Odd Issue with PowerShell SAM Monitor on one Node

This issue raised its head again today but it took out a server in the process.

To the best of my knowledge nothing changed on these nodes. I working on checking out what patches were applied this month to see if MS had its hand in this.

I logged in this morning and one of my nodes was showing two monitors as unknown and two monitors were green. 

The unknown monitors are both PowerShell monitors and the ones that are still working are WMI monitors. 

Server was completely locked this morning and I had probably 100's of wsmprovhost.exe on the node and they were all tied to the Solarwinds Service account on the server.  I removed the monitor and will be rebooting the server.  Any ideas of what direction I need to look to and figure out what is going on? 

Can you paste a screenshot of the script component config?  

Is it set to remote execution or local?

Set as Remote Host.  Local host does not generate the correct data.

I think this is what you were looking for. I am very green when it comes to PowerShell and Solarwinds.

Set as Remote Host.  Local host does not generate the correct data.

I think this is what you were looking for. I am very green when it comes to PowerShell and Solarwinds.

By chance do you know if this server is using the agent or do you poll it all via wmi?

Polling via WMI.  I have a handful of Agents on nodes. I normally only do agents for Netpath. 

Node is up and polling just fine via WMI. 

We've kind of burned through the things that came to me top of mine when troubleshooting script executions.  From the screenshot you it makes me think that you are actually getting connected because all the processes are spinning up, are there maybe a lot of files in those directories and Orion is timing out the connection before it gets a response.  You might try remoting into the server and trying to run a version of the script locally to understand how it behaves.  Then I'd probably take it a step back and try to psremote over from the polling engine to the other server and see if anything noteworthy happens.  You might also consider taking a fishing trip through the logs, but i find that sam component logs are a real monster to dig through in many cases

I am trying to figure out if something was changed or udpated in PowerShell.  The stage monitor started acting up earlier in September but it was not doing the same odd things that I found on Prod this morning.  I know it is 'something' with PowerShell doing something with the node.  Once I find that something I will make sure to post.

Port 5985 is open but Port 5986 is not.  At this point that is the only thing so far that I can figure out. 

I found this link  - View online

Received an update from Support and made the following changes which appears to correct the issue.  These changes were done on the APEs and the Primary server.

File:  %SolarWinds Install Directory%\SolarWinds\Orion\SolarWinds.APM.Probes.dll.config

Backup the file above

Launch Notepad.exe in administrator mode and load up the file

Find the line:  <add key="UseLegacyPowerShellImpersonation" value="false" 

Change the line to:  <add key="UseLegacyPowerShellImpersonation" value="true" />

Restart Orion Services

One of my polling engines was set to False and one was set to True.  So I moved the node over to the polling engine that had it set to True. It Errors out but this time it times out. Not sure if it is progress or not.  lol.