Removing ACS

Sometimes a SCOM component isn't needed anymore and needs to be removed. Most SCOM components are easily to be removed, but ACS can be a bit of a pain.

Disabling the ACS Forwarders is done easily in the SCOM Console: Goto Monitoring, Operations Mangager, Agent, Agent Health State. Select the Agent in the second window 'Agent State' and in the Actions Pane under the header Health Service Tasks, click Disable Audit Collection.

But how to go about disabling the ACS Collector itself? Not always an uninstall will work.

Somehow SCOM will still see the ACS Collector and raise Alerts as it is not working. And when one checks the ACS view in the Monitoring Pane (Microsoft Audit Collection Services, Collector, State View) the ACS Collector is still being displayed. Also the service for the ACS Collector is still being displayed in the services mmc.

The remedy is simple. On the ACS Collector go to the folder c:\windows\system32\Security\AdtServer and start the executable AdtSetup.exe. This will start the installer and a dialog what one wants to do.

Simply select the Remove option and within a couple of seconds all is well: The ACS Collector is gone: the service is gone, the errors in SCOM are vanished and the ACS Collector State View will turn up empty as it should.

Remember with the ACS removal that the steps need to be the opposite of the ACS installation: first disable the ACS Forwarders, uninstall the ACS Collector and finally remove the ACS Database.