Here’s the alert:
Title: Workflow Initialization: Failed to start a workflow that runs a process or script
Data was found in the output, but has been dropped because the Event Policy for the process started at 3:00:10 AM has detected errors.
The 'ExitCode' policy expression:
matched the following output:
This alert was due to VirusScan 8.8i blocking the opsmgr scripts from running. To resolve, I had to modify the VirusScan on-access scanning policy to identify the specific ‘HealthService.exe’ from opsmgr as a low-risk process, then exclude the same healthservice.exe from several access protection policies. To find out what policies you need to exclude, view the access protection policy log from the VirusScan console.