We've updated the ServiceNow Community Code of Conduct, adding guidelines around AI usage, professionalism, and content violations. Read more

Local system account not enabled on Windows: Some metrics can’t be collected.

sameeramin
Tera Contributor

3 weeks ago

I was checking if anybody else from the community has experienced where the agents display message in the DEX console (Service Ops Workspace) of Local system account not enabled on Windows: Some metrics can’t be collected. We have observed more of these recently & not sure yet of the root cause (we have a SN case open) however checking in the meanwhile if others have seen these even after confirming the service is set with run as local system.

 

0 Helpfuls
  • 287 Views
2 REPLIES 2

Matthew_13
Mega Sage

2 weeks ago

Hi Buddy,

Yes — we’ve run into this in DEX/Service Ops Workspace as well. In our case the service was set to run as Local System, but the warning still appeared and certain endpoint metrics stopped collecting.

What we found is that the message is a bit misleading. It’s usually not that Local System is disabled, but that the agent can’t access something it needs WMI, performance counters, or a protected metric and DEX logs it under that generic message.

Things worth checking that helped us isolate it:

  • Confirm the agent service is actually running as Local System not just configured that way and was restarted after any change.

  • Check for recent:

    • Windows updates

    • GPO/security baseline changes

    • EDR/AV policy updates
      These can block metric collection even for Local System.

  • Review Event Viewer System + WMI Activity on affected machines.

  • Validate performance counters — we had a few endpoints where corrupted counters triggered the same message.

  • Compare affected vs unaffected devices OS build, patch level, agent version.

We saw a spike after a patch cycle and endpoint hardening changes, so it ended up being environmental rather than a platform defect.

You’re on the right track with the SN case — in most situations this ends up being either a WMI/counter access issue or a specific metric failing collection, not the Local System configuration itself.

 

@sameeramin - If help you answer, please mark Solution Accepted.

MJG
0 Helpfuls

KenR47122430407
Tera Contributor

2 weeks ago

Support created a PRB to resolve the issue that will be fixed in the March release.

 

While in this state, the agent will not collect the following metrics:

  • Pending System Updates
  • Bitlocker Details
  • Energy Consumption
  • Last access time
  • SCCM
  • Freezes
  • Zscaler service status
  • Boot time
0 Helpfuls