Auto-Close resolved Incidents

After a Ticket has been closed, it is no more possible to reopen it – this is why the “resolved” state exists. As long as a ticket is resolved, it can be re-opened. So one thing you have to deal with when using Service Manager for Incident and Problem Management is constantly closing Incidents and Problems when they have been in a resolved state for a while. Many customers want to automate this process. Therefore I have written a simple PowerShell-Script that can be used for exact this need.

I use the SMLets-PowerShell Module for this. This is a really great PowerShell-Module for Service Manager Management and a must-have! It’s available for free on Codeplex. Be aware that for successfully using it, you must make sure that the Service Manager SDK Assemblies are available on the Service Manager Server. And you must use PowerShell 2.0.

You will find a cmdlet called “get-scsmincident”. I used to work with this cmdlet first, but run into troubles. Therefore i decided to switch to the cmdlet “get-scsmobject” which gives you more flexibility as you can connect to all available classes. So let’s go with the script.


$LogFilename = “c:\Opalis\Logs\SCSM-AutoCloseIncidents.log”;
$SMDefaultComputer = “SMServer01”;

$Date = (get-date);
$DateString = $Date.toString();

import-module smlets;

$5DaysOld = (get-date).addhours(-120);

$IncidentsToClose = Get-SCSMObject –ClassName System.WorkItem.Incident$ | where{$_.lastmodified -lt $5DaysOld -AND $_.Status -like “*Resol*”};

$IncidentsToClose | Set-SCSMObject –property Status –Value Closed;

Add-Content -Path $LogFilename ($Datestring + ” – ” + $IncidentsToClose.Count + ” Incidents AutoClosed”);


Now in Detail …

$LogFilename = “c:\Opalis\Logs\SCSM-AutoCloseIncidents.log”;
$SMDefaultComputer = “SMServer01”;

First I fill some Variables with values. The first Variable is used for some very basic logging later. The second Variable is used for declaring the Service Manager Management Server – just if you want to run this Script remotely.

$Date = (get-date);
$DateString = $Date.toString();

This step I use to write the actual date and time in String Format to a Variable. I’m not very good in Powershell-Scripting and I’m sure this could be done much better, but I have not investigated much on this as it works for me. So if you have a better way to do it I really appreciate your solution.

import-module smlets;

Time to import the SMLets-Module into Powershell.

$5DaysOld = (get-date).addhours(-120);

From the actual Date I subtract 120 hours as I want to close all resolved Incidents that are resolved for 5 days.

$IncidentsToClose = Get-SCSMObject –ClassName System.WorkItem.Incident$ | where{$_.lastmodified -lt $5DaysOld -AND $_.Status -like “*Resol*”};

I get all Incidents that have not been modified in the last 5 Days and have the state “resolved”. You can access objects of any available class. Just make sure you know the exact name.

$IncidentsToClose | Set-SCSMObject –property Status –Value Closed;

Now I change the state to “closed”.

Add-Content -Path $LogFilename ($Datestring + ” – ” + $IncidentsToClose.Count + ” Incidents AutoClosed”);

As a last step I write the number of closed Incidents, the Date and Time to a Logfile. This is used for informational purposes.

Normally I run this Script with Opalis, but of course you can also use native PowerShell.

Have fun!

About Marcel Zehner

Microsoft Azure MVP
This entry was posted in SCSM and tagged , , , , , , , . Bookmark the permalink.

25 Responses to Auto-Close resolved Incidents

  1. Pingback: Service Manager Workflows – Part 1 |

  2. Pingback: System Center Service Manager information(blog) overview - System Center Service Manager

  3. Pingback: SCSM Incident Auto Close Guide « MEMOEXP

  4. James says:

    Hi Marcel,

    This came way too late but my thanks to you that I’m able to get this working in the first place. I’ve also just noticed that this script will no longer work with beta3 SMLets. We’ll need to replace Get-SCSMObject -ClassName System.WorkItem.Incident$ with Get-SCSMObject -Class (Get-SCSMClass –Name System.WorkItem.Incident$) or else an error will appear and the workflow will fail. Hope this helps!

    James Yeoh

    • Marcel Zehner says:

      Hey James

      Thanks for your input! Indeed, with the release of smlets beta 3 some (small) changes are needed. today, I prefer to solve the problem like this …

      $class = get-scsmclass system.workitem.incident$
      $statusid = (get-scsmenumeration -name incidentstatusenum.resolved).id
      $ResolvedIncidents = Get-SCSMObject –class $class -filter “status -eq $statusid”
      $IncidentsToClose = $ResolvedIncidents | where{$_.lastmodified -lt $5daysold}

      by using the “-filter” you put the load on the database server – by using “where” all records are pulled to the client that does the filtering afterwards. in environments with many objects (incidents in this case) this could be a major performance impact …


      • Wyatt Wong says:

        Where the following command should be located ?

        $IncidentsToClose | Set-SCSMObject –property Status –Value Closed;

        Can you re-post the whole script again which works for smlets beta 3 ?

      • Marcel Zehner says:

        Hey Wyatt

        The complete Script is in the post. You need the smlets Module for Powershell to run it. This is also mentioned in the post.


  5. Pingback: Auto-closing a change request (dual criteria) - Mark Mears at

  6. Pingback: Auto-closing a change request (dual criteria) |

  7. Jake says:

    Great Script, but I seem to be getting:

    You must provide a value expression on the right-hand side of the ‘*’ operator.
    At C:\sc\CloseResolvedIncidents.ps1:11 char:135
    + $IncidentsToClose = Get-SCSMObject -ClassName System.WorkItem.Incident$ | where{$_.lastmodified -lt $10Day
    _.Status -like “* <<<< Resol*"};
    + CategoryInfo : ParserError: (:) [], ParseException
    + FullyQualifiedErrorId : ExpectedValueExpression

  8. Jake says:

    Didn’t notice the previous reply above. Thanks and never mind!

  9. pauloxaxa says:


    Great post, but I have a problem I do not know the cause.

    I installed the SMLets (SCSM PowerShell Cmdlets BETA 4), I ran the following commands in PowerShell to not have impediments:

    Set-ExecutionPolicy-force RemoteSigned


    Import-Module smlets

    I created the MP faithfully following your tutorial, but when I save it, an error is displayed:

    “Service Manager Authoring Tool:
    Invalid character in the given encoding. Line 2, position 158 ”

    This corresponds precisely appears when the command “get-update”, but I know that your code is correct.

    Any idea what might be going on?

    P.S: Sorry my english 🙂

    • Marcel Zehner says:


      Did you manage to solve it?


      • pauloxaxa says:

        Mr. Marcel,

        I managed to solve yes, but thanks to the comments of Mr. James and his response to his comment. The credit is yours and I just have to thank you for sharing the information.

        P.S: Sorry my English :-); I don’t speak English very well.

  10. pauloxaxa says:

    Great solution! Congratulations 😀

  11. Trina says:

    Hey Marcel,
    Thank you for the great script. I am new to the powershell scripting. I have been asked to filter which service groups / queues get closed at what times. For example Business Office resolved incidents should auto close 2 days after they are resolved, but pc support incidents should not close for 30 days as we have QA done on them and then they are closed. I have attempted to filter this with a workflow, but it’s not working. Any thoughts?

    Thank you,

    • Marcel Zehner says:

      Just add another filter that only returns incidents that are assigned to a specific support group. Add something like this:

      $TierQueue = (Get-SCSMEnumeration IncidentTierQueuesEnum.Tier1$)

      $Incidents = Get-SCSMObject -Class $IncidentClass | where {$_.Status -eq $Resolved -AND $_.Tierqueue -eq $TierQueue}

      Hope that helps!


  12. Trina says:

    Thanks Marcel, I actually found the MP that is currently doing part of this in our setup:

    import-module smlets -force;
    $Date = (get-date);
    $Now = $Date.ToUniversalTime();
    $Rslvd = $Now.addhours(-12000);
    $RId = (Get-SCSMEnumeration IncidentStatusEnum.Resolved$).id;
    $Class = Get-SCSMClass -Name System.WorkItem.Incident$;
    $cType = “Microsoft.EnterpriseManagement.Common.EnterpriseManagementObjectCriteria”;
    $cString = “ResolvedDate < ‘$Rslvd’ and Status = ‘$RId'”;
    $crit = new-object $cType $cString,$Class;
    $Closed = Get-SCSMEnumeration IncidentStatusEnum.Closed$;
    $PropertyHash = @{ “Status” = $Closed; “ClosedDate” = $Now };
    $incident = Get-SCSMObject -criteria $crit;
    $incident | Set-SCSMObject -PropertyHashtable $PropertyHash;
    remove-module smlets

    So, some one set this to autoclose after 500 days for all resolved. How would I apply your addition above to this script for a support group named Business Office? Thanks for the assist, as I said I am very new to this part of scripting.

  13. Pingback: Auto close process automation for Service Manager 2012 (and SP1) with PowerShell « System Center Dynamics by wwwally

  14. Tom Aguero says:

    Is there anyway to do this and include a comment in the Action Log?

  15. Wyatt Wong says:

    James had written a great article based on your powershell script as follows:

  16. Vladimir Kovalevskiy says:

    Marcel, thanks for your solution.
    I update script with SMlets:
    #Poweshell Script for SCSM Autoclose Incident
    #SCSM Autoclose Incident

    #Import Service Manager Cmdlets
    import-module ‘C:\Program Files\Microsoft System Center 2012 R2\Service Manager\Powershell\System.Center.Service.Manager.psd1’
    #Import SMlets
    import-module SMLets

    $LogFilename = “C:\Tmp\SCSM-AutoCloseIncidents.log”;
    $SMDefaultComputer = “serverSCSM01”;

    $Date = (get-date);
    $DateString = $Date.toString();

    $5DaysOld = (get-date).addhours(-120);

    $IncidentsToClose = Get-SCSMIncident | Where-Object{$_.status -like “*Resol*” -and $_.lastmodified -lt $5DaysOld};

    $IncidentsToClose | Set-SCSMIncident -Status “Close”;

    Add-Content -Path $LogFilename ($Datestring + ” – ” + $IncidentsToClose.Count + ” Incidents AutoClosed”);

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s