“Unsealing” sealed management packs

Sadly you cannot edit existing rules in sealed management packs. If you do want to change the scripts or any monitoring within a sealed management pack, the best practice here is to set an override against the items you need to customise (enable = false). And then recreate the two items in a custom management pack.

Although in theory you can break open a sealed management pack to make changes to the management pack, not surprisingly it isn’t a good idea. A seal is there for a reason. To show something hasn’t been tampered with. That it is genuine. Breaking open the sealed management packs to see how they function is a great way of learning. But don’t try and re-import (even if you do reseal it with your own seal) as:

1) Once you break the seal the packs are no longer supported.

2) You will not be able to upgrade the management pack. Jonathan Almquist gave a great explaination – “this is because you do not possess the key pair the vendor uses to seal their MP’s. Without the key pair, you can still seal the MP by generating your own key, but it will not match any key the vendor will use to seal future MP’s…which ultimately means you cannot download an updated MP from the vendor and just import. You’ll need to delete your overrides MP, delete the MP you now made your own, import the updated vendor MP, then recreate any overrides you had that targeted those classes in your ‘custom’ MP.”