| DisplayName | ID | Target | Category | Enabled | Alert Generate |
![Accounts_with_the_same_SID_have_been_detected___one_has_been_deleted_5_Rule](/images/Rule.png) | Accounts with the same SID have been detected - one has been deleted | Accounts_with_the_same_SID_have_been_detected___one_has_been_deleted_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Account_Changes_Report_Creation_Only_Rule](/images/Rule.png) | Create Account Changes Report | Account_Changes_Report_Creation_Only_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | False | False |
![Account_creation_will_fail_on_this_domain_controller_until_the_account_identifier_pool_is_obtained_5_Rule](/images/Rule.png) | Account creation will fail on this domain controller until the account identifier pool is obtained | Account_creation_will_fail_on_this_domain_controller_until_the_account_identifier_pool_is_obtained_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Account_Name_Not_Unique_5_Rule](/images/Rule.png) | Account Name Not Unique | Account_Name_Not_Unique_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | False | False |
![AD_MOM_Agent_Proxy_is_not_enabled](/images/Rule.png) | Agent Proxy not enabled | AD_MOM_Agent_Proxy_is_not_enabled | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | True |
![An_account_cannot_be_added_to_the_group_5_Rule](/images/Rule.png) | An account cannot be added to the group | An_account_cannot_be_added_to_the_group_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![An_account_name_collision_occurred___this_may_result_in_authentication_failures_5_Rule](/images/Rule.png) | An account name collision occurred - this may result in authentication failures | An_account_name_collision_occurred___this_may_result_in_authentication_failures_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![An_attempt_to_check_whether_group_caching_is_enabled_has_failed_5_Rule](/images/Rule.png) | An attempt to check whether group caching is enabled has failed | An_attempt_to_check_whether_group_caching_is_enabled_has_failed_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![An_attempt_to_set_the_time_was_aborted_due_to_the_offset_being_too_large_5_Rule](/images/Rule.png) | An attempt to set the time was aborted due to the offset being too large | An_attempt_to_set_the_time_was_aborted_due_to_the_offset_being_too_large_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![An_attempt_to_update_user_credentials_failed_5_Rule](/images/Rule.png) | An attempt to update user credentials failed | An_attempt_to_update_user_credentials_failed_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![A_dll_cannot_be_loaded_because_the_software_was_incorrectly_installed_5_Rule](/images/Rule.png) | A dll cannot be loaded because the software was incorrectly installed | A_dll_cannot_be_loaded_because_the_software_was_incorrectly_installed_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![A_DNS_server_used_by_this_server_for_name_resolution_did_not_respond_1_Rule](/images/Rule.png) | A DNS server used by this server for name resolution did not respond within the timeout interval | A_DNS_server_used_by_this_server_for_name_resolution_did_not_respond_1_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![A_resource_record_for_the_computer_name_of_the_DC_is_not_registered_1_Rule](/images/Rule.png) | A resource record for the computer name of the DC is not registered in the DNS database | A_resource_record_for_the_computer_name_of_the_DC_is_not_registered_1_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![A_RSoP__Resultant_Set_of_Policies__error_occurred_5_Rule](/images/Rule.png) | A RSoP (Resultant Set of Policies) error occurred | A_RSoP__Resultant_Set_of_Policies__error_occurred_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![A_user_from_a_different_forest_logged_onto_this_machine._Group_policy_processing_has_been_effected._5_Rule](/images/Rule.png) | A user from a different forest logged onto this machine. Group policy processing has been effected. | A_user_from_a_different_forest_logged_onto_this_machine._Group_policy_processing_has_been_effected._5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![A_well_known_account_has_been_recreated_because_it_did_not_exist_5_Rule](/images/Rule.png) | A well known account has been recreated because it did not exist | A_well_known_account_has_been_recreated_because_it_did_not_exist_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![A_well_known_group_has_been_recreated_because_it_did_not_exist_5_Rule](/images/Rule.png) | A well known group has been recreated because it did not exist | A_well_known_group_has_been_recreated_because_it_did_not_exist_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Change_Password_on_KRBTGT_Account_Failed_5_Rule](/images/Rule.png) | Change Password on KRBTGT Account Failed | Change_Password_on_KRBTGT_Account_Failed_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Collection_Rule_for_No_DC_GC_in_Site_events_5_Rule](/images/Rule.png) | Collection Rule for No DC/GC in Site events | Collection_Rule_for_No_DC_GC_in_Site_events_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Corrupt_Credentials_5_Rule](/images/Rule.png) | Corrupt Credentials | Corrupt_Credentials_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Domain_Operation_Mode_has_been_changed_to_Native_Mode_5_Rule](/images/Rule.png) | Domain Operation Mode has been changed to Native Mode | Domain_Operation_Mode_has_been_changed_to_Native_Mode_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Duplicate_account_names_were_detected___one_account_has_been_renamed_5_Rule](/images/Rule.png) | Duplicate account names were detected - one account has been renamed | Duplicate_account_names_were_detected___one_account_has_been_renamed_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Duplicate_User_Principal_Names_have_been_detected_5_Rule](/images/Rule.png) | Duplicate User Principal Names have been detected | Duplicate_User_Principal_Names_have_been_detected_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Group_policy_processing_aborted___cannot_determine_site_5_Rule](/images/Rule.png) | Group policy processing aborted - cannot determine site | Group_policy_processing_aborted___cannot_determine_site_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Invalid_Forwarded_AS_Request_5_Rule](/images/Rule.png) | Invalid Forwarded AS Request | Invalid_Forwarded_AS_Request_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Invalid_Policy_Data_5_Rule](/images/Rule.png) | Invalid Policy Data | Invalid_Policy_Data_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Machine_account_policy_failure___Active_Directory_GPO_lookup_failure_5_Rule](/images/Rule.png) | Machine account policy failure - Active Directory GPO lookup failure | Machine_account_policy_failure___Active_Directory_GPO_lookup_failure_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Machine_account_policy_failure___Security_Configuration_Engine_error_occurred_5_Rule](/images/Rule.png) | Machine account policy failure - Security Configuration Engine error occurred | Machine_account_policy_failure___Security_Configuration_Engine_error_occurred_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Memory_Allocation_Error___the_system_may_be_overloaded_5_Rule](/images/Rule.png) | Memory Allocation Error - the system may be overloaded | Memory_Allocation_Error___the_system_may_be_overloaded_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Microsoft.Windows.Server.2012.AD.ActiveDirectoryWebServices.Error.EventCollection](/images/Rule.png) | Active Directory Web Services Error Events | Microsoft.Windows.Server.2012.AD.ActiveDirectoryWebServices.Error.EventCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Microsoft.Windows.Server.2012.AD.ActiveDirectoryWebServices.Information.EventCollection](/images/Rule.png) | Active Directory Web Services Information Events | Microsoft.Windows.Server.2012.AD.ActiveDirectoryWebServices.Information.EventCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | False | False |
![Microsoft.Windows.Server.2012.AD.ActiveDirectoryWebServices.Warning.EventCollection](/images/Rule.png) | Active Directory Web Services Warning Events | Microsoft.Windows.Server.2012.AD.ActiveDirectoryWebServices.Warning.EventCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Availability.DiskSpace.DIT.PerformanceCollection](/images/Rule.png) | Free Disk Space Database Drive Collection | Microsoft.Windows.Server.2012.AD.Availability.DiskSpace.DIT.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Availability.DiskSpace.Log.PerformanceCollection](/images/Rule.png) | Free Disk Space Log Drive Collection | Microsoft.Windows.Server.2012.AD.Availability.DiskSpace.Log.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Availability.Size.DIT.PerformanceCollection](/images/Rule.png) | AD Database Size Collection | Microsoft.Windows.Server.2012.AD.Availability.Size.DIT.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DFSReplication.Error.EventCollection](/images/Rule.png) | AD DC DFS Replication Error Events | Microsoft.Windows.Server.2012.AD.DFSReplication.Error.EventCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DFSReplication.Information.EventCollection](/images/Rule.png) | AD DC DFS Replication Information Events | Microsoft.Windows.Server.2012.AD.DFSReplication.Information.EventCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | False | False |
![Microsoft.Windows.Server.2012.AD.DFSReplication.Warning.EventCollection](/images/Rule.png) | AD DC DFS Replication Warning Events | Microsoft.Windows.Server.2012.AD.DFSReplication.Warning.EventCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DirectoryService.Error.EventCollection](/images/Rule.png) | AD DC Directory Services Error Events | Microsoft.Windows.Server.2012.AD.DirectoryService.Error.EventCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DirectoryService.Information.EventCollection](/images/Rule.png) | AD DC Directory Services Information Events | Microsoft.Windows.Server.2012.AD.DirectoryService.Information.EventCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | False | False |
![Microsoft.Windows.Server.2012.AD.DirectoryService.Warning.EventCollection](/images/Rule.png) | AD DC Directory Services Warning Events | Microsoft.Windows.Server.2012.AD.DirectoryService.Warning.EventCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DNSServer.Error.EventCollection](/images/Rule.png) | AD DC DNS Server Error Events | Microsoft.Windows.Server.2012.AD.DNSServer.Error.EventCollection | Microsoft.Windows.Server.2012.AD.DomainController.DNS | EventCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DNSServer.Information.EventCollection](/images/Rule.png) | AD DC DNS Server Information Events | Microsoft.Windows.Server.2012.AD.DNSServer.Information.EventCollection | Microsoft.Windows.Server.2012.AD.DomainController.DNS | EventCollection | False | False |
![Microsoft.Windows.Server.2012.AD.DNSServer.Warning.EventCollection](/images/Rule.png) | AD DC DNS Server Warning Events | Microsoft.Windows.Server.2012.AD.DNSServer.Warning.EventCollection | Microsoft.Windows.Server.2012.AD.DomainController.DNS | EventCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.Atq.OutstandingQueuedRequests.Collection](/images/Rule.png) | AD DC Performance Collection - ATQ Outstanding Queued Requests | Microsoft.Windows.Server.2012.AD.DomainController.Atq.OutstandingQueuedRequests.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.Atq.RequestLatency.Collection](/images/Rule.png) | AD DC Performance Collection - ATQ Request Latency | Microsoft.Windows.Server.2012.AD.DomainController.Atq.RequestLatency.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.Atq.ThreadsLdap.Collection](/images/Rule.png) | AD DC Performance Collection - ATQ Threads LDAP | Microsoft.Windows.Server.2012.AD.DomainController.Atq.ThreadsLdap.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.Atq.ThreadsOther.Collection](/images/Rule.png) | AD DC Performance Collection - ATQ Threads Other | Microsoft.Windows.Server.2012.AD.DomainController.Atq.ThreadsOther.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.Atq.ThreadsTotal.Collection](/images/Rule.png) | AD DC Performance Collection - ATQ Threads Total | Microsoft.Windows.Server.2012.AD.DomainController.Atq.ThreadsTotal.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.AvailableBytes.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Memory Available Bytes | Microsoft.Windows.Server.2012.AD.DomainController.AvailableBytes.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.CommittedBytes.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Memory Committed Bytes | Microsoft.Windows.Server.2012.AD.DomainController.CommittedBytes.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DNSPrivateBytes.Collection](/images/Rule.png) | AD DC Performance Collection - Metric DNS Private Bytes | Microsoft.Windows.Server.2012.AD.DomainController.DNSPrivateBytes.Collection | Microsoft.Windows.Server.2012.AD.DomainController.DNS | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DNSQueryReceived.Collection](/images/Rule.png) | AD DC Performance Collection - Metric DNS Queries Received/Sec | Microsoft.Windows.Server.2012.AD.DomainController.DNSQueryReceived.Collection | Microsoft.Windows.Server.2012.AD.DomainController.DNS | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DNSTotalCPU.Collection](/images/Rule.png) | AD DC Performance Collection - Metric DNS Total CPU | Microsoft.Windows.Server.2012.AD.DomainController.DNSTotalCPU.Collection | Microsoft.Windows.Server.2012.AD.DomainController.DNS | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DRAInboundBytes.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS DRA Inbound Bytes Compressed (Between Sites, Before Compression)/sec | Microsoft.Windows.Server.2012.AD.DomainController.DRAInboundBytes.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DRAInboundBytesComp.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS DRA Inbound Bytes Compressed (Between Sites, After Compression)/sec | Microsoft.Windows.Server.2012.AD.DomainController.DRAInboundBytesComp.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DRAInboundBytesNotComp.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS DRA Inbound Bytes Not Compressed (Within Site)/sec | Microsoft.Windows.Server.2012.AD.DomainController.DRAInboundBytesNotComp.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DRAInboundBytesTotal.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS DRA Inbound Bytes Total/sec | Microsoft.Windows.Server.2012.AD.DomainController.DRAInboundBytesTotal.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DRAIntersiteOutBytes.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS DRA Outbound Bytes Compressed (Between Sites, After Compression)/sec | Microsoft.Windows.Server.2012.AD.DomainController.DRAIntersiteOutBytes.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DRAOutboundBytesComp.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS DRA Outbound Bytes Compressed (Between Sites, Before Compression)/sec | Microsoft.Windows.Server.2012.AD.DomainController.DRAOutboundBytesComp.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DRAOutboundBytesNotComp.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS DRA Outbound Bytes Not Compressed (Within Site)/sec | Microsoft.Windows.Server.2012.AD.DomainController.DRAOutboundBytesNotComp.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DRAOutboundBytesTotal.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS DRA Outbound Bytes Total/Sec | Microsoft.Windows.Server.2012.AD.DomainController.DRAOutboundBytesTotal.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.DSSubSearch.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS DS Search sub-operations/sec | Microsoft.Windows.Server.2012.AD.DomainController.DSSubSearch.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.KDCASRequests.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS KDC AS Requests | Microsoft.Windows.Server.2012.AD.DomainController.KDCASRequests.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.KDCTGRequests.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS KDC TGS Requests | Microsoft.Windows.Server.2012.AD.DomainController.KDCTGRequests.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.KerberosAuth.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS Kerberos Authentications | Microsoft.Windows.Server.2012.AD.DomainController.KerberosAuth.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.LDAPClientSessions.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS LDAP Client Sessions | Microsoft.Windows.Server.2012.AD.DomainController.LDAPClientSessions.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.LDAPSearches.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS LDAP Searches/sec | Microsoft.Windows.Server.2012.AD.DomainController.LDAPSearches.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.LDAPUDPOperations.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS LDAP UDP operations/sec | Microsoft.Windows.Server.2012.AD.DomainController.LDAPUDPOperations.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.LDAPWrites.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS LDAP Writes/sec | Microsoft.Windows.Server.2012.AD.DomainController.LDAPWrites.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.LSASSHandleCount.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Process Handle Count of LSASS | Microsoft.Windows.Server.2012.AD.DomainController.LSASSHandleCount.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.LSASSPrivateBytes.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Process Private Bytes of LSASS | Microsoft.Windows.Server.2012.AD.DomainController.LSASSPrivateBytes.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.LSASSTotalCPU.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Process \% Processor Time of LSASS | Microsoft.Windows.Server.2012.AD.DomainController.LSASSTotalCPU.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.NTLMAuthentications.Collection](/images/Rule.png) | AD DC Performance Collection - Metric NTDS NTLM Authentications | Microsoft.Windows.Server.2012.AD.DomainController.NTLMAuthentications.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.Paging.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Memory Pages/sec | Microsoft.Windows.Server.2012.AD.DomainController.Paging.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.ProcessorTime.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Process \% Processor _Total | Microsoft.Windows.Server.2012.AD.DomainController.ProcessorTime.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.ServerSessions.Collection](/images/Rule.png) | AD DC Performance Collection - Metric Server - Server Sessions | Microsoft.Windows.Server.2012.AD.DomainController.ServerSessions.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.SystemUpTime.Collection](/images/Rule.png) | AD DC Performance Collection - Metric System - System Up Time | Microsoft.Windows.Server.2012.AD.DomainController.SystemUpTime.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.TCPv4Connections.Collection](/images/Rule.png) | AD DC Performance Collection - TCPv4 - Connections Established | Microsoft.Windows.Server.2012.AD.DomainController.TCPv4Connections.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.DomainController.TCPv6Connections.Collection](/images/Rule.png) | AD DC Performance Collection - TCPv6 - Connections Established | Microsoft.Windows.Server.2012.AD.DomainController.TCPv6Connections.Collection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.BindTimes.PerformanceCollection](/images/Rule.png) | LDAP Bind Time Performance Collection | Microsoft.Windows.Server.2012.AD.Performance.BindTimes.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Bind.Domain.PerformanceCollection](/images/Rule.png) | Domain Naming Master LDAP Bind Performance Collection | Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Bind.Domain.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Bind.Infra.PerformanceCollection](/images/Rule.png) | Infrastructure Master LDAP Bind Performance Collection | Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Bind.Infra.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Bind.PDC.PerformanceCollection](/images/Rule.png) | PDC LDAP Bind Performance Collection | Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Bind.PDC.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Bind.RID.PerformanceCollection](/images/Rule.png) | RID Master LDAP Bind Performance Collection | Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Bind.RID.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Bind.Schema.PerformanceCollection](/images/Rule.png) | Schema Master LDAP Bind Performance Collection | Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Bind.Schema.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Ping.Domain.PerformanceCollection](/images/Rule.png) | Domain Naming Master Ping Performance Collection | Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Ping.Domain.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Ping.Infra.PerformanceCollection](/images/Rule.png) | Infrastructure Master Ping Performance Collection | Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Ping.Infra.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Ping.PDC.PerformanceCollection](/images/Rule.png) | PDC Ping Performance Collection | Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Ping.PDC.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Ping.RID.PerformanceCollection](/images/Rule.png) | RID Master Ping Performance Collection | Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Ping.RID.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Ping.Schema.PerformanceCollection](/images/Rule.png) | Schema Master Ping Performance Collection | Microsoft.Windows.Server.2012.AD.Performance.FsmoResponse.Ping.Schema.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Performance.GCResponse.PerformanceCollection](/images/Rule.png) | Global Catalog Search Response Time Collection | Microsoft.Windows.Server.2012.AD.Performance.GCResponse.PerformanceCollection | Microsoft.Windows.Server.2012.AD.GlobalCatalogServerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.Replication.Queue.PerformanceCollection](/images/Rule.png) | AD Replication Queue Performance Collection | Microsoft.Windows.Server.2012.AD.Replication.Queue.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![Microsoft.Windows.Server.2012.AD.RIDPool.Free.PerformanceCollection](/images/Rule.png) | AD RID Pool Free Performance Collection | Microsoft.Windows.Server.2012.AD.RIDPool.Free.PerformanceCollection | Microsoft.Windows.Server.2012.AD.DomainControllerRole | PerformanceCollection | True | False |
![No_input_provider_to_sync_time_5_Rule](/images/Rule.png) | No input provider to sync time | No_input_provider_to_sync_time_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![One_or_more_of_the_DC_Locator_DNS_records_are_not_registered_1_Rule](/images/Rule.png) | One or more of the DC Locator DNS records are not registered in the DNS database since the primary DNS server does not support the dynamic update of the DNS records | One_or_more_of_the_DC_Locator_DNS_records_are_not_registered_1_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![PAC_Verification_Failure_5_Rule](/images/Rule.png) | PAC Verification Failure | PAC_Verification_Failure_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Policy_Update_Failure_5_Rule](/images/Rule.png) | Policy Update Failure | Policy_Update_Failure_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Report_Collection___Machine_Account_Authentication_Failures_5_Rule](/images/Rule.png) | Report Collection - Machine Account Authentication Failures | Report_Collection___Machine_Account_Authentication_Failures_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | False | False |
![Setting_the_administrators_password_failed.__It_has_been_reset_to_blank._5_Rule](/images/Rule.png) | Setting the administrators password failed. It has been reset to blank. | Setting_the_administrators_password_failed.__It_has_been_reset_to_blank._5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![The_account_identifier_pool_for_this_domain_controller_cannot_be_updated_5_Rule](/images/Rule.png) | The account identifier pool for this domain controller cannot be updated | The_account_identifier_pool_for_this_domain_controller_cannot_be_updated_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![The_computer_didnt_have_sufficient_rights_to_perform_the_secure_dynamic_update_1_Rule](/images/Rule.png) | The computer did not have sufficient rights to perform the secure dynamic update | The_computer_didnt_have_sufficient_rights_to_perform_the_secure_dynamic_update_1_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![The_computer_name_cannot_be_mapped_to_an_object_in_Active_Directory___this_may_result_in_authentication_failures_5_Rule](/images/Rule.png) | The computer name cannot be mapped to an object in Active Directory - this may result in authentication failures | The_computer_name_cannot_be_mapped_to_an_object_in_Active_Directory___this_may_result_in_authentication_failures_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![The_DC_was_unable_to_obtain_the_next_account_identifier_5_Rule](/images/Rule.png) | The DC was unable to obtain the next account-identifier | The_DC_was_unable_to_obtain_the_next_account_identifier_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![The_DNS_server_with_which_this_DC_will_register_does_not_support_1_Rule](/images/Rule.png) | The DNS server with which this DC will register does not support the dynamic update protocol or the authoritative zone is not configured to allow dynamic updates | The_DNS_server_with_which_this_DC_will_register_does_not_support_1_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![The_Domain_Changes_report_Create_Only_Rule](/images/Rule.png) | Create Domain Changes report | The_Domain_Changes_report_Create_Only_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | False | False |
![The_domain_controller_failed_to_obtain_a_new_account_identifier_pool_5_Rule](/images/Rule.png) | The domain controller failed to obtain a new account identifier pool | The_domain_controller_failed_to_obtain_a_new_account_identifier_pool_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![The_group_caching_option_has_now_been_properly_updated_5_Rule](/images/Rule.png) | The group caching option has now been properly updated | The_group_caching_option_has_now_been_properly_updated_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![The_machine_account_cannot_be_found_5_Rule](/images/Rule.png) | The machine account cannot be found | The_machine_account_cannot_be_found_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![The_number_of_Group_Policies_has_exceeded_the_maximum_limit_5_Rule](/images/Rule.png) | The number of Group Policies has exceeded the maximum limit | The_number_of_Group_Policies_has_exceeded_the_maximum_limit_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![The_registry_policy_file_could_not_be_accessed_during_application_of_machine_policy_5_Rule](/images/Rule.png) | The registry policy file could not be accessed during application of machine policy | The_registry_policy_file_could_not_be_accessed_during_application_of_machine_policy_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![The_system_clock_has_not_been_synchronized_for_some_time_5_Rule](/images/Rule.png) | The system clock has not been synchronized for some time | The_system_clock_has_not_been_synchronized_for_some_time_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![This_domain_controller_will_not_start_up_because_its_machine_account_has_been_deleted_5_Rule](/images/Rule.png) | This domain controller will not start up because its machine account has been deleted | This_domain_controller_will_not_start_up_because_its_machine_account_has_been_deleted_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Trusted_Domain_List_Update_Failure_5_Rule](/images/Rule.png) | Trusted Domain List Update Failure | Trusted_Domain_List_Update_Failure_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Unexpected_SAM_Failure_5_Rule](/images/Rule.png) | Unexpected SAM Failure | Unexpected_SAM_Failure_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Windows_cannot_determine_the_role_of_this_computer._5_Rule](/images/Rule.png) | Windows cannot determine the role of this computer. | Windows_cannot_determine_the_role_of_this_computer._5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Windows_cannot_determine_the_user_or_computer_name._5_Rule](/images/Rule.png) | Windows cannot determine the user or computer name. | Windows_cannot_determine_the_user_or_computer_name._5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Windows_cannot_obtain_the_domain_controller_name_for_your_computer_network._5_Rule](/images/Rule.png) | Windows cannot obtain the domain controller name for your computer network. | Windows_cannot_obtain_the_domain_controller_name_for_your_computer_network._5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |
![Windows_is_setting_a_registry_value_5_Rule](/images/Rule.png) | Windows is setting a registry value | Windows_is_setting_a_registry_value_5_Rule | Microsoft.Windows.Server.2012.AD.DomainControllerRole | EventCollection | True | False |