Deleting a SCOM MP which the Microsoft.SystemCenter.SecureReferenceOverride MP depends upon
Posted by Matthew on December 14, 2012
If you’ve ever imported a management pack which contained a Run As profile into SCOM, you will know the pain that awaits you if you ever need to delete it (most commonly when the latest version of the MP doesn’t support an upgrade via import).
The most discussed option I’ve seen for dealing with this is to:
- Delete the offending Run As Account(s) from the Run as Profile.
- Export the Microsoft.SystemCenter.SecureReferenceOverride MP
- Remove the reference that gets left behind when you delete a Run As Profile configuration from the raw xml.
- Increment the version number (again in the xml)
- Reimport it.
However, there is another way that doesn’t rely on you having to import/export or having to touch any xml, just a bit of Powershell! The below is for 2012, but the same principle applies for 2007, just use the appropriate cmdlets/methods.
- Open a powershell session with the Operations Manager module/snappin loaded.
- Type: $MP = Get-SCOMManagementpack -Name Microsoft.SystemCenter.SecureReferenceOverride
- Now we can view the referenced management packs by typing $MP.References
- From the list of items in the Key column, note down the alias of your MP you wish to delete. If you are having trouble finding it, the Value column will list the full ID of the MP.
- Now that we know the MP alias, we can remove it from the Secure Reference MP by typing $MP.References.Remove(“yourMPAliasGoesHere“)
- Now we can verify the MP is valid by entering $MP.Verify() to ensure there are no orphaned overrides, etc.
- Finally, we can save our changes by typing: $MP.AcceptChanges()
If you don’t follow step 7, you won’t actually commit your changes to the MP. Once this is done, give the SCOM management group a chance to catch up (you might have to wait a minute and then refresh your console). When you now check the Dependencies tab of the MP you want to delete, you’ll see that the SecureReferenceOverride MP is no longer listed and you’ll be able to remove your MP.
Hope that helps!
.\Matthew Long 
bradc said
this is a great one. thank you for discovering and sharing.
Stan said
What to do if output of command is set to false? And it is not deleting… On your picture it is set to true.
My output is:
PS C:\scom> $MP.References.Remove(“yourMPAliasGoesHere”)
False
Matthew said
Hi Stan,
A return of False to the Remove method means that the reference could not be removed successfully – likely the alias does not exist or there are elements in your MP that are still dependant on the referenced management pack. You’ll need to remove those items first before you’ll be able to remove the MP reference (check for a Run as Profile configured somewhere for the added management pack).
Also, yourMPAliasGoesHere is a placeholder that you should replace with the alias of the management pack reference you want to remove. This should be showing up in the Key Column when you run Step 3.
Sorry for the late response, and hope that helps!
Tyson said
I run into this issue all the time when developing and testing MPs. Thanks for this trick!
PowerShell Script: Remove Obsolete References from Unsealed OpsMgr Management Packs | Tao Yang's System Management Blog said
[…] also want to thank Matthew Dowst for the original script and Matthew Long for his blog post where I got the ideas […]
Eric said
I can never get this to work. I can remove the reference, but every time I try to run $mp.verify() I get an error. Do I need to Delete the offending Run As Account(s) from the Run as Profile before running the PowerShell commands?
Ollie Woodall said
I found that I had to remove the Run as Account from the Profile in the console before MP$.Verify() would work. Otherwise I got errors about malicious code in verification.