SCSM: UR7 Bug & Fix: Activity Implementers Unable to Complete Manual Activities

Summary

SCSM 2012 R2 Update Rollup 7 introduced a bug with the permissions of Activity Implementers. This post contains a script used to create a workaround until the bug is addressed.

Introduction

 

In a previous post (link), I discussed why SCSM 2012 R2’s Update Rollup 7 was essential to any organization using SCSM. That remains true. However, the SCSM product team are mere humans, and as such mistakes sometimes happen. Recently I discovered a bug introduced in UR7 which breaks the Activity Implementers user role and any user roles based on it. It has been confirmed by the product team and a fix is forthcoming (likely in SCSM 2016). Users suffering from the bug need a workaround presently, though, so I developed a script (with some assistance from Mihai Sarbulescu) that provides a workaround for the UR7 bug until a fix is released.

 

This post describes the UR7 bug and provides the workaround script.

The UR7 Bug

 

One of the fixes introduced by UR7 is that Service Manager now properly sets values into the ActualStartDate and ActualEndDate properties of work items when they are opened and resolved, respectively. This is really useful for a number of organizations who wish to track metrics based on those stats and, prior to UR7, we needed to create custom workflows to set the values, which is a less optimal solution than having the product do it out of the box. UR7 fixed that, which is good.

 

However, one thing that was unfortunately overlooked is the permissions granted to the ActivityImplementer user role profile (the base set of permissions granted to the Activity Implementer user role and any custom user roles based on it). Referring to the User Role documentation on TechNet (link), we can see that the Activity Implementer user role has permissions to update only two properties – the “Status” and “Notes” fields of the Manual Activity class – and that no permissions are granted to update the “ActualEndDate” property. This is unfortunately not a case of the documentation being out of date; the permissions for the user role were not extended to support the changes made in UR7. As such, post-installation of UR7, you will find that any SCSM user who is a member of an Activity Implementer user role will be unable to save Manual Activities after marking them as “Completed” or “Failed”, since saving also triggers an update of the “ActualEndDate” property. The user instead gets an Access Denied error message, all due to the UR7 bug.

The Workaround

 

Fortunately, we are able to make (minor) modifications to the access permissions of user role profiles by interacting with the SCSM SDK via PowerShell. Unfortunately, there are no Cmdlets that provide this ability; to make this change, one has to have an understanding of the underlying SDK and security model SCSM uses. To say this is not well documented would be an understatement – aside from a small collection of scattered blog posts, there is no guidance on performing these tasks via PowerShell.

 

That reason is why I decided to write and provide a script that is pre-configured to make the necessary changes. If you are in need of implementing the workaround in your environment, all that is needed is to download the script and have an SCSM administrator run it on an SCSM management server. The script will load the SCSM SDK, extend the permissions of the ActivityImplementer user role profile with the ability to update the “ActualEndDate” property, and return a verbose message to inform you that it worked. No parameters are needed, since the script must be run on a management server anyway, though you can use the -Verbose switch to view status as the script proceeds.

 

A link to download the script can be found at the end of this post. Alternately, you can simply copy and paste the code below into a PowerShell console:

Conclusion and Link

 

This script described a bug introduced in SCSM 2012 R2 Update Rollup 7. It also provided a script that implements a workaround for the UR7 bug until such time as a fix is released.

 

Please do be aware that this script is NOT an official solution and will not be supported by Microsoft. You should always test changes in a dedicated Test environment before implementing in Production.

 

The script can be downloaded from the following link:

ImplementUR7ActivityImplementerWorkaround.zip

By |2016-06-09T13:41:27+00:00June 9th, 2016|SCSM|Comments Off on SCSM: UR7 Bug & Fix: Activity Implementers Unable to Complete Manual Activities

About the Author:

Solutions Architect / Team Lead – Model Technology Solutions Gabriel specializes in SCOM, SCSM, Orchestrator, and PowerShell, along with experience in several Azure technologies and other server roles. Gabriel has spoken at several regional conferences and user group meetings about leveraging Microsoft’s datacenter and automation technologies to solve specific problems. Gabriel’s attention to detail and relentless pursuit of perfection may one day make his brain explode from information overload. Hopefully they will have a cure before then.

Model Technology

Let us help you get your end point and data center strategy on cruise control!  Ask about our Calibration Assessment.

CONTACT US

  • 12125 Woodcrest Executive Drive, Ste. 204 Creve Coeur, MO 63141
  • (314) 254-4138
  • sales@model-technology.com

RECENT TWEETS