| DisplayName | ID | Target | Category | Enabled | Alert Generate |
| Accounts with the same SID have been detected - one has been deleted | Accounts_with_the_same_SID_have_been_detected___one_has_been_deleted_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Account Changes Report Available | Account_Changes_Report_Available_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Account creation will fail on this domain controller until the account identifier pool is obtained | Account_creation_will_fail_on_this_domain_controller_until_the_account_identifier_pool_is_obtained_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Account Name Not Unique | Account_Name_Not_Unique_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Active Directory cannot allocate a new domain controller GUID | Active_Directory_cannot_allocate_a_new_domain_controller_GUID_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot be initialized | Active_Directory_cannot_be_initialized_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot boot normally because the database was in an incorrect state | Active_Directory_cannot_boot_normally_because_the_database_was_in_an_incorrect_state_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot change the state of the database during a backup operation | Active_Directory_cannot_change_the_state_of_the_database_during_a_backup_operation_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot construct a mutual authentication Service Principal Name | Active_Directory_cannot_construct_a_mutual_authentication_Service_Principal_Name_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot create a new security descriptor | Active_Directory_cannot_create_a_new_security_descriptor_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot create the default security descriptor for an application directory partition | Active_Directory_cannot_create_the_default_security_descriptor_for_an_application_directory_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot delete the access control entry (ACE) for the domain Domain Controllers security group on a newly created application directory partition | Active_Directory_cannot_delete_the_access_control_entry__ACE__for_the_domain_Domain_Controllers_security_group_on_a_newly_created_application_directory_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot delete the key "New Database GUID" during the restore recovery process | Active_Directory_cannot_delete_the_key_New_Database_GUID_during_the_restore_recovery_process_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot find any RPC protocol sequences installed | Active_Directory_cannot_find_any_RPC_protocol_sequences_installed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot function normally | Active_Directory_cannot_function_normally_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot perform an authenticated RPC call to another DC because the SPN for the destination DC is not registered on the KDC | Active_Directory_cannot_perform_an_authenticated_RPC_call_to_another_DC_because_the_SPN_for_the_destination_DC_is_not_registered_on_the_KDC_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot rebuild the following number of indices and has failed | Active_Directory_cannot_rebuild_the_following_number_of_indices_and_has_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot replicate configuration and schema information | Active_Directory_cannot_replicate_configuration_and_schema_information_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot set the replication consistency registry key | Active_Directory_cannot_set_the_replication_consistency_registry_key_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot update object due to insufficient memory | Active_Directory_cannot_update_object_due_to_insufficient_memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot update the functional level on the NTDS Settings object for the local domain controller | Active_Directory_cannot_update_the_functional_level_on_the_NTDS_Settings_object_for_the_local_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot validate the functional level of the domain controller | Active_Directory_cannot_validate_the_functional_level_of_the_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory cannot write a new security descriptor for object | Active_Directory_cannot_write_a_new_security_descriptor_for_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory encountered a replication error. Replication will be delayed. | Active_Directory_encountered_a_replication_error.__Replication_will_be_delayed._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Active Directory has failed to upgrade a critical index as part of initialization | Active_Directory_has_failed_to_upgrade_a_critical_index_as_part_of_initialization_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication is occurring slowly | Active_Directory_Latency_Alert_Rule_For_Windows2000 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
| AD Replication is occurring slowly | Active_Directory_Latency_Alert_Rule_For_Windows2003 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
| AD Replication is occurring slowly | Active_Directory_Latency_Alert_Rule_For_Windows2008 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
| Active Directory shadow copy restore was unsuccessful. The contents of Active Directory are unpredictable. | Active_Directory_shadow_copy_restore_was_unsuccessful.__The_contents_of_Active_Directory_are_unpredictable._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD ADWS Service Check Script Based Test Failed to Complete | AD_ADWS_Service_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD cannot allocate memory | AD_cannot_allocate_memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD cannot find the NTDS object for this domain controller | AD_cannot_find_the_NTDS_object_for_this_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD cannot find the partition container | AD_cannot_find_the_partition_container_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD cannot release memory | AD_cannot_release_memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD cannot update object because the disk containing the database is full | AD_cannot_update_object_because_the_disk_containing_the_database_is_full_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD cannot update the object | AD_cannot_update_the_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD configuration information is missing from the registry | AD_configuration_information_is_missing_from_the_registry_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| LSASS CPU UsagePerformance Collection [Deprecated] | AD_CPU_Overload.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | False | False |
| AD CPU Overload Event 1 | AD_CPU_Overload_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD CPU Overload Script Based Test Failed to Complete | AD_CPU_Overload_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD CPU Overload Script Parameters are configured incorrectly | AD_CPU_Overload_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Database and Log Event 1 | AD_Database_and_Log_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Database and Log Script Based Test Failed to Complete | AD_Database_and_Log_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Database and Log The AD Management Pack does not support the agentless management mode | AD_Database_and_Log_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD database is corrupt | AD_database_is_corrupt_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD DC Demoted | AD_DC_Demoted | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Maintenance | True | False |
| AD DC Demoted Event 1 | AD_DC_Demoted_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD DC Demoted Script Based Test Failed to Complete | AD_DC_Demoted_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD DNS Verification Script Based Test Failed to Complete | AD_DNS_Verification_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD DNS Verification The AD Management Pack does not support the agentless management mode | AD_DNS_Verification_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD General Response Last Bind Performance Collection | AD_General_Response.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD General Response Event | AD_General_Response_Pass_through | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD General Response Script Based Test Failed to Complete | AD_General_Response_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD General Response Script Parameters are configured incorrectly | AD_General_Response_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD General Response: The AD Management Pack does not support the agentless management mode | AD_General_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Global Catalog Search Time Response Performance Collection | AD_Global_Catalog_Search_Response.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Global Catalog Search Response Event 1 | AD_Global_Catalog_Search_Response_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Global Catalog Search Response Event 2 | AD_Global_Catalog_Search_Response_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Global Catalog Search Response Script Parameters are configured incorrectly | AD_Global_Catalog_Search_Response_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Global Catalog Search Response The AD Management Pack does not support the agentless management mode | AD_Global_Catalog_Search_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD internal error: reinstall server | AD_internal_error__reinstall_server_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Lost And Found Object Count Event 1 | AD_Lost_And_Found_Object_Count_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Lost And Found Object Count Event 2 | AD_Lost_And_Found_Object_Count_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Lost And Found Object Count Script Based Test Failed to Complete | AD_Lost_And_Found_Object_Count_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Lost And Found Object Count The AD Management Pack does not support the agentless management mode | AD_Lost_And_Found_Object_Count_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Agent Proxy not enabled | AD_MOM_Agent_Proxy_is_not_enabled | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Monitor Trusts AD Client Side Script Based Test Failed to Complete | AD_Monitor_Trusts_AD_Client_Side_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Monitor Trusts Event 1 | AD_Monitor_Trusts_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Monitor Trusts Event 2 | AD_Monitor_Trusts_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Monitor Trusts The AD Management Pack does not support the agentless management mode | AD_Monitor_Trusts_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Op Master PDC Last Ping Performance Collection | AD_Op_Master_Response_1.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Op Master Schema Last Bind Performance Collection | AD_Op_Master_Response_10.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Op Master PDC Last Bind PerformanceCollection | AD_Op_Master_Response_2.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Op Master Domain Naming Last Ping Performance Collection | AD_Op_Master_Response_3.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Op Master Domain Naming Last Bind Performance Collection | AD_Op_Master_Response_4.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Op Master Infrastructure Last Ping Performance Collection | AD_Op_Master_Response_5.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Op Master Infrastructure Last Bind Performance Collection | AD_Op_Master_Response_6.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Op Master RID Last Ping Performance Collection | AD_Op_Master_Response_7.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Op Master RID Last Bind Performance Collection | AD_Op_Master_Response_8.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Op Master Schema Last Ping Performance Collection | AD_Op_Master_Response_9.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Op Master Response Script Parameters are configured incorrectly | AD_Op_Master_Response_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Op Master Response The AD Management Pack does not support the agentless management mode | AD_Op_Master_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication Monitoring Performance Collection (Sources) | AD_Replication_Monitoring.Helper1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | False |
| AD Replication Monitoring Performance Collection (Targets) | AD_Replication_Monitoring.Helper2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | False |
| AD Replication Performance Collection - Metric Replication Latency | AD_Replication_Monitoring.PerformanceCollection_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Replication Performance Collection - Metric Replication Latency:Minimum | AD_Replication_Monitoring.PerformanceCollection_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Replication Performance Collection - Metric Replication Latency:Maximum | AD_Replication_Monitoring.PerformanceCollection_3 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Replication Performance Collection - Metric Replication Latency:Average | AD_Replication_Monitoring.PerformanceCollection_4 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD Replication Monitoring Access Denied | AD_Replication_Monitoring_Access_Denied | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication Monitoring A problem has been detected with the trust relationship between two domains | AD_Replication_Monitoring_A_problem_has_been_detected_with_the_trust_relationship_between_two_domains | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication Monitoring Event | AD_Replication_Monitoring_Pass_through | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Replication Monitoring Script Based Test Failed to Complete | AD_Replication_Monitoring_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication Monitoring Script Parameters are configured incorrectly | AD_Replication_Monitoring_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication Monitoring The AD Management Pack does not support the agentless management mode | AD_Replication_Monitoring_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication Monitoring Time skew detected | AD_Replication_Monitoring_Time_skew_detected | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication Partner Count Script Based Test Failed to Complete | AD_Replication_Partner_Count_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication Partner Count Script Parameters are configured incorrectly | AD_Replication_Partner_Count_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication Partner Count The AD Management Pack does not support the agentless management mode | AD_Replication_Partner_Count_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication Partner Op Master Consistency AD Client Side Script Based Test Failed to Complete | AD_Replication_Partner_Op_Master_Consistency_AD_Client_Side_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Replication Partner Op_Master Consistency Event 1 | AD_Replication_Partner_Op_Master_Consistency_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Replication Partner Op_Master Consistency Event 2 | AD_Replication_Partner_Op_Master_Consistency_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Replication Partner Op Master Consistency The AD Management Pack does not support the agentless management mode | AD_Replication_Partner_Op_Master_Consistency_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Server Moved Site Rule | AD_Server_Moved_Site | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Maintenance | True | False |
| AD Server Moved Site AD Client Side Script Based Test Failed to Complete | AD_Server_Moved_Site_AD_Client_Side_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Server Moved Site Event 1 | AD_Server_Moved_Site_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Server Moved Site Event 2 | AD_Server_Moved_Site_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| AD Server Moved Site The AD Management Pack does not support the agentless management mode | AD_Server_Moved_Site_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Validate Server Trust Event Script Based Test Failed to Complete | AD_Validate_Server_Trust_Event_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD Validate Server Trust Event The AD Management Pack does not support the agentless management mode | AD_Validate_Server_Trust_Event_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| All of the replication partners failed to replicate. | All_replication_partners_failed_to_synchronize | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | True |
| An account cannot be added to the group | An_account_cannot_be_added_to_the_group_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| An account name collision occurred - this may result in authentication failures | An_account_name_collision_occurred___this_may_result_in_authentication_failures_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| An attempt to check whether group caching is enabled has failed | An_attempt_to_check_whether_group_caching_is_enabled_has_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| An attempt to set the time was aborted due to the offset being too large | An_attempt_to_set_the_time_was_aborted_due_to_the_offset_being_too_large_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| An attempt to update user credentials failed | An_attempt_to_update_user_credentials_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| An error occurred while granting rights to the Domain Administrators group | An_error_occurred_while_granting_rights_to_the_Domain_Administrators_group_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| An internal AD error occurred | An_internal_AD_error_occurred_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| An Intersite Messaging Service request to modify an LDAP object failed | An_Intersite_Messaging_Service_request_to_modify_an_LDAP_object_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| An object cannot inherit a security identifier (SID) from another object | An_object_cannot_inherit_a_security_identifier__SID__from_another_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| An object has been duplicated during a cross domain move | An_object_has_been_duplicated_during_a_cross_domain_move_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Attempts to backup or restore Active Directory have failed or will fail | Attempts_to_backup_or_restore_Active_Directory_have_failed_or_will_fail_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Attempts to update Active Directory are failing | Attempts_to_update_Active_Directory_are_failing_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A certificate was not authenticated because the computer it came from is not a domain controller | A_certificate_was_not_authenticated_because_the_computer_it_came_from_is_not_a_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A dll cannot be loaded because the software was incorrectly installed | A_dll_cannot_be_loaded_because_the_software_was_incorrectly_installed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A DNS server used by this server for name resolution did not respond within the timeout interval | A_DNS_server_used_by_this_server_for_name_resolution_did_not_respond_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A domain controller has an extremely high number of replication partners | A_domain_controller_has_an_extremely_high_number_of_replication_partners | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A domain controller has an unusually high number of replication partners | A_domain_controller_has_an_unusually_high_number_of_replication_partners | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A domain controller made a replication request for a writable directory partition that has been denied by the local domain controller | A_domain_controller_made_a_replication_request_for_a_writable_directory_partition_that_has_been_denied_by_the_local_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A GPO extension was not applied because the registry extension failed | A_GPO_extension_was_not_applied_because_the_registry_extension_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A Group Policy object cannot be found in Active Directory | A_Group_Policy_object_cannot_be_found_in_Active_Directory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A Group Policy Object has not been processed because the filter check could not be performed | A_Group_Policy_Object_has_not_been_processed_because_the_filter_check_could_not_be_performed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A Group Policy Object is corrupt. | A_Group_Policy_Object_is_corrupt._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A journal wrap error has occurred on the Sysvol | A_journal_wrap_error_has_occurred_on_the_Sysvol_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
| A lingering object has been detected. Replication has been blocked. | A_lingering_object_has_been_detected.__Replication_has_been_blocked._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A problem has been detected with the trust relationship between two domains | A_problem_has_been_detected_with_the_trust_relationship_between_two_domains | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A replication island has been detected Replication will not occur across the enterprise | A_replication_island_has_been_detected_Replication_will_not_occur_across_the_enterprise | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A resource record for the computer name of the DC is not registered in the DNS database | A_resource_record_for_the_computer_name_of_the_DC_is_not_registered_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A RSoP (Resultant Set of Policies) error occurred | A_RSoP__Resultant_Set_of_Policies__error_occurred_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A schema collision occurred while replicating attribute definitions | A_schema_collision_occurred_while_replicating_attribute_definitions_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A schema collision occurred while replicating a class definition | A_schema_collision_occurred_while_replicating_a_class_definition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A user from a different forest logged onto this machine. Group policy processing has been effected. | A_user_from_a_different_forest_logged_onto_this_machine._Group_policy_processing_has_been_effected._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| A well known account has been recreated because it did not exist | A_well_known_account_has_been_recreated_because_it_did_not_exist_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| A well known group has been recreated because it did not exist | A_well_known_group_has_been_recreated_because_it_did_not_exist_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Cannot access the registry policy file | Cannot_access_the_registry_policy_file_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Cannot delete a registry value | Cannot_delete_a_registry_value_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Cannot process client side group policy extension | Cannot_process_client_side_group_policy_extension_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Cannot read the GPO history | Cannot_read_the_GPO_history_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Certificate for intersite replication was rejected | Certificate_for_intersite_replication_was_rejected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Change Password on KRBTGT Account Failed | Change_Password_on_KRBTGT_Account_Failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Classes from COM.DLL not registered | Classes_from_COM.DLL_not_registered_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Collection Rule for No DC/GC in Site events | Collection_Rule_for_No_DC_GC_in_Site_events_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Collection rule for the Replication Collisions Report | Collection_rule_for_the_Replication_Collisions_Report_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Collection rule for the Replication Failures Report | Collection_rule_for_the_Replication_Failures_Report_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Contacting the Domain Naming FSMO Role Holder has completed successfully | Contacting_the_Domain_Naming_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Contacting the Infrastructure FSMO Role Holder has completed successfully | Contacting_the_Infrastructure_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Contacting the PDC FSMO Role Holder has completed successfully | Contacting_the_PDC_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Contacting the RID Master FSMO Role Holder has completed successfully | Contacting_the_RID_Master_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Contacting the Schema Master FSMO Role Holder has completed successfully | Contacting_the_Schema_Master_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Corrupt Credentials | Corrupt_Credentials_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Could not determine the FSMO role holder | Could_not_determine_the_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Cross-domain Group Policy processing has been aborted because the other domain cannot be reached | Cross_domain_Group_Policy_processing_has_been_aborted_because_the_other_domain_cannot_be_reached_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| DC has failed to synchronize naming context with its replication partner | DC_2000_has_failed_to_synchronize_with_its_replication_partner | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
| DC has failed to synchronize naming context with its replication partner | DC_2003_has_failed_to_synchronize_with_its_replication_partner | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
| DC has failed to synchronize naming context with its replication partner | DC_2008_has_failed_to_synchronize_with_its_replication_partner | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
| DC is both a Global Catalog and the Infrastructure Update master | DC_is_both_a_Global_Catalog_and_the_Infrastructure_Update_master_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Direct replication cannot occur as configured | Direct_replication_cannot_occur_as_configured_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| DNS registrations of essential Domain controller records is failing | DNS_registrations_of_essential_Domain_controller_records_is_failing_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Domain Operation Mode has been changed to Native Mode | Domain_Operation_Mode_has_been_changed_to_Native_Mode_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Duplicate account names were detected - one account has been renamed | Duplicate_account_names_were_detected___one_account_has_been_renamed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Duplicate moved object detected | Duplicate_moved_object_detected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Duplicate User Principal Names have been detected | Duplicate_User_Principal_Names_have_been_detected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Failed to ping or bind to the Domain Naming Master FSMO role holder | Failed_to_ping_or_bind_to_the_Domain_Naming_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Failed to ping or bind to the Infrastructure Master FSMO role holder | Failed_to_ping_or_bind_to_the_Infrastructure_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Failed to ping or bind to the PDC FSMO role holder | Failed_to_ping_or_bind_to_the_PDC_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Failed to ping or bind to the RID Master FSMO role holder | Failed_to_ping_or_bind_to_the_RID_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Failed to ping or bind to the Schema Master FSMO role holder | Failed_to_ping_or_bind_to_the_Schema_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Format of schedule object attribute unrecognized | Format_of_schedule_object_attribute_unrecognized_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| FRS has not replicated one or more files in the Sysvol to other domain controllers | FRS_has_not_replicated_one_or_more_files_in_the_Sysvol_to_other_domain_controllers_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
| FRS is scanning the system volume before sharing it | FRS_is_scanning_the_system_volume_before_sharing_it_5_Rule | Microsoft.Windows.Server.2008.AD.EssentialService.NTFRS | EventCollection | False | True |
| Group Cache Refresh cannot obtain a connection schedule to it's preferred site | Group_Cache_Refresh_cannot_obtain_a_connection_schedule_to_it_s_preferred_site_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Cache Refresh cannot schedule an update | Group_Cache_Refresh_cannot_schedule_an_update_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Cache Refresh found a GC in a non-optimal site | Group_Cache_Refresh_found_a_GC_in_a_non_optimal_site_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Cache Refresh has reached the user limit for this domain controller | Group_Cache_Refresh_has_reached_the_user_limit_for_this_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing aborted because a filter check for the GPO failed | Group_Policy_processing_aborted_because_a_filter_check_for_the_GPO_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing aborted because the common name for the GPO cannot be accessed | Group_Policy_processing_aborted_because_the_common_name_for_the_GPO_cannot_be_accessed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group policy processing aborted because the GPO does not have a version number | Group_policy_processing_aborted_because_the_GPO_does_not_have_a_version_number_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group policy processing aborted - cannot connect to the Directory Service | Group_policy_processing_aborted___cannot_connect_to_the_Directory_Service_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group policy processing aborted - cannot determine site | Group_policy_processing_aborted___cannot_determine_site_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group policy processing aborted - reboot this machine | Group_policy_processing_aborted___reboot_this_machine_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group policy processing aborted - the search for the root AD object failed | Group_policy_processing_aborted___the_search_for_the_root_AD_object_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing has been aborted because an invalid class of object was discovered | Group_Policy_processing_has_been_aborted_because_an_invalid_class_of_object_was_discovered_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing has been aborted because GPO lists cannot be set up | Group_Policy_processing_has_been_aborted_because_GPO_lists_cannot_be_set_up_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing has been aborted because of an invalid access configuration | Group_Policy_processing_has_been_aborted_because_of_an_invalid_access_configuration_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing has been aborted because the extensions from the registry cannot be read | Group_Policy_processing_has_been_aborted_because_the_extensions_from_the_registry_cannot_be_read_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing has been aborted because the file gpt.ini cannot be accessed | Group_Policy_processing_has_been_aborted_because_the_file_gpt.ini_cannot_be_accessed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing has been aborted because the GPLink property of an object cannot be accessed | Group_Policy_processing_has_been_aborted_because_the_GPLink_property_of_an_object_cannot_be_accessed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing has been aborted because the GPO does not have a functionality version number | Group_Policy_processing_has_been_aborted_because_the_GPO_does_not_have_a_functionality_version_number_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing has been aborted because the user does not have access to an object | Group_Policy_processing_has_been_aborted_because_the_user_does_not_have_access_to_an_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing has been aborted (in planning mode) because the user/computer does not have access to a required object | Group_Policy_processing_has_been_aborted__in_planning_mode__because_the_user_computer_does_not_have_access_to_a_required_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing was aborted because a security check failed | Group_Policy_processing_was_aborted_because_a_security_check_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing was aborted because historical data cannot be moved from the users old SID to their new one | Group_Policy_processing_was_aborted_because_historical_data_cannot_be_moved_from_the_users_old_SID_to_their_new_one_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing was aborted because security cannot be set on Group Policy events | Group_Policy_processing_was_aborted_because_security_cannot_be_set_on_Group_Policy_events_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing was aborted because the refresh timer cannot be set | Group_Policy_processing_was_aborted_because_the_refresh_timer_cannot_be_set_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing was aborted because the search for objects cannot be completed | Group_Policy_processing_was_aborted_because_the_search_for_objects_cannot_be_completed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing was aborted because the security ID of the user cannot be obtained | Group_Policy_processing_was_aborted_because_the_security_ID_of_the_user_cannot_be_obtained_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Policy processing was aborted because the users security ID cannot be written to the registry | Group_Policy_processing_was_aborted_because_the_users_security_ID_cannot_be_written_to_the_registry_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Group Refresh updates are falling behind | Group_Refresh_updates_are_falling_behind_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Initial replication after domain controller promotion has not completed | Initial_replication_after_domain_controller_promotion_has_not_completed | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Internal async schema cache update failed | Internal_async_schema_cache_update_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Intersite Messaging Service SMTP Transport received a delivery failure | Intersite_Messaging_Service_SMTP_Transport_received_a_delivery_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Inter-Site Messaging Service SMTP Transport plug-in failed to add SMTP routing domain | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_add_SMTP_routing_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Inter-Site Messaging Service SMTP Transport plug-in failed to bind the event sink ismsink.dll to the SMTP Service | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_bind_the_event_sink_ismsink.dll_to_the_SMTP_Service_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Inter-Site Messaging Service SMTP Transport plug-in failed to read the SMTP mail message | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_read_the_SMTP_mail_message_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Inter-Site Messaging Service SMTP Transport plug-in failed to register the event sink ismsink.dll | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_register_the_event_sink_ismsink.dll_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Inter-Site Messaging (ISM) Service SMTP Transport plug-in has determined that one or more classes from CDO library are not registered as expected | Inter_Site_Messaging__ISM__Service_SMTP_Transport_plug_in_has_determined_that_one_or_more_classes_from_CDO_library_are_not_registered_as_expected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Inter-Site Messaging (ISM) Service SMTP Transport plug-in has encountered an unexpected error from CDO library | Inter_Site_Messaging__ISM__Service_SMTP_Transport_plug_in_has_encountered_an_unexpected_error_from_CDO_library_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Invalid Forwarded AS Request | Invalid_Forwarded_AS_Request_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Invalid object class | Invalid_object_class_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Invalid Policy Data | Invalid_Policy_Data_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Invalid Script Parameter Configuration | Invalid_Script_Parameter_Configuration | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Invalid site link definition will be ignored | Invalid_site_link_definition_will_be_ignored_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| ISM cannot receive messages | ISM_cannot_receive_messages_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| ISM Request Failure | ISM_Request_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| ISM transport has been shut down | ISM_transport_has_been_shut_down_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| KCC cannot compute a replication path | KCC_cannot_compute_a_replication_path_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| KCC cannot configure replication topology due to ISM failure | KCC_cannot_configure_replication_topology_due_to_ISM_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| KCC failed to initialize | KCC_failed_to_initialize_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| KCC failed to stop | KCC_failed_to_stop_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| KCC failed to update replication topology | KCC_failed_to_update_replication_topology_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| KCC is ignoring a replication path because non-intersecting schedules are preventing replication along that path | KCC_is_ignoring_a_replication_path_because_non_intersecting_schedules_are_preventing_replication_along_that_path_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| LDAP agent cannot open security provider | LDAP_agent_cannot_open_security_provider_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Local cleanup failed on cross domain move | Local_cleanup_failed_on_cross_domain_move_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Local group policy is disabled | Local_group_policy_is_disabled_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Loopback processing has been disabled | Loopback_processing_has_been_disabled_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The AD Machine Account Authentication Failures Report has data available | Machine_Account_Authentication_Failure_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Machine account policy failure - Active Directory GPO lookup failure | Machine_account_policy_failure___Active_Directory_GPO_lookup_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Machine account policy failure - Security Configuration Engine error occurred | Machine_account_policy_failure___Security_Configuration_Engine_error_occurred_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Manual deregistration of some DNS records is required | Manual_deregistration_of_some_DNS_records_is_required_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Memory Allocation Error - the system may be overloaded | Memory_Allocation_Error___the_system_may_be_overloaded_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Memory cannot be allocated | Memory_cannot_be_allocated_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| AD DC Performance Collection - Metric Memory Available Bytes | Microsoft.Windows.Server.2008.AD.DomainController.AvailableBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric Memory Committed Bytes | Microsoft.Windows.Server.2008.AD.DomainController.CommittedBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric NTDS DS Search sub-operations/sec | Microsoft.Windows.Server.2008.AD.DomainController.DSSubSearch.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric NTDS KDC AS Requests | Microsoft.Windows.Server.2008.AD.DomainController.KDCASRequests.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric NTDS KDC TGS Requests | Microsoft.Windows.Server.2008.AD.DomainController.KDCTGRequests.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric NTDS Kerberos Authentications | Microsoft.Windows.Server.2008.AD.DomainController.KerberosAuth.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric NTDS LDAP Client Sessions | Microsoft.Windows.Server.2008.AD.DomainController.LDAPClientSessions.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric NTDS LDAP Searches/sec | Microsoft.Windows.Server.2008.AD.DomainController.LDAPSearches.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric NTDS LDAP UDP operations/sec | Microsoft.Windows.Server.2008.AD.DomainController.LDAPUDPOperations.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric NTDS LDAP Writes/sec | Microsoft.Windows.Server.2008.AD.DomainController.LDAPWrites.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric Process Handle Count of LSASS | Microsoft.Windows.Server.2008.AD.DomainController.LSASSHandleCount.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric Process Private Bytes of LSASS | Microsoft.Windows.Server.2008.AD.DomainController.LSASSPrivateBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric Process \% Processor Time of LSASS | Microsoft.Windows.Server.2008.AD.DomainController.LSASSTotalCPU.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric NTDS NTLM Authentications | Microsoft.Windows.Server.2008.AD.DomainController.NTLMAuthentications.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric Memory Pages/sec | Microsoft.Windows.Server.2008.AD.DomainController.Paging.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric Process \% Processor _Total | Microsoft.Windows.Server.2008.AD.DomainController.ProcessorTime.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric Server - Server Sessions | Microsoft.Windows.Server.2008.AD.DomainController.ServerSessions.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - Metric System - System Up Time | Microsoft.Windows.Server.2008.AD.DomainController.SystemUpTime.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - TCPv4 - Connections Established | Microsoft.Windows.Server.2008.AD.DomainController.TCPv4Connections.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| AD DC Performance Collection - TCPv6 - Connections Established | Microsoft.Windows.Server.2008.AD.DomainController.TCPv6Connections.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
| Miscellaneous KDC Errors | Miscellaneous_KDC_Errors_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Miscellaneous NetLogon Errors | Miscellaneous_NetLogon_Errors_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Miscellaneous SAM Errors | Miscellaneous_SAM_Errors_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Miscellaneous UserEnv Errors | Miscellaneous_UserEnv_Errors_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Missing X.509 Domain Controller certificate | Missing_X.509_Domain_Controller_certificate_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Name conflict detected while replicating partition | Name_conflict_detected_while_replicating_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| None of the preferred bridgehead servers can replicate the directory partition | None_of_the_preferred_bridgehead_servers_can_replicate_the_directory_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| No changes detected in the list of GPOs | No_changes_detected_in_the_list_of_GPOs_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| No input provider to sync time | No_input_provider_to_sync_time_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| No Key to Generate Kerberos Ticket | No_Key_to_Generate_Kerberos_Ticket_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| No suitable domain controller is available for authentication in this domain | No_suitable_domain_controller_is_available_for_authentication_in_this_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| One or more domain controllers may not be replicating | One_or_more_domain_controllers_may_not_be_replicating_For_2000 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
| One or more domain controllers may not be replicating | One_or_more_domain_controllers_may_not_be_replicating_For_2003 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
| One or more domain controllers may not be replicating | One_or_more_domain_controllers_may_not_be_replicating_For_2008 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
| One or more of the DC Locator DNS records are not registered in the DNS database since the primary DNS server doesn't support the dynamic update of the DNS records | One_or_more_of_the_DC_Locator_DNS_records_are_not_registered_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| PAC Verification Failure | PAC_Verification_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Policy Update Failure | Policy_Update_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Replication error | Replication_error_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Replication has been aborted | Replication_has_been_aborted_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Replication has been stopped with a source | Replication_has_been_stopped_with_a_source__5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Report Collection - Machine Account Authentication Failures | Report_Collection___Machine_Account_Authentication_Failures_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Schedule attribute of siteLink object is invalid | Schedule_attribute_of_siteLink_object_is_invalid_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Schema cache load failed to convert the string default SD on class-schema object | Schema_cache_load_failed_to_convert_the_string_default_SD_on_class_schema_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Schema cache load failed to inherit all attributes for the class | Schema_cache_load_failed_to_inherit_all_attributes_for_the_class_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Security Descriptor Propagator has been terminated with error | Security_Descriptor_Propagator_has_been_terminated_with_error_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Session setup failed because no trust account exists : Script - AD Validate Server Trust Event | Session_setup_failed_because_no_trust_account_exists___Script___AD_Validate_Server_Trust_Event_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Setting the administrators password failed. It has been reset to blank. | Setting_the_administrators_password_failed.__It_has_been_reset_to_blank._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| Site has no NTDS Site Settings object | Site_has_no_NTDS_Site_Settings_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Site link was not found | Site_link_was_not_found_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| There are no domain-based Group Policy objects for this user/computer. | There_are_no_domain_based_Group_Policy_objects_for_this_user_computer._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The account identifier pool for this domain controller cannot be updated | The_account_identifier_pool_for_this_domain_controller_cannot_be_updated_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Active Directory database is corrupt | The_Active_Directory_database_is_corrupt_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The AD replication process is unable to continue | The_AD_replication_process_is_unable_to_continue_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The attempt to change the directory partition name to a name that is not conflicting failed | The_attempt_to_change_the_directory_partition_name_to_a_name_that_is_not_conflicting_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The attempt to discover the tombstone lifetime from the domain failed | The_attempt_to_discover_the_tombstone_lifetime_from_the_domain_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The attempt to move a child object to a container failed | The_attempt_to_move_a_child_object_to_a_container_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The behavior version of the dsa object is higher than the behavior version of this OS | The_behavior_version_of_the_dsa_object_is_higher_than_the_behavior_version_of_this_OS_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The computer cannot function properly for authentication purposes | The_computer_cannot_function_properly_for_authentication_purposes_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The computer didn't have sufficient rights to perform the secure dynamic update | The_computer_didnt_have_sufficient_rights_to_perform_the_secure_dynamic_update_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The computer name cannot be mapped to an object in Active Directory - this may result in authentication failures | The_computer_name_cannot_be_mapped_to_an_object_in_Active_Directory___this_may_result_in_authentication_failures_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The computer's domain \%1 is unavailable. (\%2). | The_computer_s_domain__1_is_unavailable.___2_.__5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The connection object translation task in the consistency checker is disabled | The_connection_object_translation_task_in_the_consistency_checker_is__disabled_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The DC was unable to obtain the next account-identifier | The_DC_was_unable_to_obtain_the_next_account_identifier_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The default NTFS security settings have not been applied to Active Directory folders | The_default_NTFS_security_settings_have_not_been_applied_to_Active_Directory_folders_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The deleted list for an extension cannot be obtained | The_deleted_list_for_an_extension_cannot_be_obtained_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The directory forest behavior version and/or domain behavior version are changed to values incompatible with this version of Windows | The_directory_forest_behavior_version_and_or_domain_behavior_version_are_changed_to_values_incompatible_with_this_version_of_Windows_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The directory partition cannot be replicated over a specified transport because none of the domain controllers support the transport | The_directory_partition_cannot_be_replicated_over_a_specified_transport_because_none_of_the_domain_controllers_support_the_transport_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The DNS server with which this DC will register does not support the dynamic update protocol or the authoritative zone is not configured to allow dynamic updates | The_DNS_server_with_which_this_DC_will_register_does_not_support_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The domain behavior version or the forest behavior version is incompatible with this version of Windows | The_domain_behavior_version_or_the_forest_behavior_version_is_incompatible_with_this_version_of_Windows_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Domain Changes report has data available | The_Domain_Changes_report_has_data_available_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The domain controller failed to obtain a new account identifier pool | The_domain_controller_failed_to_obtain_a_new_account_identifier_pool_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Domain Controller has been started | The_Domain_Controller_has_been_started_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Domain Controller has been stopped | The_Domain_Controller_has_been_stopped_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Domain Controller has shutdown unexpectedly | The_Domain_Controller_has_shutdown_unexpectedly_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The domain controller is booting to directory services restore mode | The_domain_controller_is_booting_to_directory_services_restore_mode_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The DS Service Configuration object is not found. You will not be able to set service parameters. | The_DS_Service_Configuration_object_is_not_found.__You_will_not_be_able_to_set_service_parameters._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The GPO cannot be processed because it was created by an old version of the GPO editor | The_GPO_cannot_be_processed_because_it_was_created_by_an_old_version_of_the_GPO_editor_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The group caching option has now been properly updated | The_group_caching_option_has_now_been_properly_updated_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Group Policy client side extension failed to execute | The_Group_Policy_client_side_extension_failed_to_execute_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Intersite Messaging service failed to start the RPC server because it was unable to register authentication information. | The_Intersite_Messaging_service_failed_to_start_the_RPC_server_because_it_was_unable_to_register_authentication_information._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Inter-Site Messaging Service cannot allocate memory | The_Inter_Site_Messaging_Service_cannot_allocate__memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Inter-Site Messaging Service cannot perform a requested LDAP bind operation | The_Inter_Site_Messaging_Service_cannot_perform_a_requested_LDAP_bind_operation_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Inter-Site Messaging Service encountered an error while attempting to start the Service Control Dispatcher | The_Inter_Site_Messaging_Service_encountered_an_error_while__attempting_to_start_the_Service_Control_Dispatcher_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Inter-Site Messaging Service encountered a malformed transport distinguished name | The_Inter_Site_Messaging_Service_encountered_a_malformed__transport_distinguished_name_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Inter-Site Messaging Service failed to create an event | The_Inter_Site_Messaging_Service_failed_to_create_an_event_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Inter-Site Messaging Service failed to initialize | The_Inter_Site_Messaging_Service_failed_to_initialize_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Inter-Site Messaging Service failed to start | The_Inter_Site_Messaging_Service_failed_to_start_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Inter-Site Messaging Service failed to start the RPC server | The_Inter_Site_Messaging_Service_failed_to_start_the_RPC_server_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Inter-Site Messaging Service failed to wait for a message | The_Inter_Site_Messaging_Service_failed_to_wait_for_a_message_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Inter-Site Messaging Service requested to abandon an LDAP notification message | The_Inter_Site_Messaging_Service_requested_to_abandon_an_LDAP_notification_message_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Inter-Site Messaging Service SMTP Transport plug-in failed to remove SMTP routing domain | The_Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_remove__SMTP_routing_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Knowledge Consistency Checker (KCC) cannot run successfully. Replication may be affected | The_Knowledge_Consistency_Checker__KCC__cannot_run_successfully.__Replication_may_be_affected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The Knowledge Consistency Checker (KCC) detected an incompatible up-to-dateness vector format | The_Knowledge_Consistency_Checker__KCC__detected_an_incompatible_up_to_dateness_vector_format_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The list of GPOs for this user or computer has changed | The_list_of_GPOs_for_this_user_or_computer_has_changed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The local domain controller has attempted to replicate an object which is not present because it may have been deleted and already garbage collected | The_local_domain_controller_has_attempted_to_replicate_an_object_which_is_not_present_because_it_may_have_been_deleted_and_already_garbage_collected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The local domain controller has denied a replication attempt on a directory partition. This may pose a security risk | The_local_domain_controller_has_denied_a_replication_attempt_on_a_directory_partition.__This_may_pose_a_security_risk_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The machine account cannot be found | The_machine_account_cannot_be_found_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The NetLogon service on remote machines will not be able to connect to this DC over TCP/IP resulting in authentication failure | The_NetLogon_service_on_remote_machines_will_not_be_able_to_connect_to_this_DC_over_TCP_IP_resulting_in_authentication_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The non-domain naming context has no security descriptor reference domain | The_non_domain_naming_context_has_no_security_descriptor_reference_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The number of Group Policies has exceeded the maximum limit | The_number_of_Group_Policies_has_exceeded_the_maximum_limit_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The object does not exist in Active Directory | The_object_does_not_exist_in_Active_Directory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The registry key cannot be created | The_registry_key_cannot_be_created_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The registry policy file could not be accessed during application of machine policy | The_registry_policy_file_could_not_be_accessed_during_application_of_machine_policy_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The registry value cannot be set | The_registry_value_cannot_be_set_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The script cannot locate the server or its site in Active Directory | The_script_cannot_locate_the_server_or_its_site_in_Active_Directory | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The search for objects in the schema directory partition failed | The_search_for_objects_in_the_schema_directory_partition_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The security descriptor propagation task encountered an error | The_security_descriptor_propagation_task_encountered_an_error_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The server has moved between sites | The_server_has_moved_between_sites | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| The Services container has more than one object of class msExchConfigurationContainer as an immediate child | The_Services_container_has_more_than_one_object_of_class_msExchConfigurationContainer_as_an_immediate_child_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The site cannot be found | The_site_cannot_be_found_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The site contains one or more domain controllers, but is not connected by any site links | The_site_contains_one_or_more_domain_controllers_but_is_not_connected_by_any_site_links_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The site name cannot be queried for | The_site_name_cannot_be_queried_for_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The SMTP domain administrative namespace is not available at this time | The_SMTP_domain_administrative_namespace_is_not_available_at_this_time_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The system clock has not been synchronized for some time | The_system_clock_has_not_been_synchronized_for_some_time_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The system failed to promote this server into a Global Catalog | The_system_failed_to_promote_this_server_into_a_Global_Catalog_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The task that monitors Active Directory for changes in the Inter-Site Transport objects failed to start | The_task_that_monitors_Active_Directory_for_changes_in_the_Inter_Site_Transport_objects_failed_to_start_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The user or computer does not have access to a GPO | The_user_or_computer_does_not_have_access_to_a_GPO_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The user or computer does not pass the filter check to the GPO | The_user_or_computer_does_not_pass_the_filter_check_to_the_GPO_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| The WMI service is disabled. A Group Policy object has not been processed | The_WMI_service_is_disabled.__A_Group_Policy_object_has_not_been_processed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| This domain controller failed to register as (and will not advertise as) a global catalog | This_domain_controller_failed_to_register_as__and_will_not_advertise_as__a_global_catalog_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| This domain controller has been promoted to PDC | This_domain_controller_has_been_promoted_to_PDC_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| This domain controller will not start up because its machine account has been deleted | This_domain_controller_will_not_start_up_because_its_machine_account_has_been_deleted_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
| This server cannot process the replication request | This_server_cannot_process_the_replication_request_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| This server is no longer a domain controller | This_server_is_no_longer_a_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| This source server failed to add schema information for the mail replication request | This_source_server_failed_to_add_schema_information_for_the_mail_replication_request_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| This source server failed to generate the changes | This_source_server_failed_to_generate_the_changes_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Thread in directory is waiting for remote procedure call | Thread_in_directory_is_waiting_for_remote_procedure_call_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Transport initialization failure | Transport_initialization_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Trusted Domain List Update Failure | Trusted_Domain_List_Update_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Two replication partners have an inconsistent view of the FSMO role holders | Two_replication_partners_have_an_inconsistent_view_of_the_FSMO_role_holders | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Unable to establish connection with any Global Catalog(s) | Unable_to_establish_connection_with_any_Global_Catalog_s__5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Unable to establish connection with server | Unable_to_establish_connection_with_server_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Unable to open performance counters | Unable_to_open_performance_counters_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Unable to set privileges necessary for security checks | Unable_to_set_privileges_necessary_for_security_checks_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Unexpected Error applying group policy to machine account | Unexpected_Error_applying_group_policy_to_machine_account_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Unexpected SAM Failure | Unexpected_SAM_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Windows cannot access information in the registry | Windows_cannot_access_information_in_the_registry_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Windows cannot determine the role of this computer. | Windows_cannot_determine_the_role_of_this_computer._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Windows cannot determine the user or computer name. | Windows_cannot_determine_the_user_or_computer_name._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Windows cannot load extension | Windows_cannot_load_extension_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Windows cannot obtain the domain controller name for your computer network. | Windows_cannot_obtain_the_domain_controller_name_for_your_computer_network._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Windows cannot read the history of GPOs from the registry. | Windows_cannot_read_the_history_of_GPOs_from_the_registry._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Windows Directory Service (Active Directory) cannot be initialized | Windows_Directory_Service__Active_Directory__cannot_be_initialized_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Windows Directory Service (Active Directory) exception | Windows_Directory_Service__Active_Directory__exception_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| Windows is setting a registry value | Windows_is_setting_a_registry_value_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
| WMI Replication Provider is not installed Replication cannot be monitored fully | WMI_Replication_Provider_is_not_installed_Replication_cannot_be_monitored_fully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |