The difference between “Close alert” and “Set Resolution State -> Closed” in SCOM

Still trying to wrap our heads around SCOM and we've wrestled with this a bit, too.

The trigger to an 'unhealthy' status seems to happen pretty quickly, but the trigger back to 'healthy' seems to be on what we are referring to as SCOM time. It happens, but it certainly doesn't happen quickly. I've been chalking this up to the sizing of our development lab.

The script looks ok, but you can also verify in the operation manager event log that there aren't problems during the execution of the script. e.g. if you are accessing a file share, and don't have a Run As account setup, it could fail if that server machine account doesn't have rights to the file share.

This will error the script but the monitor will stay healthy.

It may be succeeding for you because when you run it its executing under your user account, which probably has access to the file share.

An easier solution, though with a higher impact: put the object generating the critical health state in maintenance mode for 15 minutes. The health state will change to "not monitored" an will be re-evaluated once it quits maintenance mode.

This way you will regenerate an alert. Bear in mind though that it will have the same effect for every rule an monitor running on that object.