| DisplayName | ID | Target | Category | Enabled | Alert Generate |
![Accounts_with_the_same_SID_have_been_detected___one_has_been_deleted_5_Rule](/images/Rule.png) | Accounts with the same SID have been detected - one has been deleted | Accounts_with_the_same_SID_have_been_detected___one_has_been_deleted_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Account_Changes_Report_Available_5_Rule](/images/Rule.png) | Create Account Changes Report and Alert | Account_Changes_Report_Available_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Account_Changes_Report_Creation_Only_Rule](/images/Rule.png) | Create Account Changes Report | Account_Changes_Report_Creation_Only_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | False |
![Account_creation_will_fail_on_this_domain_controller_until_the_account_identifier_pool_is_obtained_5_Rule](/images/Rule.png) | Account creation will fail on this domain controller until the account identifier pool is obtained | Account_creation_will_fail_on_this_domain_controller_until_the_account_identifier_pool_is_obtained_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Account_Name_Not_Unique_5_Rule](/images/Rule.png) | Account Name Not Unique | Account_Name_Not_Unique_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![Active_Directory_cannot_allocate_a_new_domain_controller_GUID_5_Rule](/images/Rule.png) | Active Directory cannot allocate a new domain controller GUID | Active_Directory_cannot_allocate_a_new_domain_controller_GUID_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_be_initialized_5_Rule](/images/Rule.png) | Active Directory cannot be initialized | Active_Directory_cannot_be_initialized_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_boot_normally_because_the_database_was_in_an_incorrect_state_5_Rule](/images/Rule.png) | Active Directory cannot boot normally because the database was in an incorrect state | Active_Directory_cannot_boot_normally_because_the_database_was_in_an_incorrect_state_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_change_the_state_of_the_database_during_a_backup_operation_5_Rule](/images/Rule.png) | Active Directory cannot change the state of the database during a backup operation | Active_Directory_cannot_change_the_state_of_the_database_during_a_backup_operation_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_construct_a_mutual_authentication_Service_Principal_Name_5_Rule](/images/Rule.png) | Active Directory cannot construct a mutual authentication Service Principal Name | Active_Directory_cannot_construct_a_mutual_authentication_Service_Principal_Name_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_create_a_new_security_descriptor_5_Rule](/images/Rule.png) | Active Directory cannot create a new security descriptor | Active_Directory_cannot_create_a_new_security_descriptor_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_create_the_default_security_descriptor_for_an_application_directory_partition_5_Rule](/images/Rule.png) | Active Directory cannot create the default security descriptor for an application directory partition | Active_Directory_cannot_create_the_default_security_descriptor_for_an_application_directory_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_delete_the_access_control_entry__ACE__for_the_domain_Domain_Controllers_security_group_on_a_newly_created_application_directory_partition_5_Rule](/images/Rule.png) | Active Directory cannot delete the access control entry (ACE) for the domain Domain Controllers security group on a newly created application directory partition | Active_Directory_cannot_delete_the_access_control_entry__ACE__for_the_domain_Domain_Controllers_security_group_on_a_newly_created_application_directory_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_delete_the_key_New_Database_GUID_during_the_restore_recovery_process_5_Rule](/images/Rule.png) | Active Directory cannot delete the key "New Database GUID" during the restore recovery process | Active_Directory_cannot_delete_the_key_New_Database_GUID_during_the_restore_recovery_process_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_find_any_RPC_protocol_sequences_installed_5_Rule](/images/Rule.png) | Active Directory cannot find any RPC protocol sequences installed | Active_Directory_cannot_find_any_RPC_protocol_sequences_installed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_function_normally_5_Rule](/images/Rule.png) | Active Directory cannot function normally | Active_Directory_cannot_function_normally_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_perform_an_authenticated_RPC_call_to_another_DC_because_the_SPN_for_the_destination_DC_is_not_registered_on_the_KDC_5_Rule](/images/Rule.png) | Active Directory cannot perform an authenticated RPC call to another DC because the SPN for the destination DC is not registered on the KDC | Active_Directory_cannot_perform_an_authenticated_RPC_call_to_another_DC_because_the_SPN_for_the_destination_DC_is_not_registered_on_the_KDC_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_rebuild_the_following_number_of_indices_and_has_failed_5_Rule](/images/Rule.png) | Active Directory cannot rebuild the following number of indices and has failed | Active_Directory_cannot_rebuild_the_following_number_of_indices_and_has_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_replicate_configuration_and_schema_information_5_Rule](/images/Rule.png) | [DEPRECATED] Active Directory cannot replicate configuration and schema information | Active_Directory_cannot_replicate_configuration_and_schema_information_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![Active_Directory_cannot_set_the_replication_consistency_registry_key_5_Rule](/images/Rule.png) | Active Directory cannot set the replication consistency registry key | Active_Directory_cannot_set_the_replication_consistency_registry_key_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_update_object_due_to_insufficient_memory_5_Rule](/images/Rule.png) | Active Directory cannot update object due to insufficient memory | Active_Directory_cannot_update_object_due_to_insufficient_memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_update_the_functional_level_on_the_NTDS_Settings_object_for_the_local_domain_controller_5_Rule](/images/Rule.png) | Active Directory cannot update the functional level on the NTDS Settings object for the local domain controller | Active_Directory_cannot_update_the_functional_level_on_the_NTDS_Settings_object_for_the_local_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_validate_the_functional_level_of_the_domain_controller_5_Rule](/images/Rule.png) | Active Directory cannot validate the functional level of the domain controller | Active_Directory_cannot_validate_the_functional_level_of_the_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_cannot_write_a_new_security_descriptor_for_object_5_Rule](/images/Rule.png) | Active Directory cannot write a new security descriptor for object | Active_Directory_cannot_write_a_new_security_descriptor_for_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_encountered_a_replication_error.__Replication_will_be_delayed._5_Rule](/images/Rule.png) | Active Directory encountered a replication error. Replication will be delayed. | Active_Directory_encountered_a_replication_error.__Replication_will_be_delayed._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_has_failed_to_upgrade_a_critical_index_as_part_of_initialization_5_Rule](/images/Rule.png) | Active Directory has failed to upgrade a critical index as part of initialization | Active_Directory_has_failed_to_upgrade_a_critical_index_as_part_of_initialization_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Active_Directory_Latency_Alert_Rule_For_Windows2000](/images/Rule.png) | AD Replication is occurring slowly | Active_Directory_Latency_Alert_Rule_For_Windows2000 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
![Active_Directory_Latency_Alert_Rule_For_Windows2003](/images/Rule.png) | AD Replication is occurring slowly | Active_Directory_Latency_Alert_Rule_For_Windows2003 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
![Active_Directory_Latency_Alert_Rule_For_Windows2008](/images/Rule.png) | AD Replication is occurring slowly | Active_Directory_Latency_Alert_Rule_For_Windows2008 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
![Active_Directory_shadow_copy_restore_was_unsuccessful.__The_contents_of_Active_Directory_are_unpredictable._5_Rule](/images/Rule.png) | Active Directory shadow copy restore was unsuccessful. The contents of Active Directory are unpredictable. | Active_Directory_shadow_copy_restore_was_unsuccessful.__The_contents_of_Active_Directory_are_unpredictable._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_ADWS_Service_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD ADWS Service Check Script Based Test Failed to Complete | AD_ADWS_Service_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_cannot_allocate_memory_5_Rule](/images/Rule.png) | AD cannot allocate memory | AD_cannot_allocate_memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_cannot_find_the_NTDS_object_for_this_domain_controller_5_Rule](/images/Rule.png) | AD cannot find the NTDS object for this domain controller | AD_cannot_find_the_NTDS_object_for_this_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_cannot_find_the_partition_container_5_Rule](/images/Rule.png) | AD cannot find the partition container | AD_cannot_find_the_partition_container_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_cannot_release_memory_5_Rule](/images/Rule.png) | AD cannot release memory | AD_cannot_release_memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_cannot_update_object_because_the_disk_containing_the_database_is_full_5_Rule](/images/Rule.png) | AD cannot update object because the disk containing the database is full | AD_cannot_update_object_because_the_disk_containing_the_database_is_full_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_cannot_update_the_object_5_Rule](/images/Rule.png) | AD cannot update the object | AD_cannot_update_the_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_configuration_information_is_missing_from_the_registry_5_Rule](/images/Rule.png) | AD configuration information is missing from the registry | AD_configuration_information_is_missing_from_the_registry_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_CPU_Overload.PerformanceCollection](/images/Rule.png) | LSASS CPU UsagePerformance Collection [Deprecated] | AD_CPU_Overload.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | False | False |
![AD_CPU_Overload_Pass_through_1](/images/Rule.png) | AD CPU Overload Event 1 | AD_CPU_Overload_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_CPU_Overload_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD CPU Overload Script Based Test Failed to Complete | AD_CPU_Overload_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_CPU_Overload_Script_Parameters_are_configured_incorrectly](/images/Rule.png) | AD CPU Overload Script Parameters are configured incorrectly | AD_CPU_Overload_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Database_and_Log_Pass_through_1](/images/Rule.png) | AD Database and Log Event 1 | AD_Database_and_Log_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_Database_and_Log_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD Database and Log Script Based Test Failed to Complete | AD_Database_and_Log_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Database_and_Log_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | AD Database and Log The AD Management Pack does not support the agentless management mode | AD_Database_and_Log_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_database_is_corrupt_5_Rule](/images/Rule.png) | AD database is corrupt | AD_database_is_corrupt_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_DC_Demoted](/images/Rule.png) | AD DC Demoted | AD_DC_Demoted | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Maintenance | True | False |
![AD_DC_Demoted_Pass_through_1](/images/Rule.png) | AD DC Demoted Event 1 | AD_DC_Demoted_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_DC_Demoted_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD DC Demoted Script Based Test Failed to Complete | AD_DC_Demoted_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_DNS_Verification_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD DNS Verification Script Based Test Failed to Complete | AD_DNS_Verification_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_DNS_Verification_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | AD DNS Verification The AD Management Pack does not support the agentless management mode | AD_DNS_Verification_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_General_Response.PerformanceCollection](/images/Rule.png) | AD General Response Last Bind Performance Collection | AD_General_Response.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_General_Response_Pass_through](/images/Rule.png) | AD General Response Event | AD_General_Response_Pass_through | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_General_Response_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD General Response Script Based Test Failed to Complete | AD_General_Response_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_General_Response_Script_Parameters_are_configured_incorrectly](/images/Rule.png) | AD General Response Script Parameters are configured incorrectly | AD_General_Response_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_General_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | AD General Response: The AD Management Pack does not support the agentless management mode | AD_General_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Global_Catalog_Search_Response.PerformanceCollection](/images/Rule.png) | AD Global Catalog Search Time Response Performance Collection | AD_Global_Catalog_Search_Response.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Global_Catalog_Search_Response_Pass_through_1](/images/Rule.png) | AD Global Catalog Search Response Event 1 | AD_Global_Catalog_Search_Response_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_Global_Catalog_Search_Response_Pass_through_2](/images/Rule.png) | AD Global Catalog Search Response Event 2 | AD_Global_Catalog_Search_Response_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_Global_Catalog_Search_Response_Script_Parameters_are_configured_incorrectly](/images/Rule.png) | AD Global Catalog Search Response Script Parameters are configured incorrectly | AD_Global_Catalog_Search_Response_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Global_Catalog_Search_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | AD Global Catalog Search Response The AD Management Pack does not support the agentless management mode | AD_Global_Catalog_Search_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_internal_error__reinstall_server_5_Rule](/images/Rule.png) | AD internal error: reinstall server | AD_internal_error__reinstall_server_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Lost_And_Found_Object_Count_Pass_through_1](/images/Rule.png) | AD Lost And Found Object Count Event 1 | AD_Lost_And_Found_Object_Count_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_Lost_And_Found_Object_Count_Pass_through_2](/images/Rule.png) | AD Lost And Found Object Count Event 2 | AD_Lost_And_Found_Object_Count_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_Lost_And_Found_Object_Count_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD Lost And Found Object Count Script Based Test Failed to Complete | AD_Lost_And_Found_Object_Count_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Lost_And_Found_Object_Count_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | AD Lost And Found Object Count The AD Management Pack does not support the agentless management mode | AD_Lost_And_Found_Object_Count_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_MOM_Agent_Proxy_is_not_enabled](/images/Rule.png) | Agent Proxy not enabled | AD_MOM_Agent_Proxy_is_not_enabled | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Monitor_Trusts_AD_Client_Side_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD Monitor Trusts AD Client Side Script Based Test Failed to Complete | AD_Monitor_Trusts_AD_Client_Side_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Monitor_Trusts_Pass_through_1](/images/Rule.png) | AD Monitor Trusts Event 1 | AD_Monitor_Trusts_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_Monitor_Trusts_Pass_through_2](/images/Rule.png) | AD Monitor Trusts Event 2 | AD_Monitor_Trusts_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_Monitor_Trusts_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | AD Monitor Trusts The AD Management Pack does not support the agentless management mode | AD_Monitor_Trusts_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Op_Master_Response_1.PerformanceCollection](/images/Rule.png) | AD Op Master PDC Last Ping Performance Collection | AD_Op_Master_Response_1.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Op_Master_Response_10.PerformanceCollection](/images/Rule.png) | AD Op Master Schema Last Bind Performance Collection | AD_Op_Master_Response_10.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Op_Master_Response_2.PerformanceCollection](/images/Rule.png) | AD Op Master PDC Last Bind PerformanceCollection | AD_Op_Master_Response_2.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Op_Master_Response_3.PerformanceCollection](/images/Rule.png) | AD Op Master Domain Naming Last Ping Performance Collection | AD_Op_Master_Response_3.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Op_Master_Response_4.PerformanceCollection](/images/Rule.png) | AD Op Master Domain Naming Last Bind Performance Collection | AD_Op_Master_Response_4.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Op_Master_Response_5.PerformanceCollection](/images/Rule.png) | AD Op Master Infrastructure Last Ping Performance Collection | AD_Op_Master_Response_5.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Op_Master_Response_6.PerformanceCollection](/images/Rule.png) | AD Op Master Infrastructure Last Bind Performance Collection | AD_Op_Master_Response_6.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Op_Master_Response_7.PerformanceCollection](/images/Rule.png) | AD Op Master RID Last Ping Performance Collection | AD_Op_Master_Response_7.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Op_Master_Response_8.PerformanceCollection](/images/Rule.png) | AD Op Master RID Last Bind Performance Collection | AD_Op_Master_Response_8.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Op_Master_Response_9.PerformanceCollection](/images/Rule.png) | AD Op Master Schema Last Ping Performance Collection | AD_Op_Master_Response_9.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Op_Master_Response_Script_Parameters_are_configured_incorrectly](/images/Rule.png) | AD Op Master Response Script Parameters are configured incorrectly | AD_Op_Master_Response_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Op_Master_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | AD Op Master Response The AD Management Pack does not support the agentless management mode | AD_Op_Master_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Replication_Monitoring.Helper1](/images/Rule.png) | AD Replication Monitoring Performance Collection (Sources) | AD_Replication_Monitoring.Helper1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | False |
![AD_Replication_Monitoring.Helper2](/images/Rule.png) | AD Replication Monitoring Performance Collection (Targets) | AD_Replication_Monitoring.Helper2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | False |
![AD_Replication_Monitoring.PerformanceCollection_1](/images/Rule.png) | AD Replication Performance Collection - Metric Replication Latency | AD_Replication_Monitoring.PerformanceCollection_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Replication_Monitoring.PerformanceCollection_2](/images/Rule.png) | AD Replication Performance Collection - Metric Replication Latency:Minimum | AD_Replication_Monitoring.PerformanceCollection_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Replication_Monitoring.PerformanceCollection_3](/images/Rule.png) | AD Replication Performance Collection - Metric Replication Latency:Maximum | AD_Replication_Monitoring.PerformanceCollection_3 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Replication_Monitoring.PerformanceCollection_4](/images/Rule.png) | AD Replication Performance Collection - Metric Replication Latency:Average | AD_Replication_Monitoring.PerformanceCollection_4 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![AD_Replication_Monitoring_Access_Denied](/images/Rule.png) | AD Replication Monitoring Access Denied | AD_Replication_Monitoring_Access_Denied | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Replication_Monitoring_A_problem_has_been_detected_with_the_trust_relationship_between_two_domains](/images/Rule.png) | [DEPRECATED] A SCOM latency monitor for an invalid naming context has been cleaned up | AD_Replication_Monitoring_A_problem_has_been_detected_with_the_trust_relationship_between_two_domains | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![AD_Replication_Monitoring_Pass_through](/images/Rule.png) | AD Replication Monitoring Event | AD_Replication_Monitoring_Pass_through | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_Replication_Monitoring_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD Replication Monitoring Script Based Test Failed to Complete | AD_Replication_Monitoring_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Replication_Monitoring_Script_Parameters_are_configured_incorrectly](/images/Rule.png) | AD Replication Monitoring Script Parameters are configured incorrectly | AD_Replication_Monitoring_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Replication_Monitoring_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | AD Replication Monitoring The AD Management Pack does not support the agentless management mode | AD_Replication_Monitoring_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Replication_Monitoring_Time_skew_detected](/images/Rule.png) | AD Replication Monitoring Time skew detected | AD_Replication_Monitoring_Time_skew_detected | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Replication_Partner_Count_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD Replication Partner Count Script Based Test Failed to Complete | AD_Replication_Partner_Count_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Replication_Partner_Count_Script_Parameters_are_configured_incorrectly](/images/Rule.png) | AD Replication Partner Count Script Parameters are configured incorrectly | AD_Replication_Partner_Count_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Replication_Partner_Count_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | AD Replication Partner Count The AD Management Pack does not support the agentless management mode | AD_Replication_Partner_Count_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Replication_Partner_Op_Master_Consistency_AD_Client_Side_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | [DEPRECATED] AD Replication Partner Op Master Consistency AD Client Side Script Based Test Failed to Complete | AD_Replication_Partner_Op_Master_Consistency_AD_Client_Side_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![AD_Replication_Partner_Op_Master_Consistency_Pass_through_1](/images/Rule.png) | [DEPRECATED] AD Replication Partner Op_Master Consistency Event 1 | AD_Replication_Partner_Op_Master_Consistency_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | False |
![AD_Replication_Partner_Op_Master_Consistency_Pass_through_2](/images/Rule.png) | [DEPRECATED] AD Replication Partner Op_Master Consistency Event 2 | AD_Replication_Partner_Op_Master_Consistency_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | False |
![AD_Replication_Partner_Op_Master_Consistency_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | [DEPRECATED] AD Replication Partner Op Master Consistency The AD Management Pack does not support the agentless management mode | AD_Replication_Partner_Op_Master_Consistency_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![AD_Server_Moved_Site](/images/Rule.png) | AD Server Moved Site Rule | AD_Server_Moved_Site | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Maintenance | True | False |
![AD_Server_Moved_Site_AD_Client_Side_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD Server Moved Site AD Client Side Script Based Test Failed to Complete | AD_Server_Moved_Site_AD_Client_Side_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Server_Moved_Site_Pass_through_1](/images/Rule.png) | AD Server Moved Site Event 1 | AD_Server_Moved_Site_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_Server_Moved_Site_Pass_through_2](/images/Rule.png) | AD Server Moved Site Event 2 | AD_Server_Moved_Site_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![AD_Server_Moved_Site_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | AD Server Moved Site The AD Management Pack does not support the agentless management mode | AD_Server_Moved_Site_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Validate_Server_Trust_Event_Script_Based_Test_Failed_to_Complete](/images/Rule.png) | AD Validate Server Trust Event Script Based Test Failed to Complete | AD_Validate_Server_Trust_Event_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![AD_Validate_Server_Trust_Event_The_AD_Management_Pack_does_not_support_the_agentless_management_mode](/images/Rule.png) | AD Validate Server Trust Event The AD Management Pack does not support the agentless management mode | AD_Validate_Server_Trust_Event_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![All_replication_partners_failed_to_synchronize](/images/Rule.png) | All of the replication partners failed to replicate. | All_replication_partners_failed_to_synchronize | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | True |
![An_account_cannot_be_added_to_the_group_5_Rule](/images/Rule.png) | An account cannot be added to the group | An_account_cannot_be_added_to_the_group_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![An_account_name_collision_occurred___this_may_result_in_authentication_failures_5_Rule](/images/Rule.png) | An account name collision occurred - this may result in authentication failures | An_account_name_collision_occurred___this_may_result_in_authentication_failures_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![An_attempt_to_check_whether_group_caching_is_enabled_has_failed_5_Rule](/images/Rule.png) | An attempt to check whether group caching is enabled has failed | An_attempt_to_check_whether_group_caching_is_enabled_has_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![An_attempt_to_set_the_time_was_aborted_due_to_the_offset_being_too_large_5_Rule](/images/Rule.png) | An attempt to set the time was aborted due to the offset being too large | An_attempt_to_set_the_time_was_aborted_due_to_the_offset_being_too_large_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![An_attempt_to_update_user_credentials_failed_5_Rule](/images/Rule.png) | An attempt to update user credentials failed | An_attempt_to_update_user_credentials_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![An_error_occurred_while_granting_rights_to_the_Domain_Administrators_group_5_Rule](/images/Rule.png) | An error occurred while granting rights to the Domain Administrators group | An_error_occurred_while_granting_rights_to_the_Domain_Administrators_group_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![An_internal_AD_error_occurred_5_Rule](/images/Rule.png) | An internal AD error occurred | An_internal_AD_error_occurred_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![An_Intersite_Messaging_Service_request_to_modify_an_LDAP_object_failed_5_Rule](/images/Rule.png) | An Intersite Messaging Service request to modify an LDAP object failed | An_Intersite_Messaging_Service_request_to_modify_an_LDAP_object_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![An_object_cannot_inherit_a_security_identifier__SID__from_another_object_5_Rule](/images/Rule.png) | An object cannot inherit a security identifier (SID) from another object | An_object_cannot_inherit_a_security_identifier__SID__from_another_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![An_object_has_been_duplicated_during_a_cross_domain_move_5_Rule](/images/Rule.png) | An object has been duplicated during a cross domain move | An_object_has_been_duplicated_during_a_cross_domain_move_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Attempts_to_backup_or_restore_Active_Directory_have_failed_or_will_fail_5_Rule](/images/Rule.png) | Attempts to backup or restore Active Directory have failed or will fail | Attempts_to_backup_or_restore_Active_Directory_have_failed_or_will_fail_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Attempts_to_update_Active_Directory_are_failing_5_Rule](/images/Rule.png) | Attempts to update Active Directory are failing | Attempts_to_update_Active_Directory_are_failing_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_certificate_was_not_authenticated_because_the_computer_it_came_from_is_not_a_domain_controller_5_Rule](/images/Rule.png) | A certificate was not authenticated because the computer it came from is not a domain controller | A_certificate_was_not_authenticated_because_the_computer_it_came_from_is_not_a_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_dll_cannot_be_loaded_because_the_software_was_incorrectly_installed_5_Rule](/images/Rule.png) | A dll cannot be loaded because the software was incorrectly installed | A_dll_cannot_be_loaded_because_the_software_was_incorrectly_installed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_DNS_server_used_by_this_server_for_name_resolution_did_not_respond_1_Rule](/images/Rule.png) | A DNS server used by this server for name resolution did not respond within the timeout interval | A_DNS_server_used_by_this_server_for_name_resolution_did_not_respond_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_domain_controller_has_an_extremely_high_number_of_replication_partners](/images/Rule.png) | A domain controller has an extremely high number of replication partners | A_domain_controller_has_an_extremely_high_number_of_replication_partners | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_domain_controller_has_an_unusually_high_number_of_replication_partners](/images/Rule.png) | A domain controller has an unusually high number of replication partners | A_domain_controller_has_an_unusually_high_number_of_replication_partners | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_domain_controller_made_a_replication_request_for_a_writable_directory_partition_that_has_been_denied_by_the_local_domain_controller_5_Rule](/images/Rule.png) | A domain controller made a replication request for a writable directory partition that has been denied by the local domain controller | A_domain_controller_made_a_replication_request_for_a_writable_directory_partition_that_has_been_denied_by_the_local_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_GPO_extension_was_not_applied_because_the_registry_extension_failed_5_Rule](/images/Rule.png) | A GPO extension was not applied because the registry extension failed | A_GPO_extension_was_not_applied_because_the_registry_extension_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_Group_Policy_object_cannot_be_found_in_Active_Directory_5_Rule](/images/Rule.png) | A Group Policy object cannot be found in Active Directory | A_Group_Policy_object_cannot_be_found_in_Active_Directory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_Group_Policy_Object_has_not_been_processed_because_the_filter_check_could_not_be_performed_5_Rule](/images/Rule.png) | A Group Policy Object has not been processed because the filter check could not be performed | A_Group_Policy_Object_has_not_been_processed_because_the_filter_check_could_not_be_performed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_Group_Policy_Object_is_corrupt._5_Rule](/images/Rule.png) | A Group Policy Object is corrupt. | A_Group_Policy_Object_is_corrupt._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_journal_wrap_error_has_occurred_on_the_Sysvol_5_Rule](/images/Rule.png) | A journal wrap error has occurred on the Sysvol | A_journal_wrap_error_has_occurred_on_the_Sysvol_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![A_lingering_object_has_been_detected.__Replication_has_been_blocked._5_Rule](/images/Rule.png) | A lingering object has been detected. Replication has been blocked. | A_lingering_object_has_been_detected.__Replication_has_been_blocked._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_problem_has_been_detected_with_the_trust_relationship_between_two_domains](/images/Rule.png) | [DEPRECATED] A problem has been detected with the trust relationship between two domains | A_problem_has_been_detected_with_the_trust_relationship_between_two_domains | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![A_replication_island_has_been_detected_Replication_will_not_occur_across_the_enterprise](/images/Rule.png) | A replication island has been detected Replication will not occur across the enterprise | A_replication_island_has_been_detected_Replication_will_not_occur_across_the_enterprise | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_resource_record_for_the_computer_name_of_the_DC_is_not_registered_1_Rule](/images/Rule.png) | A resource record for the computer name of the DC is not registered in the DNS database | A_resource_record_for_the_computer_name_of_the_DC_is_not_registered_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_RSoP__Resultant_Set_of_Policies__error_occurred_5_Rule](/images/Rule.png) | A RSoP (Resultant Set of Policies) error occurred | A_RSoP__Resultant_Set_of_Policies__error_occurred_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_schema_collision_occurred_while_replicating_attribute_definitions_5_Rule](/images/Rule.png) | A schema collision occurred while replicating attribute definitions | A_schema_collision_occurred_while_replicating_attribute_definitions_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_schema_collision_occurred_while_replicating_a_class_definition_5_Rule](/images/Rule.png) | A schema collision occurred while replicating a class definition | A_schema_collision_occurred_while_replicating_a_class_definition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_user_from_a_different_forest_logged_onto_this_machine._Group_policy_processing_has_been_effected._5_Rule](/images/Rule.png) | A user from a different forest logged onto this machine. Group policy processing has been effected. | A_user_from_a_different_forest_logged_onto_this_machine._Group_policy_processing_has_been_effected._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![A_well_known_account_has_been_recreated_because_it_did_not_exist_5_Rule](/images/Rule.png) | A well known account has been recreated because it did not exist | A_well_known_account_has_been_recreated_because_it_did_not_exist_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![A_well_known_group_has_been_recreated_because_it_did_not_exist_5_Rule](/images/Rule.png) | A well known group has been recreated because it did not exist | A_well_known_group_has_been_recreated_because_it_did_not_exist_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Cannot_access_the_registry_policy_file_5_Rule](/images/Rule.png) | Cannot access the registry policy file | Cannot_access_the_registry_policy_file_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Cannot_delete_a_registry_value_5_Rule](/images/Rule.png) | Cannot delete a registry value | Cannot_delete_a_registry_value_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Cannot_process_client_side_group_policy_extension_5_Rule](/images/Rule.png) | Cannot process client side group policy extension | Cannot_process_client_side_group_policy_extension_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Cannot_read_the_GPO_history_5_Rule](/images/Rule.png) | Cannot read the GPO history | Cannot_read_the_GPO_history_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Certificate_for_intersite_replication_was_rejected_5_Rule](/images/Rule.png) | Certificate for intersite replication was rejected | Certificate_for_intersite_replication_was_rejected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Change_Password_on_KRBTGT_Account_Failed_5_Rule](/images/Rule.png) | Change Password on KRBTGT Account Failed | Change_Password_on_KRBTGT_Account_Failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Classes_from_COM.DLL_not_registered_5_Rule](/images/Rule.png) | Classes from COM.DLL not registered | Classes_from_COM.DLL_not_registered_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Collection_Rule_for_No_DC_GC_in_Site_events_5_Rule](/images/Rule.png) | Collection Rule for No DC/GC in Site events | Collection_Rule_for_No_DC_GC_in_Site_events_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Collection_rule_for_the_Replication_Collisions_Report_5_Rule](/images/Rule.png) | Collection rule for the Replication Collisions Report | Collection_rule_for_the_Replication_Collisions_Report_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Collection_rule_for_the_Replication_Failures_Report_5_Rule](/images/Rule.png) | Collection rule for the Replication Failures Report | Collection_rule_for_the_Replication_Failures_Report_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Contacting_the_Domain_Naming_FSMO_Role_Holder_has_completed_successfully](/images/Rule.png) | Contacting the Domain Naming FSMO Role Holder has completed successfully | Contacting_the_Domain_Naming_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Contacting_the_Infrastructure_FSMO_Role_Holder_has_completed_successfully](/images/Rule.png) | Contacting the Infrastructure FSMO Role Holder has completed successfully | Contacting_the_Infrastructure_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Contacting_the_PDC_FSMO_Role_Holder_has_completed_successfully](/images/Rule.png) | Contacting the PDC FSMO Role Holder has completed successfully | Contacting_the_PDC_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Contacting_the_RID_Master_FSMO_Role_Holder_has_completed_successfully](/images/Rule.png) | Contacting the RID Master FSMO Role Holder has completed successfully | Contacting_the_RID_Master_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Contacting_the_Schema_Master_FSMO_Role_Holder_has_completed_successfully](/images/Rule.png) | Contacting the Schema Master FSMO Role Holder has completed successfully | Contacting_the_Schema_Master_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Corrupt_Credentials_5_Rule](/images/Rule.png) | Corrupt Credentials | Corrupt_Credentials_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Could_not_determine_the_FSMO_role_holder](/images/Rule.png) | Could not determine the FSMO role holder | Could_not_determine_the_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Cross_domain_Group_Policy_processing_has_been_aborted_because_the_other_domain_cannot_be_reached_5_Rule](/images/Rule.png) | Cross-domain Group Policy processing has been aborted because the other domain cannot be reached | Cross_domain_Group_Policy_processing_has_been_aborted_because_the_other_domain_cannot_be_reached_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![DC_2000_has_failed_to_synchronize_with_its_replication_partner](/images/Rule.png) | DC has failed to synchronize naming context with its replication partner | DC_2000_has_failed_to_synchronize_with_its_replication_partner | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
![DC_2003_has_failed_to_synchronize_with_its_replication_partner](/images/Rule.png) | DC has failed to synchronize naming context with its replication partner | DC_2003_has_failed_to_synchronize_with_its_replication_partner | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
![DC_2008_has_failed_to_synchronize_with_its_replication_partner](/images/Rule.png) | DC has failed to synchronize naming context with its replication partner | DC_2008_has_failed_to_synchronize_with_its_replication_partner | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
![DC_is_both_a_Global_Catalog_and_the_Infrastructure_Update_master_5_Rule](/images/Rule.png) | DC is both a Global Catalog and the Infrastructure Update master | DC_is_both_a_Global_Catalog_and_the_Infrastructure_Update_master_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Direct_replication_cannot_occur_as_configured_5_Rule](/images/Rule.png) | Direct replication cannot occur as configured | Direct_replication_cannot_occur_as_configured_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![DNS_registrations_of_essential_Domain_controller_records_is_failing_1_Rule](/images/Rule.png) | DNS registrations of essential Domain controller records is failing | DNS_registrations_of_essential_Domain_controller_records_is_failing_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Domain_Operation_Mode_has_been_changed_to_Native_Mode_5_Rule](/images/Rule.png) | Domain Operation Mode has been changed to Native Mode | Domain_Operation_Mode_has_been_changed_to_Native_Mode_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Duplicate_account_names_were_detected___one_account_has_been_renamed_5_Rule](/images/Rule.png) | Duplicate account names were detected - one account has been renamed | Duplicate_account_names_were_detected___one_account_has_been_renamed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Duplicate_moved_object_detected_5_Rule](/images/Rule.png) | Duplicate moved object detected | Duplicate_moved_object_detected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Duplicate_User_Principal_Names_have_been_detected_5_Rule](/images/Rule.png) | Duplicate User Principal Names have been detected | Duplicate_User_Principal_Names_have_been_detected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Failed_to_ping_or_bind_to_the_Domain_Naming_Master_FSMO_role_holder](/images/Rule.png) | Failed to ping or bind to the Domain Naming Master FSMO role holder | Failed_to_ping_or_bind_to_the_Domain_Naming_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Failed_to_ping_or_bind_to_the_Infrastructure_Master_FSMO_role_holder](/images/Rule.png) | Failed to ping or bind to the Infrastructure Master FSMO role holder | Failed_to_ping_or_bind_to_the_Infrastructure_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Failed_to_ping_or_bind_to_the_PDC_FSMO_role_holder](/images/Rule.png) | Failed to ping or bind to the PDC FSMO role holder | Failed_to_ping_or_bind_to_the_PDC_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Failed_to_ping_or_bind_to_the_RID_Master_FSMO_role_holder](/images/Rule.png) | Failed to ping or bind to the RID Master FSMO role holder | Failed_to_ping_or_bind_to_the_RID_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Failed_to_ping_or_bind_to_the_Schema_Master_FSMO_role_holder](/images/Rule.png) | Failed to ping or bind to the Schema Master FSMO role holder | Failed_to_ping_or_bind_to_the_Schema_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Format_of_schedule_object_attribute_unrecognized_5_Rule](/images/Rule.png) | Format of schedule object attribute unrecognized | Format_of_schedule_object_attribute_unrecognized_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![FRS_has_not_replicated_one_or_more_files_in_the_Sysvol_to_other_domain_controllers_5_Rule](/images/Rule.png) | FRS has not replicated one or more files in the Sysvol to other domain controllers | FRS_has_not_replicated_one_or_more_files_in_the_Sysvol_to_other_domain_controllers_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![FRS_is_scanning_the_system_volume_before_sharing_it_5_Rule](/images/Rule.png) | FRS is scanning the system volume before sharing it | FRS_is_scanning_the_system_volume_before_sharing_it_5_Rule | Microsoft.Windows.Server.2008.AD.EssentialService.NTFRS | EventCollection | False | True |
![Group_Cache_Refresh_cannot_obtain_a_connection_schedule_to_it_s_preferred_site_5_Rule](/images/Rule.png) | Group Cache Refresh cannot obtain a connection schedule to it's preferred site | Group_Cache_Refresh_cannot_obtain_a_connection_schedule_to_it_s_preferred_site_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Cache_Refresh_cannot_schedule_an_update_5_Rule](/images/Rule.png) | Group Cache Refresh cannot schedule an update | Group_Cache_Refresh_cannot_schedule_an_update_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Cache_Refresh_found_a_GC_in_a_non_optimal_site_5_Rule](/images/Rule.png) | Group Cache Refresh found a GC in a non-optimal site | Group_Cache_Refresh_found_a_GC_in_a_non_optimal_site_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Cache_Refresh_has_reached_the_user_limit_for_this_domain_controller_5_Rule](/images/Rule.png) | Group Cache Refresh has reached the user limit for this domain controller | Group_Cache_Refresh_has_reached_the_user_limit_for_this_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_aborted_because_a_filter_check_for_the_GPO_failed_5_Rule](/images/Rule.png) | Group Policy processing aborted because a filter check for the GPO failed | Group_Policy_processing_aborted_because_a_filter_check_for_the_GPO_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_aborted_because_the_common_name_for_the_GPO_cannot_be_accessed_5_Rule](/images/Rule.png) | Group Policy processing aborted because the common name for the GPO cannot be accessed | Group_Policy_processing_aborted_because_the_common_name_for_the_GPO_cannot_be_accessed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_policy_processing_aborted_because_the_GPO_does_not_have_a_version_number_5_Rule](/images/Rule.png) | Group policy processing aborted because the GPO does not have a version number | Group_policy_processing_aborted_because_the_GPO_does_not_have_a_version_number_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_policy_processing_aborted___cannot_connect_to_the_Directory_Service_5_Rule](/images/Rule.png) | Group policy processing aborted - cannot connect to the Directory Service | Group_policy_processing_aborted___cannot_connect_to_the_Directory_Service_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_policy_processing_aborted___cannot_determine_site_5_Rule](/images/Rule.png) | Group policy processing aborted - cannot determine site | Group_policy_processing_aborted___cannot_determine_site_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_policy_processing_aborted___reboot_this_machine_5_Rule](/images/Rule.png) | Group policy processing aborted - reboot this machine | Group_policy_processing_aborted___reboot_this_machine_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_policy_processing_aborted___the_search_for_the_root_AD_object_failed_5_Rule](/images/Rule.png) | Group policy processing aborted - the search for the root AD object failed | Group_policy_processing_aborted___the_search_for_the_root_AD_object_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_has_been_aborted_because_an_invalid_class_of_object_was_discovered_5_Rule](/images/Rule.png) | Group Policy processing has been aborted because an invalid class of object was discovered | Group_Policy_processing_has_been_aborted_because_an_invalid_class_of_object_was_discovered_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_has_been_aborted_because_GPO_lists_cannot_be_set_up_5_Rule](/images/Rule.png) | Group Policy processing has been aborted because GPO lists cannot be set up | Group_Policy_processing_has_been_aborted_because_GPO_lists_cannot_be_set_up_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_has_been_aborted_because_of_an_invalid_access_configuration_5_Rule](/images/Rule.png) | Group Policy processing has been aborted because of an invalid access configuration | Group_Policy_processing_has_been_aborted_because_of_an_invalid_access_configuration_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_has_been_aborted_because_the_extensions_from_the_registry_cannot_be_read_5_Rule](/images/Rule.png) | Group Policy processing has been aborted because the extensions from the registry cannot be read | Group_Policy_processing_has_been_aborted_because_the_extensions_from_the_registry_cannot_be_read_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_has_been_aborted_because_the_file_gpt.ini_cannot_be_accessed_5_Rule](/images/Rule.png) | Group Policy processing has been aborted because the file gpt.ini cannot be accessed | Group_Policy_processing_has_been_aborted_because_the_file_gpt.ini_cannot_be_accessed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_has_been_aborted_because_the_GPLink_property_of_an_object_cannot_be_accessed_5_Rule](/images/Rule.png) | Group Policy processing has been aborted because the GPLink property of an object cannot be accessed | Group_Policy_processing_has_been_aborted_because_the_GPLink_property_of_an_object_cannot_be_accessed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_has_been_aborted_because_the_GPO_does_not_have_a_functionality_version_number_5_Rule](/images/Rule.png) | Group Policy processing has been aborted because the GPO does not have a functionality version number | Group_Policy_processing_has_been_aborted_because_the_GPO_does_not_have_a_functionality_version_number_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_has_been_aborted_because_the_user_does_not_have_access_to_an_object_5_Rule](/images/Rule.png) | Group Policy processing has been aborted because the user does not have access to an object | Group_Policy_processing_has_been_aborted_because_the_user_does_not_have_access_to_an_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_has_been_aborted__in_planning_mode__because_the_user_computer_does_not_have_access_to_a_required_object_5_Rule](/images/Rule.png) | Group Policy processing has been aborted (in planning mode) because the user/computer does not have access to a required object | Group_Policy_processing_has_been_aborted__in_planning_mode__because_the_user_computer_does_not_have_access_to_a_required_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_was_aborted_because_a_security_check_failed_5_Rule](/images/Rule.png) | Group Policy processing was aborted because a security check failed | Group_Policy_processing_was_aborted_because_a_security_check_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_was_aborted_because_historical_data_cannot_be_moved_from_the_users_old_SID_to_their_new_one_5_Rule](/images/Rule.png) | Group Policy processing was aborted because historical data cannot be moved from the users old SID to their new one | Group_Policy_processing_was_aborted_because_historical_data_cannot_be_moved_from_the_users_old_SID_to_their_new_one_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_was_aborted_because_security_cannot_be_set_on_Group_Policy_events_5_Rule](/images/Rule.png) | Group Policy processing was aborted because security cannot be set on Group Policy events | Group_Policy_processing_was_aborted_because_security_cannot_be_set_on_Group_Policy_events_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_was_aborted_because_the_refresh_timer_cannot_be_set_5_Rule](/images/Rule.png) | Group Policy processing was aborted because the refresh timer cannot be set | Group_Policy_processing_was_aborted_because_the_refresh_timer_cannot_be_set_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_was_aborted_because_the_search_for_objects_cannot_be_completed_5_Rule](/images/Rule.png) | Group Policy processing was aborted because the search for objects cannot be completed | Group_Policy_processing_was_aborted_because_the_search_for_objects_cannot_be_completed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_was_aborted_because_the_security_ID_of_the_user_cannot_be_obtained_5_Rule](/images/Rule.png) | Group Policy processing was aborted because the security ID of the user cannot be obtained | Group_Policy_processing_was_aborted_because_the_security_ID_of_the_user_cannot_be_obtained_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Policy_processing_was_aborted_because_the_users_security_ID_cannot_be_written_to_the_registry_5_Rule](/images/Rule.png) | Group Policy processing was aborted because the users security ID cannot be written to the registry | Group_Policy_processing_was_aborted_because_the_users_security_ID_cannot_be_written_to_the_registry_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Group_Refresh_updates_are_falling_behind_5_Rule](/images/Rule.png) | Group Refresh updates are falling behind | Group_Refresh_updates_are_falling_behind_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Initial_replication_after_domain_controller_promotion_has_not_completed](/images/Rule.png) | Initial replication after domain controller promotion has not completed | Initial_replication_after_domain_controller_promotion_has_not_completed | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Internal_async_schema_cache_update_failed_5_Rule](/images/Rule.png) | Internal async schema cache update failed | Internal_async_schema_cache_update_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Intersite_Messaging_Service_SMTP_Transport_received_a_delivery_failure_5_Rule](/images/Rule.png) | Intersite Messaging Service SMTP Transport received a delivery failure | Intersite_Messaging_Service_SMTP_Transport_received_a_delivery_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_add_SMTP_routing_domain_5_Rule](/images/Rule.png) | Inter-Site Messaging Service SMTP Transport plug-in failed to add SMTP routing domain | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_add_SMTP_routing_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_bind_the_event_sink_ismsink.dll_to_the_SMTP_Service_5_Rule](/images/Rule.png) | Inter-Site Messaging Service SMTP Transport plug-in failed to bind the event sink ismsink.dll to the SMTP Service | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_bind_the_event_sink_ismsink.dll_to_the_SMTP_Service_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_read_the_SMTP_mail_message_5_Rule](/images/Rule.png) | Inter-Site Messaging Service SMTP Transport plug-in failed to read the SMTP mail message | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_read_the_SMTP_mail_message_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_register_the_event_sink_ismsink.dll_5_Rule](/images/Rule.png) | Inter-Site Messaging Service SMTP Transport plug-in failed to register the event sink ismsink.dll | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_register_the_event_sink_ismsink.dll_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Inter_Site_Messaging__ISM__Service_SMTP_Transport_plug_in_has_determined_that_one_or_more_classes_from_CDO_library_are_not_registered_as_expected_5_Rule](/images/Rule.png) | Inter-Site Messaging (ISM) Service SMTP Transport plug-in has determined that one or more classes from CDO library are not registered as expected | Inter_Site_Messaging__ISM__Service_SMTP_Transport_plug_in_has_determined_that_one_or_more_classes_from_CDO_library_are_not_registered_as_expected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Inter_Site_Messaging__ISM__Service_SMTP_Transport_plug_in_has_encountered_an_unexpected_error_from_CDO_library_5_Rule](/images/Rule.png) | Inter-Site Messaging (ISM) Service SMTP Transport plug-in has encountered an unexpected error from CDO library | Inter_Site_Messaging__ISM__Service_SMTP_Transport_plug_in_has_encountered_an_unexpected_error_from_CDO_library_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Invalid_Forwarded_AS_Request_5_Rule](/images/Rule.png) | Invalid Forwarded AS Request | Invalid_Forwarded_AS_Request_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Invalid_object_class_5_Rule](/images/Rule.png) | Invalid object class | Invalid_object_class_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Invalid_Policy_Data_5_Rule](/images/Rule.png) | Invalid Policy Data | Invalid_Policy_Data_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Invalid_Script_Parameter_Configuration](/images/Rule.png) | Invalid Script Parameter Configuration | Invalid_Script_Parameter_Configuration | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Invalid_site_link_definition_will_be_ignored_5_Rule](/images/Rule.png) | Invalid site link definition will be ignored | Invalid_site_link_definition_will_be_ignored_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![ISM_cannot_receive_messages_5_Rule](/images/Rule.png) | ISM cannot receive messages | ISM_cannot_receive_messages_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![ISM_Request_Failure_5_Rule](/images/Rule.png) | ISM Request Failure | ISM_Request_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![ISM_transport_has_been_shut_down_5_Rule](/images/Rule.png) | ISM transport has been shut down | ISM_transport_has_been_shut_down_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![KCC_cannot_compute_a_replication_path_5_Rule](/images/Rule.png) | KCC cannot compute a replication path | KCC_cannot_compute_a_replication_path_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![KCC_cannot_configure_replication_topology_due_to_ISM_failure_5_Rule](/images/Rule.png) | KCC cannot configure replication topology due to ISM failure | KCC_cannot_configure_replication_topology_due_to_ISM_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![KCC_failed_to_initialize_5_Rule](/images/Rule.png) | KCC failed to initialize | KCC_failed_to_initialize_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![KCC_failed_to_stop_5_Rule](/images/Rule.png) | KCC failed to stop | KCC_failed_to_stop_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![KCC_failed_to_update_replication_topology_5_Rule](/images/Rule.png) | KCC failed to update replication topology | KCC_failed_to_update_replication_topology_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![KCC_is_ignoring_a_replication_path_because_non_intersecting_schedules_are_preventing_replication_along_that_path_5_Rule](/images/Rule.png) | KCC is ignoring a replication path because non-intersecting schedules are preventing replication along that path | KCC_is_ignoring_a_replication_path_because_non_intersecting_schedules_are_preventing_replication_along_that_path_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![LDAP_agent_cannot_open_security_provider_5_Rule](/images/Rule.png) | LDAP agent cannot open security provider | LDAP_agent_cannot_open_security_provider_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Local_cleanup_failed_on_cross_domain_move_5_Rule](/images/Rule.png) | Local cleanup failed on cross domain move | Local_cleanup_failed_on_cross_domain_move_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Local_group_policy_is_disabled_5_Rule](/images/Rule.png) | Local group policy is disabled | Local_group_policy_is_disabled_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Loopback_processing_has_been_disabled_5_Rule](/images/Rule.png) | Loopback processing has been disabled | Loopback_processing_has_been_disabled_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Machine_Account_Authentication_Failure_1_Rule](/images/Rule.png) | [DEPRECATED] The AD Machine Account Authentication Failures Report has data available | Machine_Account_Authentication_Failure_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![Machine_account_policy_failure___Active_Directory_GPO_lookup_failure_5_Rule](/images/Rule.png) | Machine account policy failure - Active Directory GPO lookup failure | Machine_account_policy_failure___Active_Directory_GPO_lookup_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Machine_account_policy_failure___Security_Configuration_Engine_error_occurred_5_Rule](/images/Rule.png) | Machine account policy failure - Security Configuration Engine error occurred | Machine_account_policy_failure___Security_Configuration_Engine_error_occurred_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Manual_deregistration_of_some_DNS_records_is_required_5_Rule](/images/Rule.png) | Manual deregistration of some DNS records is required | Manual_deregistration_of_some_DNS_records_is_required_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Memory_Allocation_Error___the_system_may_be_overloaded_5_Rule](/images/Rule.png) | Memory Allocation Error - the system may be overloaded | Memory_Allocation_Error___the_system_may_be_overloaded_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Memory_cannot_be_allocated_5_Rule](/images/Rule.png) | Memory cannot be allocated | Memory_cannot_be_allocated_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Microsoft.Windows.Server.2008.AD.DomainController.AvailableBytes.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Memory Available Bytes | Microsoft.Windows.Server.2008.AD.DomainController.AvailableBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.CommittedBytes.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Memory Committed Bytes | Microsoft.Windows.Server.2008.AD.DomainController.CommittedBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.DRAInboundBytes.Collection](/images/Rule.png) | AD 2008 DC Performance Collection - Metric NTDS DRA Inbound Bytes Compressed (Between Sites, Before Compression)/sec | Microsoft.Windows.Server.2008.AD.DomainController.DRAInboundBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.DRAInboundBytesComp.Collection](/images/Rule.png) | AD 2008 DC Performance Collection - Metric NTDS DRA Inbound Bytes Compressed (Between Sites, After Compression)/sec | Microsoft.Windows.Server.2008.AD.DomainController.DRAInboundBytesComp.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.DRAInboundBytesNotComp.Collection](/images/Rule.png) | AD 2008 DC Performance Collection - Metric NTDS DRA Inbound Bytes Not Compressed (Within Site)/sec | Microsoft.Windows.Server.2008.AD.DomainController.DRAInboundBytesNotComp.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.DRAInboundBytesTotal.Collection](/images/Rule.png) | AD 2008 DC Performance Collection - Metric NTDS DRA Inbound Bytes Total/sec | Microsoft.Windows.Server.2008.AD.DomainController.DRAInboundBytesTotal.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.DRAIntersiteInBytes.Collection](/images/Rule.png) | AD 2008 DC Performance Collection - Metric NTDS DRA Inbound Bytes Compressed (Between Sites, After Compression)/sec | Microsoft.Windows.Server.2008.AD.DomainController.DRAIntersiteInBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.DRAIntersiteOutBytes.Collection](/images/Rule.png) | AD 2008 DC Performance Collection - Metric NTDS DRA Outbound Bytes Compressed (Between Sites, After Compression)/sec | Microsoft.Windows.Server.2008.AD.DomainController.DRAIntersiteOutBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.DRAOutboundBytesComp.Collection](/images/Rule.png) | AD 2008 DC Performance Collection - Metric NTDS DRA Outbound Bytes Compressed (Between Sites, Before Compression)/sec | Microsoft.Windows.Server.2008.AD.DomainController.DRAOutboundBytesComp.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.DRAOutboundBytesNotComp.Collection](/images/Rule.png) | AD 2008 DC Performance Collection - Metric NTDS DRA Outbound Bytes Not Compressed (Within Site)/sec | Microsoft.Windows.Server.2008.AD.DomainController.DRAOutboundBytesNotComp.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.DRAOutboundBytesTotal.Collection](/images/Rule.png) | AD 2008 DC Perfomance Collection - Metric NTDS DRA Outbound Bytes Total/Sec | Microsoft.Windows.Server.2008.AD.DomainController.DRAOutboundBytesTotal.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.DSSubSearch.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS DS Search sub-operations/sec | Microsoft.Windows.Server.2008.AD.DomainController.DSSubSearch.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.KDCASRequests.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS KDC AS Requests | Microsoft.Windows.Server.2008.AD.DomainController.KDCASRequests.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.KDCTGRequests.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS KDC TGS Requests | Microsoft.Windows.Server.2008.AD.DomainController.KDCTGRequests.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.KerberosAuth.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS Kerberos Authentications | Microsoft.Windows.Server.2008.AD.DomainController.KerberosAuth.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.LDAPClientSessions.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS LDAP Client Sessions | Microsoft.Windows.Server.2008.AD.DomainController.LDAPClientSessions.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.LDAPSearches.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS LDAP Searches/sec | Microsoft.Windows.Server.2008.AD.DomainController.LDAPSearches.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.LDAPUDPOperations.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS LDAP UDP operations/sec | Microsoft.Windows.Server.2008.AD.DomainController.LDAPUDPOperations.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.LDAPWrites.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS LDAP Writes/sec | Microsoft.Windows.Server.2008.AD.DomainController.LDAPWrites.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.LSASSHandleCount.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Process Handle Count of LSASS | Microsoft.Windows.Server.2008.AD.DomainController.LSASSHandleCount.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.LSASSPrivateBytes.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Process Private Bytes of LSASS | Microsoft.Windows.Server.2008.AD.DomainController.LSASSPrivateBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.LSASSTotalCPU.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Process \% Processor Time of LSASS | Microsoft.Windows.Server.2008.AD.DomainController.LSASSTotalCPU.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.NTLMAuthentications.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS NTLM Authentications | Microsoft.Windows.Server.2008.AD.DomainController.NTLMAuthentications.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.Paging.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Memory Pages/sec | Microsoft.Windows.Server.2008.AD.DomainController.Paging.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.ProcessorTime.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Process \% Processor _Total | Microsoft.Windows.Server.2008.AD.DomainController.ProcessorTime.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.ServerSessions.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Server - Server Sessions | Microsoft.Windows.Server.2008.AD.DomainController.ServerSessions.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.SystemUpTime.Collection](/images/Rule.png) | AD DC Performance Collection - Metric System - System Up Time | Microsoft.Windows.Server.2008.AD.DomainController.SystemUpTime.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.TCPv4Connections.Collection](/images/Rule.png) | AD DC Performance Collection - TCPv4 - Connections Established | Microsoft.Windows.Server.2008.AD.DomainController.TCPv4Connections.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2008.AD.DomainController.TCPv6Connections.Collection](/images/Rule.png) | AD DC Performance Collection - TCPv6 - Connections Established | Microsoft.Windows.Server.2008.AD.DomainController.TCPv6Connections.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | False |
![Miscellaneous_KDC_Errors_5_Rule](/images/Rule.png) | [DEPRECATED] Miscellaneous KDC Errors | Miscellaneous_KDC_Errors_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![Miscellaneous_NetLogon_Errors_1_Rule](/images/Rule.png) | [DEPRECATED] Miscellaneous NetLogon Errors | Miscellaneous_NetLogon_Errors_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![Miscellaneous_SAM_Errors_5_Rule](/images/Rule.png) | [DEPRECATED] Miscellaneous SAM Errors | Miscellaneous_SAM_Errors_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![Miscellaneous_UserEnv_Errors_5_Rule](/images/Rule.png) | [DEPRECATED] Miscellaneous Group Policy Errors | Miscellaneous_UserEnv_Errors_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![Missing_X.509_Domain_Controller_certificate_5_Rule](/images/Rule.png) | Missing X.509 Domain Controller certificate | Missing_X.509_Domain_Controller_certificate_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Name_conflict_detected_while_replicating_partition_5_Rule](/images/Rule.png) | Name conflict detected while replicating partition | Name_conflict_detected_while_replicating_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![None_of_the_preferred_bridgehead_servers_can_replicate_the_directory_partition_5_Rule](/images/Rule.png) | None of the preferred bridgehead servers can replicate the directory partition | None_of_the_preferred_bridgehead_servers_can_replicate_the_directory_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![No_changes_detected_in_the_list_of_GPOs_5_Rule](/images/Rule.png) | No changes detected in the list of GPOs | No_changes_detected_in_the_list_of_GPOs_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![No_input_provider_to_sync_time_5_Rule](/images/Rule.png) | No input provider to sync time | No_input_provider_to_sync_time_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![No_Key_to_Generate_Kerberos_Ticket_5_Rule](/images/Rule.png) | No Key to Generate Kerberos Ticket | No_Key_to_Generate_Kerberos_Ticket_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![No_suitable_domain_controller_is_available_for_authentication_in_this_domain_5_Rule](/images/Rule.png) | No suitable domain controller is available for authentication in this domain | No_suitable_domain_controller_is_available_for_authentication_in_this_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![One_or_more_domain_controllers_may_not_be_replicating_For_2000](/images/Rule.png) | One or more domain controllers may not be replicating | One_or_more_domain_controllers_may_not_be_replicating_For_2000 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
![One_or_more_domain_controllers_may_not_be_replicating_For_2003](/images/Rule.png) | One or more domain controllers may not be replicating | One_or_more_domain_controllers_may_not_be_replicating_For_2003 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
![One_or_more_domain_controllers_may_not_be_replicating_For_2008](/images/Rule.png) | One or more domain controllers may not be replicating | One_or_more_domain_controllers_may_not_be_replicating_For_2008 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | False |
![One_or_more_of_the_DC_Locator_DNS_records_are_not_registered_1_Rule](/images/Rule.png) | One or more of the DC Locator DNS records are not registered in the DNS database since the primary DNS server doesn't support the dynamic update of the DNS records | One_or_more_of_the_DC_Locator_DNS_records_are_not_registered_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![PAC_Verification_Failure_5_Rule](/images/Rule.png) | PAC Verification Failure | PAC_Verification_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Policy_Update_Failure_5_Rule](/images/Rule.png) | Policy Update Failure | Policy_Update_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Replication_error_5_Rule](/images/Rule.png) | Replication error | Replication_error_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Replication_has_been_aborted_5_Rule](/images/Rule.png) | Replication has been aborted | Replication_has_been_aborted_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Replication_has_been_stopped_with_a_source__5_Rule](/images/Rule.png) | Replication has been stopped with a source | Replication_has_been_stopped_with_a_source__5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Report_Collection___Machine_Account_Authentication_Failures_5_Rule](/images/Rule.png) | Report Collection - Machine Account Authentication Failures | Report_Collection___Machine_Account_Authentication_Failures_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Schedule_attribute_of_siteLink_object_is_invalid_5_Rule](/images/Rule.png) | Schedule attribute of siteLink object is invalid | Schedule_attribute_of_siteLink_object_is_invalid_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Schema_cache_load_failed_to_convert_the_string_default_SD_on_class_schema_object_5_Rule](/images/Rule.png) | Schema cache load failed to convert the string default SD on class-schema object | Schema_cache_load_failed_to_convert_the_string_default_SD_on_class_schema_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Schema_cache_load_failed_to_inherit_all_attributes_for_the_class_5_Rule](/images/Rule.png) | Schema cache load failed to inherit all attributes for the class | Schema_cache_load_failed_to_inherit_all_attributes_for_the_class_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Security_Descriptor_Propagator_has_been_terminated_with_error_5_Rule](/images/Rule.png) | Security Descriptor Propagator has been terminated with error | Security_Descriptor_Propagator_has_been_terminated_with_error_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Session_setup_failed_because_no_trust_account_exists___Script___AD_Validate_Server_Trust_Event_5_Rule](/images/Rule.png) | [DEPRECATED] Session setup failed because no trust account exists : Script - AD Validate Server Trust Event | Session_setup_failed_because_no_trust_account_exists___Script___AD_Validate_Server_Trust_Event_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![Setting_the_administrators_password_failed.__It_has_been_reset_to_blank._5_Rule](/images/Rule.png) | Setting the administrators password failed. It has been reset to blank. | Setting_the_administrators_password_failed.__It_has_been_reset_to_blank._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![Site_has_no_NTDS_Site_Settings_object_5_Rule](/images/Rule.png) | Site has no NTDS Site Settings object | Site_has_no_NTDS_Site_Settings_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Site_link_was_not_found_5_Rule](/images/Rule.png) | Site link was not found | Site_link_was_not_found_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![There_are_no_domain_based_Group_Policy_objects_for_this_user_computer._5_Rule](/images/Rule.png) | There are no domain-based Group Policy objects for this user/computer. | There_are_no_domain_based_Group_Policy_objects_for_this_user_computer._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_account_identifier_pool_for_this_domain_controller_cannot_be_updated_5_Rule](/images/Rule.png) | The account identifier pool for this domain controller cannot be updated | The_account_identifier_pool_for_this_domain_controller_cannot_be_updated_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Active_Directory_database_is_corrupt_5_Rule](/images/Rule.png) | The Active Directory database is corrupt | The_Active_Directory_database_is_corrupt_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_AD_replication_process_is_unable_to_continue_5_Rule](/images/Rule.png) | The AD replication process is unable to continue | The_AD_replication_process_is_unable_to_continue_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_attempt_to_change_the_directory_partition_name_to_a_name_that_is_not_conflicting_failed_5_Rule](/images/Rule.png) | The attempt to change the directory partition name to a name that is not conflicting failed | The_attempt_to_change_the_directory_partition_name_to_a_name_that_is_not_conflicting_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_attempt_to_discover_the_tombstone_lifetime_from_the_domain_failed_5_Rule](/images/Rule.png) | The attempt to discover the tombstone lifetime from the domain failed | The_attempt_to_discover_the_tombstone_lifetime_from_the_domain_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_attempt_to_move_a_child_object_to_a_container_failed_5_Rule](/images/Rule.png) | The attempt to move a child object to a container failed | The_attempt_to_move_a_child_object_to_a_container_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_behavior_version_of_the_dsa_object_is_higher_than_the_behavior_version_of_this_OS_5_Rule](/images/Rule.png) | The behavior version of the dsa object is higher than the behavior version of this OS | The_behavior_version_of_the_dsa_object_is_higher_than_the_behavior_version_of_this_OS_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_computer_cannot_function_properly_for_authentication_purposes_5_Rule](/images/Rule.png) | The computer cannot function properly for authentication purposes | The_computer_cannot_function_properly_for_authentication_purposes_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_computer_didnt_have_sufficient_rights_to_perform_the_secure_dynamic_update_1_Rule](/images/Rule.png) | The computer didn't have sufficient rights to perform the secure dynamic update | The_computer_didnt_have_sufficient_rights_to_perform_the_secure_dynamic_update_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_computer_name_cannot_be_mapped_to_an_object_in_Active_Directory___this_may_result_in_authentication_failures_5_Rule](/images/Rule.png) | The computer name cannot be mapped to an object in Active Directory - this may result in authentication failures | The_computer_name_cannot_be_mapped_to_an_object_in_Active_Directory___this_may_result_in_authentication_failures_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_computer_s_domain__1_is_unavailable.___2_.__5_Rule](/images/Rule.png) | The computer's domain \%1 is unavailable. (\%2). | The_computer_s_domain__1_is_unavailable.___2_.__5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_connection_object_translation_task_in_the_consistency_checker_is__disabled_5_Rule](/images/Rule.png) | The connection object translation task in the consistency checker is disabled | The_connection_object_translation_task_in_the_consistency_checker_is__disabled_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_DC_was_unable_to_obtain_the_next_account_identifier_5_Rule](/images/Rule.png) | The DC was unable to obtain the next account-identifier | The_DC_was_unable_to_obtain_the_next_account_identifier_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_default_NTFS_security_settings_have_not_been_applied_to_Active_Directory_folders_5_Rule](/images/Rule.png) | [DEPRECATED] The default NTFS security settings have not been applied to Active Directory folders | The_default_NTFS_security_settings_have_not_been_applied_to_Active_Directory_folders_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![The_deleted_list_for_an_extension_cannot_be_obtained_5_Rule](/images/Rule.png) | The deleted list for an extension cannot be obtained | The_deleted_list_for_an_extension_cannot_be_obtained_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_directory_forest_behavior_version_and_or_domain_behavior_version_are_changed_to_values_incompatible_with_this_version_of_Windows_5_Rule](/images/Rule.png) | The directory forest behavior version and/or domain behavior version are changed to values incompatible with this version of Windows | The_directory_forest_behavior_version_and_or_domain_behavior_version_are_changed_to_values_incompatible_with_this_version_of_Windows_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_directory_partition_cannot_be_replicated_over_a_specified_transport_because_none_of_the_domain_controllers_support_the_transport_5_Rule](/images/Rule.png) | The directory partition cannot be replicated over a specified transport because none of the domain controllers support the transport | The_directory_partition_cannot_be_replicated_over_a_specified_transport_because_none_of_the_domain_controllers_support_the_transport_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_DNS_server_with_which_this_DC_will_register_does_not_support_1_Rule](/images/Rule.png) | The DNS server with which this DC will register does not support the dynamic update protocol or the authoritative zone is not configured to allow dynamic updates | The_DNS_server_with_which_this_DC_will_register_does_not_support_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_domain_behavior_version_or_the_forest_behavior_version_is_incompatible_with_this_version_of_Windows_5_Rule](/images/Rule.png) | The domain behavior version or the forest behavior version is incompatible with this version of Windows | The_domain_behavior_version_or_the_forest_behavior_version_is_incompatible_with_this_version_of_Windows_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Domain_Changes_report_Create_Only_Rule](/images/Rule.png) | Create Domain Changes report | The_Domain_Changes_report_Create_Only_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | False |
![The_Domain_Changes_report_has_data_available_5_Rule](/images/Rule.png) | Create Domain Changes Report and Alert | The_Domain_Changes_report_has_data_available_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_domain_controller_failed_to_obtain_a_new_account_identifier_pool_5_Rule](/images/Rule.png) | The domain controller failed to obtain a new account identifier pool | The_domain_controller_failed_to_obtain_a_new_account_identifier_pool_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Domain_Controller_has_been_started_5_Rule](/images/Rule.png) | The Domain Controller has been started | The_Domain_Controller_has_been_started_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Domain_Controller_has_been_stopped_5_Rule](/images/Rule.png) | The Domain Controller has been stopped | The_Domain_Controller_has_been_stopped_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Domain_Controller_has_shutdown_unexpectedly_5_Rule](/images/Rule.png) | The Domain Controller has shutdown unexpectedly | The_Domain_Controller_has_shutdown_unexpectedly_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_domain_controller_is_booting_to_directory_services_restore_mode_5_Rule](/images/Rule.png) | The domain controller is booting to directory services restore mode | The_domain_controller_is_booting_to_directory_services_restore_mode_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_DS_Service_Configuration_object_is_not_found.__You_will_not_be_able_to_set_service_parameters._5_Rule](/images/Rule.png) | The DS Service Configuration object is not found. You will not be able to set service parameters. | The_DS_Service_Configuration_object_is_not_found.__You_will_not_be_able_to_set_service_parameters._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_GPO_cannot_be_processed_because_it_was_created_by_an_old_version_of_the_GPO_editor_5_Rule](/images/Rule.png) | The GPO cannot be processed because it was created by an old version of the GPO editor | The_GPO_cannot_be_processed_because_it_was_created_by_an_old_version_of_the_GPO_editor_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_group_caching_option_has_now_been_properly_updated_5_Rule](/images/Rule.png) | The group caching option has now been properly updated | The_group_caching_option_has_now_been_properly_updated_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Group_Policy_client_side_extension_failed_to_execute_5_Rule](/images/Rule.png) | The Group Policy client side extension failed to execute | The_Group_Policy_client_side_extension_failed_to_execute_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Intersite_Messaging_service_failed_to_start_the_RPC_server_because_it_was_unable_to_register_authentication_information._5_Rule](/images/Rule.png) | The Intersite Messaging service failed to start the RPC server because it was unable to register authentication information. | The_Intersite_Messaging_service_failed_to_start_the_RPC_server_because_it_was_unable_to_register_authentication_information._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Inter_Site_Messaging_Service_cannot_allocate__memory_5_Rule](/images/Rule.png) | The Inter-Site Messaging Service cannot allocate memory | The_Inter_Site_Messaging_Service_cannot_allocate__memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Inter_Site_Messaging_Service_cannot_perform_a_requested_LDAP_bind_operation_5_Rule](/images/Rule.png) | The Inter-Site Messaging Service cannot perform a requested LDAP bind operation | The_Inter_Site_Messaging_Service_cannot_perform_a_requested_LDAP_bind_operation_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Inter_Site_Messaging_Service_encountered_an_error_while__attempting_to_start_the_Service_Control_Dispatcher_5_Rule](/images/Rule.png) | The Inter-Site Messaging Service encountered an error while attempting to start the Service Control Dispatcher | The_Inter_Site_Messaging_Service_encountered_an_error_while__attempting_to_start_the_Service_Control_Dispatcher_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Inter_Site_Messaging_Service_encountered_a_malformed__transport_distinguished_name_5_Rule](/images/Rule.png) | The Inter-Site Messaging Service encountered a malformed transport distinguished name | The_Inter_Site_Messaging_Service_encountered_a_malformed__transport_distinguished_name_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Inter_Site_Messaging_Service_failed_to_create_an_event_5_Rule](/images/Rule.png) | The Inter-Site Messaging Service failed to create an event | The_Inter_Site_Messaging_Service_failed_to_create_an_event_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Inter_Site_Messaging_Service_failed_to_initialize_5_Rule](/images/Rule.png) | The Inter-Site Messaging Service failed to initialize | The_Inter_Site_Messaging_Service_failed_to_initialize_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Inter_Site_Messaging_Service_failed_to_start_5_Rule](/images/Rule.png) | The Inter-Site Messaging Service failed to start | The_Inter_Site_Messaging_Service_failed_to_start_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Inter_Site_Messaging_Service_failed_to_start_the_RPC_server_5_Rule](/images/Rule.png) | The Inter-Site Messaging Service failed to start the RPC server | The_Inter_Site_Messaging_Service_failed_to_start_the_RPC_server_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Inter_Site_Messaging_Service_failed_to_wait_for_a_message_5_Rule](/images/Rule.png) | The Inter-Site Messaging Service failed to wait for a message | The_Inter_Site_Messaging_Service_failed_to_wait_for_a_message_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Inter_Site_Messaging_Service_requested_to_abandon_an_LDAP_notification_message_5_Rule](/images/Rule.png) | The Inter-Site Messaging Service requested to abandon an LDAP notification message | The_Inter_Site_Messaging_Service_requested_to_abandon_an_LDAP_notification_message_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_remove__SMTP_routing_domain_5_Rule](/images/Rule.png) | The Inter-Site Messaging Service SMTP Transport plug-in failed to remove SMTP routing domain | The_Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_remove__SMTP_routing_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Knowledge_Consistency_Checker__KCC__cannot_run_successfully.__Replication_may_be_affected_5_Rule](/images/Rule.png) | The Knowledge Consistency Checker (KCC) cannot run successfully. Replication may be affected | The_Knowledge_Consistency_Checker__KCC__cannot_run_successfully.__Replication_may_be_affected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_Knowledge_Consistency_Checker__KCC__detected_an_incompatible_up_to_dateness_vector_format_5_Rule](/images/Rule.png) | The Knowledge Consistency Checker (KCC) detected an incompatible up-to-dateness vector format | The_Knowledge_Consistency_Checker__KCC__detected_an_incompatible_up_to_dateness_vector_format_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_list_of_GPOs_for_this_user_or_computer_has_changed_5_Rule](/images/Rule.png) | The list of GPOs for this user or computer has changed | The_list_of_GPOs_for_this_user_or_computer_has_changed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_local_domain_controller_has_attempted_to_replicate_an_object_which_is_not_present_because_it_may_have_been_deleted_and_already_garbage_collected_5_Rule](/images/Rule.png) | The local domain controller has attempted to replicate an object which is not present because it may have been deleted and already garbage collected | The_local_domain_controller_has_attempted_to_replicate_an_object_which_is_not_present_because_it_may_have_been_deleted_and_already_garbage_collected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_local_domain_controller_has_denied_a_replication_attempt_on_a_directory_partition.__This_may_pose_a_security_risk_5_Rule](/images/Rule.png) | The local domain controller has denied a replication attempt on a directory partition. This may pose a security risk | The_local_domain_controller_has_denied_a_replication_attempt_on_a_directory_partition.__This_may_pose_a_security_risk_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_machine_account_cannot_be_found_5_Rule](/images/Rule.png) | The machine account cannot be found | The_machine_account_cannot_be_found_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_NetLogon_service_on_remote_machines_will_not_be_able_to_connect_to_this_DC_over_TCP_IP_resulting_in_authentication_failure_5_Rule](/images/Rule.png) | The NetLogon service on remote machines will not be able to connect to this DC over TCP/IP resulting in authentication failure | The_NetLogon_service_on_remote_machines_will_not_be_able_to_connect_to_this_DC_over_TCP_IP_resulting_in_authentication_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_non_domain_naming_context_has_no_security_descriptor_reference_domain_5_Rule](/images/Rule.png) | The non-domain naming context has no security descriptor reference domain | The_non_domain_naming_context_has_no_security_descriptor_reference_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_number_of_Group_Policies_has_exceeded_the_maximum_limit_5_Rule](/images/Rule.png) | The number of Group Policies has exceeded the maximum limit | The_number_of_Group_Policies_has_exceeded_the_maximum_limit_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_object_does_not_exist_in_Active_Directory_5_Rule](/images/Rule.png) | The object does not exist in Active Directory | The_object_does_not_exist_in_Active_Directory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_registry_key_cannot_be_created_5_Rule](/images/Rule.png) | The registry key cannot be created | The_registry_key_cannot_be_created_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_registry_policy_file_could_not_be_accessed_during_application_of_machine_policy_5_Rule](/images/Rule.png) | The registry policy file could not be accessed during application of machine policy | The_registry_policy_file_could_not_be_accessed_during_application_of_machine_policy_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_registry_value_cannot_be_set_5_Rule](/images/Rule.png) | The registry value cannot be set | The_registry_value_cannot_be_set_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_script_cannot_locate_the_server_or_its_site_in_Active_Directory](/images/Rule.png) | The script cannot locate the server or its site in Active Directory | The_script_cannot_locate_the_server_or_its_site_in_Active_Directory | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_search_for_objects_in_the_schema_directory_partition_failed_5_Rule](/images/Rule.png) | The search for objects in the schema directory partition failed | The_search_for_objects_in_the_schema_directory_partition_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_security_descriptor_propagation_task_encountered_an_error_5_Rule](/images/Rule.png) | The security descriptor propagation task encountered an error | The_security_descriptor_propagation_task_encountered_an_error_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_server_has_moved_between_sites](/images/Rule.png) | The server has moved between sites | The_server_has_moved_between_sites | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | False |
![The_Services_container_has_more_than_one_object_of_class_msExchConfigurationContainer_as_an_immediate_child_5_Rule](/images/Rule.png) | The Services container has more than one object of class msExchConfigurationContainer as an immediate child | The_Services_container_has_more_than_one_object_of_class_msExchConfigurationContainer_as_an_immediate_child_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_site_cannot_be_found_5_Rule](/images/Rule.png) | The site cannot be found | The_site_cannot_be_found_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_site_contains_one_or_more_domain_controllers_but_is_not_connected_by_any_site_links_5_Rule](/images/Rule.png) | The site contains one or more domain controllers, but is not connected by any site links | The_site_contains_one_or_more_domain_controllers_but_is_not_connected_by_any_site_links_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_site_name_cannot_be_queried_for_5_Rule](/images/Rule.png) | The site name cannot be queried for | The_site_name_cannot_be_queried_for_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_SMTP_domain_administrative_namespace_is_not_available_at_this_time_5_Rule](/images/Rule.png) | The SMTP domain administrative namespace is not available at this time | The_SMTP_domain_administrative_namespace_is_not_available_at_this_time_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_system_clock_has_not_been_synchronized_for_some_time_5_Rule](/images/Rule.png) | The system clock has not been synchronized for some time | The_system_clock_has_not_been_synchronized_for_some_time_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_system_failed_to_promote_this_server_into_a_Global_Catalog_5_Rule](/images/Rule.png) | The system failed to promote this server into a Global Catalog | The_system_failed_to_promote_this_server_into_a_Global_Catalog_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_task_that_monitors_Active_Directory_for_changes_in_the_Inter_Site_Transport_objects_failed_to_start_5_Rule](/images/Rule.png) | The task that monitors Active Directory for changes in the Inter-Site Transport objects failed to start | The_task_that_monitors_Active_Directory_for_changes_in_the_Inter_Site_Transport_objects_failed_to_start_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_user_or_computer_does_not_have_access_to_a_GPO_5_Rule](/images/Rule.png) | The user or computer does not have access to a GPO | The_user_or_computer_does_not_have_access_to_a_GPO_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_user_or_computer_does_not_pass_the_filter_check_to_the_GPO_5_Rule](/images/Rule.png) | The user or computer does not pass the filter check to the GPO | The_user_or_computer_does_not_pass_the_filter_check_to_the_GPO_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![The_WMI_service_is_disabled.__A_Group_Policy_object_has_not_been_processed_5_Rule](/images/Rule.png) | The WMI service is disabled. A Group Policy object has not been processed | The_WMI_service_is_disabled.__A_Group_Policy_object_has_not_been_processed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![This_domain_controller_failed_to_register_as__and_will_not_advertise_as__a_global_catalog_5_Rule](/images/Rule.png) | This domain controller failed to register as (and will not advertise as) a global catalog | This_domain_controller_failed_to_register_as__and_will_not_advertise_as__a_global_catalog_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![This_domain_controller_has_been_promoted_to_PDC_5_Rule](/images/Rule.png) | This domain controller has been promoted to PDC | This_domain_controller_has_been_promoted_to_PDC_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![This_domain_controller_will_not_start_up_because_its_machine_account_has_been_deleted_5_Rule](/images/Rule.png) | This domain controller will not start up because its machine account has been deleted | This_domain_controller_will_not_start_up_because_its_machine_account_has_been_deleted_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![This_server_cannot_process_the_replication_request_5_Rule](/images/Rule.png) | This server cannot process the replication request | This_server_cannot_process_the_replication_request_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![This_server_is_no_longer_a_domain_controller_5_Rule](/images/Rule.png) | This server is no longer a domain controller | This_server_is_no_longer_a_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![This_source_server_failed_to_add_schema_information_for_the_mail_replication_request_5_Rule](/images/Rule.png) | This source server failed to add schema information for the mail replication request | This_source_server_failed_to_add_schema_information_for_the_mail_replication_request_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![This_source_server_failed_to_generate_the_changes_5_Rule](/images/Rule.png) | This source server failed to generate the changes | This_source_server_failed_to_generate_the_changes_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Thread_in_directory_is_waiting_for_remote_procedure_call_5_Rule](/images/Rule.png) | [DEPRECATED] Thread in directory is waiting for remote procedure call | Thread_in_directory_is_waiting_for_remote_procedure_call_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![Transport_initialization_failure_5_Rule](/images/Rule.png) | Transport initialization failure | Transport_initialization_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Trusted_Domain_List_Update_Failure_5_Rule](/images/Rule.png) | Trusted Domain List Update Failure | Trusted_Domain_List_Update_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Two_replication_partners_have_an_inconsistent_view_of_the_FSMO_role_holders](/images/Rule.png) | [DEPRECATED] Two replication partners have an inconsistent view of the FSMO role holders | Two_replication_partners_have_an_inconsistent_view_of_the_FSMO_role_holders | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | True |
![Unable_to_establish_connection_with_any_Global_Catalog_s__5_Rule](/images/Rule.png) | Unable to establish connection with any Global Catalog(s) | Unable_to_establish_connection_with_any_Global_Catalog_s__5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Unable_to_establish_connection_with_server_5_Rule](/images/Rule.png) | Unable to establish connection with server | Unable_to_establish_connection_with_server_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Unable_to_open_performance_counters_5_Rule](/images/Rule.png) | Unable to open performance counters | Unable_to_open_performance_counters_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Unable_to_set_privileges_necessary_for_security_checks_5_Rule](/images/Rule.png) | Unable to set privileges necessary for security checks | Unable_to_set_privileges_necessary_for_security_checks_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Unexpected_Error_applying_group_policy_to_machine_account_5_Rule](/images/Rule.png) | Unexpected Error applying group policy to machine account | Unexpected_Error_applying_group_policy_to_machine_account_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Unexpected_SAM_Failure_5_Rule](/images/Rule.png) | Unexpected SAM Failure | Unexpected_SAM_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Windows_cannot_access_information_in_the_registry_5_Rule](/images/Rule.png) | Windows cannot access information in the registry | Windows_cannot_access_information_in_the_registry_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Windows_cannot_determine_the_role_of_this_computer._5_Rule](/images/Rule.png) | Windows cannot determine the role of this computer. | Windows_cannot_determine_the_role_of_this_computer._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Windows_cannot_determine_the_user_or_computer_name._5_Rule](/images/Rule.png) | Windows cannot determine the user or computer name. | Windows_cannot_determine_the_user_or_computer_name._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Windows_cannot_load_extension_5_Rule](/images/Rule.png) | Windows cannot load extension | Windows_cannot_load_extension_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Windows_cannot_obtain_the_domain_controller_name_for_your_computer_network._5_Rule](/images/Rule.png) | Windows cannot obtain the domain controller name for your computer network. | Windows_cannot_obtain_the_domain_controller_name_for_your_computer_network._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Windows_cannot_read_the_history_of_GPOs_from_the_registry._5_Rule](/images/Rule.png) | Windows cannot read the history of GPOs from the registry. | Windows_cannot_read_the_history_of_GPOs_from_the_registry._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Windows_Directory_Service__Active_Directory__cannot_be_initialized_5_Rule](/images/Rule.png) | Windows Directory Service (Active Directory) cannot be initialized | Windows_Directory_Service__Active_Directory__cannot_be_initialized_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Windows_Directory_Service__Active_Directory__exception_5_Rule](/images/Rule.png) | Windows Directory Service (Active Directory) exception | Windows_Directory_Service__Active_Directory__exception_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![Windows_is_setting_a_registry_value_5_Rule](/images/Rule.png) | Windows is setting a registry value | Windows_is_setting_a_registry_value_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |
![WMI_Replication_Provider_is_not_installed_Replication_cannot_be_monitored_fully](/images/Rule.png) | WMI Replication Provider is not installed Replication cannot be monitored fully | WMI_Replication_Provider_is_not_installed_Replication_cannot_be_monitored_fully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | True |