate /force" on the problematic clients to make sure that you get the latest policy from AD.

Run “wuauclt /detectnow” and then “wuauclt /reportnow” on problematic clients to report the status to SCE server."

One user confirmed this: "I found all the GPOs were not installed by the feature configuration wizard, so I ran it again and now everything seems to be OK."
One user reported these events as being recorded when the System Center Essentials 2007 server was decommissioned (and a new one installed). The proper way to move an SCE is to first uninstall the agents (from the old server) and then reinstall them from the new server.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.