Well known configuration that needs applying to domain controler after the SCOM agent is installed.
Clue that this has not been done is that the relevent domain controller will show in the SCOM console as not monitored.
- Open an elevated command prompt.
- Navigate to the agent install folder on the domain controller, typically C:\Program Files\Microsoft Monitoring Agent\Agent.
- Run – HSLockdown.exe /A “NT AUTHORITY\SYSTEM”
- Restart the SCOM agent service – run net stop healthservice & net start healthservice
Thanks yet agin to Kevin Holman.