| DisplayName | ID | Target | Category | Enabled | Alert Generate |
| 終端機服務作用中工作階段的基準集合規則 (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.ActiveSessions.BaselineCollection | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | PerformanceCollection | True | False |
| 效能測量:終端機服務作用中工作階段 (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.ActiveSessions.PerformanceCollection | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | PerformanceCollection | True | False |
| 終端機服務用戶端提供的授權無效 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1003 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| 終端機伺服器無法發行用戶端授權 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1004 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| 終端機伺服器收到大量不完整的連線 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1006 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | False |
| 已中斷終端機伺服器用戶端的連線,因為其臨時授權已過期 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1011 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| 遠端工作階段已超過登入嘗試失敗允許的次數上限。 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1012 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | False |
| 已中斷終端機伺服器用戶端的連線,因為其授權無法更新 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1028 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| 終端機伺服器接聽程式堆疊已經停止了 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1035 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 終端機伺服器工作階段建立失敗 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1036 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 此終端機伺服器無法與授權伺服器進行通訊 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1043 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 無法載入終端機伺服器設定檔路徑 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1046 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| 終端機伺服器接聽程式設定為不一致的驗證及加密設定 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1050 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 終端機伺服器設定成使用憑證,但是存取該憑證時發生問題。 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1051.1055 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 終端機伺服器設定使用的憑證已經或即將過期 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1052.1065.1053 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 終端機伺服器設定使用的憑證未含有伺服器驗證的增強金鑰使用方法屬性 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1054 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 終端機伺服器無法建立或取代自行簽署的憑證 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1057.1058 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 終端機伺服器驗證憑證設定資料無效,而且服務已將它重設。 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1059 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 沒有設定終端機服務使用者主目錄,因為指定的路徑不存在或無法存取 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1060 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| 終端機伺服器無法從 AD 中擷取使用者授權資訊 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1061 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| 終端機伺服器設定成使用範本型憑證,但是憑證上的主體名稱無效 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1062 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 終端機伺服器無法安裝新的範本型憑證 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1064 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 終端機伺服器無法登錄要用於伺服器驗證的 'TERMSRV' 服務主要名稱 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1067 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 尚未設定 TS 授權模式 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1068 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| TS 授權寬限期已過期,而且尚未設定終端機伺服器的授權模式 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1069 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 終端機伺服器找不到授權伺服器,或者授權寬限期已經或即將結束 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1129.1128.1130.1131.1132 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 接聽程式在接聽時失敗 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.260 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| TS 工作階段代理人伺服器名稱無效 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.TSSessionBrokerClient1003 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | Custom | True | True |
| 終端機伺服器負載平衡 Jet RPC 介面呼叫失敗 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.TSSessionBrokerClient1004 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| 終端機服務非作用中工作階段的基準集合規則 (Server 2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.InactiveSessions.BaselineCollection | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | PerformanceCollection | True | False |
| 效能測量:終端機服務非作用中工作階段 (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.InactiveSessions.PerformanceCollection | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | PerformanceCollection | True | False |
| 效能測量:終端機服務工作階段總數 (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.TotalSessions.PerformanceCollection | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | PerformanceCollection | True | False |
| 重新啟動 TS 閘道伺服器,如有需要則移除並重新安裝 TS 閘道角色服務 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.1001 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 取得、安裝並設定符合 TS 閘道伺服器憑證需求的憑證 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.102 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 確定已將所需的權限授與 SSL 憑證的私密金鑰 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.103 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 檢查設定是否與其他 TS 閘道伺服器上的本機安全性群組相關聯 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.2002 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 確定已將所需的權限授與 Core 登錄機碼,如有需要則刪除並重新建立 TS RAP 和 TS RAP | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.2004 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 確定用戶端符合 TS CAP 的需求 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.201 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | False | True |
| TS 閘道伺服器的同時連線數目已經達到系統管理員所設定的數目上限 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.203 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 確定用戶端符合網路原則伺服器上所設定的健全狀況原則需求 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.204 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | False | True |
| 確定用戶端符合 TS RAP 的需求 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.301 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | False | True |
| 確定已啟用遠端桌面而且使用者屬於遠端桌面使用者群組的成員,如有需要則修正網路連線問題 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.304 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 確定 TS 閘道伺服器支援用戶端所支援的驗證方法 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.305 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 將 TS 閘道伺服器設定成使用 SSL 的憑證 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.306 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 收集 TS 閘道設定變更事件 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.504.506.510.512.514.516.520.521.522.540.541.542.560.561.562 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | False |
| 確定已將所需的權限授與 LogEvents 登錄機碼而且已啟動遠端登錄服務 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.505.507 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 確定已將所需的權限授與 Core 登錄機碼 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.509.515.517 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 確定已指定正確的中央 NPS 伺服器 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.511.583.585 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 檢閱網路原則伺服器事件的事件記錄檔 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.513.584 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 檢查 TS 閘道伺服器是否設定成使用符合 TS 閘道需求的憑證 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.518.519 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 確定已正確設定 TS CAP | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.523.524.525 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 確定已正確設定 TS RAP | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.543.544.545 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 確定已正確設定安全性群組和 TS 閘道管理的群組 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.563.564.565 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 確定已將所需的權限授與 RPC 登錄機碼 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.622.623 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 手動啟用終端機服務閘道伺服器伺服陣列例外狀況 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.627 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| 效能測量:TS 閘道連線要求授權時間 (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.PerformanceCollection.Connectionrequestauthorizationtime | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | PerformanceCollection | True | False |
| 效能測量:TS 閘道目前連線數 (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.PerformanceCollection.Currentconnections | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | PerformanceCollection | True | False |
| 效能測量:TS 閘道失敗的連線授權 (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.PerformanceCollection.FailedConnectionAuthorization | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | PerformanceCollection | True | False |
| 效能測量:TS 閘道失敗的資源授權 (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.PerformanceCollection.FailedResourceAuthoization | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | PerformanceCollection | True | False |
| 在終端機服務授權伺服器上建立 "Terminal Server Computers" 本機群組,或將終端機伺服器新增至該群組 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.71.4140.4141 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| 移除 TS 授權角色服務,然後重新安裝 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.12.38 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| 終端機服務授權伺服器無法偵測本機安裝的終端機服務用戶端存取使用權 (TS CAL) 或與其他終端機服務授權伺服器進行通訊 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.14 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| 購買並安裝 TS CAL 至授權伺服器 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.20.22 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| 終端機服務授權伺服器沒有特定類型的任何其餘永久終端機服務用戶端存取使用權 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.21 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| 使用電話方法,將 TS CAL 重新安裝至授權伺服器 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.26 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| Key-pack 或憑證鏈結驗證失敗 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.56.57.58 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| 此終端機服務授權伺服器太忙碌,或無法通知其他終端機服務授權伺服器 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.7.15 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| 終端機服務授權伺服器無法與其他終端機服務授權伺服器進行通訊 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.8.45 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| 無法撤銷已發行的終端機服務用戶端存取使用權 (TS CAL) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.81 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| TS 工作階段代理人無法刪除所有記錄檔 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1000 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| TS 工作階段代理人服務無法設定從登錄中擷取工作目錄 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1007 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| TS 工作階段代理人服務拒絕來自未授權電腦的遠端程序呼叫 (RPC) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1016 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| 收集加入和離開伺服陣列之 TS 伺服器的相關事件 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1017.1018 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | False |
| 群組是空的 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1020 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| 群組不存在 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1021 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| TS 工作階段代理人伺服陣列處於不一致的狀態 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1023 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| 沒有針對 TS Web 存取指定任何終端機伺服器。 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSWebAccess.EventCollection.6 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSWebAccess | EventCollection | True | True |
| TS Web 存取無法存取終端機伺服器 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSWebAccess.EventCollection.8 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSWebAccess | EventCollection | True | True |