| | DisplayName | ID | Target | Category | Enabled | Alert Generate |
|---|
 | Baseline Collection Rule for Terminal Services Active Sessions (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.ActiveSessions.BaselineCollection | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | PerformanceCollection | True | False |
| Performance Measuring: Terminal Services Active Sessions (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.ActiveSessions.PerformanceCollection | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | PerformanceCollection | True | False |
| A terminal service client has provided an invalid license | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1003 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| The terminal server cannot issue a client license | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1004 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| The terminal server received large number of incomplete connections | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1006 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | False |
| A terminal server client has been disconnected because its temporary license has expired | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1011 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| A remote session exceeded the maximum allowed failed logon attempts. | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1012 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | False |
| A terminal server client has been disconnected because its license could not be renewed | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1028 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| Terminal Server listener stack was down | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1035 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| Terminal Server session creation failed | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1036 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| This Terminal Server is not able to communicate with the License Server | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1043 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| Failed to load Terminal Server Profile path | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1046 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| A Terminal Server listener is configured with inconsistent authentication and encryption settings | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1050 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The Terminal Server is configured to use a certificate but is experiencing issues accessing that certificate. | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1051.1055 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The Terminal Server is configured to use a certificate that has or will soon expire | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1052.1065.1053 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The Terminal Server is configured to use a certificate that does not contain an Enhanced Key Usage attribute of Server Authentication | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1054 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The Terminal Server has failed to create or replace a self signed certificate | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1057.1058 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The Terminal Server authentication certificate configuration data was invalid and the service reset i | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1059 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The Terminal Services User Home Directory was not set because the path specified does not exist or not accessible | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1060 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| Terminal Server was unable to retrieve users Licensing information from AD | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1061 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | False | True |
| The terminal server is configured to use a template-based certificate but the subject name on the certificate is invalid | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1062 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The terminal server cannot install a new template-based certificate | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1064 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The terminal server cannot register 'TERMSRV' Service Principal Name to be used for server authentication | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1067 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The TS Licensing mode has not been configured | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1068 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The TS Licensing grace period has expired and Licensing mode for the Terminal Server has not been configured | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1069 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The terminal server could not locate a license server or the licensing grace period is at or near an end | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.1129.1128.1130.1131.1132 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| A listener failed while listening | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.260 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| The TS Session Broker server name is not valid | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.TSSessionBrokerClient1003 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | Custom | True | True |
| The terminal server load-balancing Jet RPC interface call failed | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.EventCollection.TSSessionBrokerClient1004 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | EventCollection | True | True |
| Baseline Collection Rule for Terminal Services Inactive Sessions (Server 2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.InactiveSessions.BaselineCollection | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | PerformanceCollection | True | False |
| Performance Measuring: Terminal Services Inactive Sessions (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.InactiveSessions.PerformanceCollection | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | PerformanceCollection | True | False |
| Performance Measuring: Terminal Services Total Sessions (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer.TotalSessions.PerformanceCollection | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TerminalServer | PerformanceCollection | True | False |
| Restart the TS Gateway server, and if needed, remove and reinstall the TS Gateway role service | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.1001 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Obtain, install, and configure a certificate that meets TS Gateway server certificate requirements | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.102 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Ensure that the required permissions are granted to the private key of the SSL certificate | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.103 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Check whether settings are associated with local security groups on another TS Gateway server | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.2002 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Ensure that the required permissions are granted to the Core registry key, and if needed, delete and recreate TS RAPs and TS RAPs | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.2004 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Ensure that the client meets the requirements of the TS CAP | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.201 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | False | True |
| The number of simultaneous connections to the TS Gateway server has reached the maximum number that was configured by the administrator | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.203 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Ensure that the client meets the health policy requirements configured on the Network Policy Server | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.204 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | False | True |
| Ensure that the client meets the requirements of the TS RAP | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.301 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | False | True |
| Ensure that Remote Desktop is enabled and that the user is a member of the Remote Desktop Users group, and if needed, fix network connectivity issues | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.304 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Ensure that the TS Gateway server supports the authentication methods that are supported for clients | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.305 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Configure the TS Gateway server to use the certificate for SSL | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.306 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Collect TS Gateway configuration change events | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.504.506.510.512.514.516.520.521.522.540.541.542.560.561.562 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | False |
| Ensure that the required permissions are granted to the LogEvents registry key and that the Remote Registry service started | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.505.507 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Ensure that the required permissions are granted to the Core registry key | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.509.515.517 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Ensure that the correct central NPS server is specified | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.511.583.585 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Review event log for Network Policy Server events | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.513.584 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Check whether the TS Gateway server is configured to use a certificate that meets TS Gateway requirements | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.518.519 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Ensure that the TS CAP is configured correctly | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.523.524.525 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Ensure that the TS RAP is configured correctly | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.543.544.545 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Ensure that security groups and TS Gateway-managed groups are configured correctly | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.563.564.565 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Ensure that the required permissions are granted to the RPC registry key | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.622.623 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Manually enable the Terminal Services Gateway Server Farm exception | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.627 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | EventCollection | True | True |
| Performance Measuring: TS Gateway Connection request authorization time (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.PerformanceCollection.Connectionrequestauthorizationtime | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | PerformanceCollection | True | False |
| Performance Measuring: TS Gateway Current connections (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.PerformanceCollection.Currentconnections | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | PerformanceCollection | True | False |
| Performance Measuring: TS Gateway Failed Connection Authorization (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.PerformanceCollection.FailedConnectionAuthorization | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | PerformanceCollection | True | False |
| Performance Measuring: TS Gateway Failed Resource Authoization (2008) | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.PerformanceCollection.FailedResourceAuthoization | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway | PerformanceCollection | True | False |
| Create the "Terminal Server Computers" local group or add a terminal server to the group on the Terminal Services license server | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.71.4140.4141 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| Remove and then reinstall the TS Licensing role service | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.12.38 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| The Terminal Services license server cannot detect locally installed Terminal Services client access licenses (TS CALs) or communicate with other Terminal Services license servers | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.14 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| Purchase and install TS CALs onto the license server | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.20.22 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| The Terminal Services license server does not have any remaining permanent Terminal Services client access licenses of a certain type | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.21 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| Reinstall the TS CALs onto the license server by using the telephone method | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.26 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| Key-pack or certificate chain verification failed | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.56.57.58 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| This Terminal Services license server is too busy or could not to notify other Terminal Services license servers | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.7.15 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| The Terminal Services license server cannot communicate with another Terminal Services license server | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.8.45 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| A Terminal Services client access license (TS CAL) issued could not be revoked | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing.EventCollection.81 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSLicensing | EventCollection | True | True |
| The TS Session Broker failed to delete all the log files | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1000 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| The TS Session Broker service failed to set the working directory retrieved from the registry | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1007 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| The TS Session Broker service denied the remote procedure call (RPC) from an unauthorized computer | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1016 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| Collect events about TS servers joining and leaving a farm | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1017.1018 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | False |
| The group is empty | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1020 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| The group does not exist | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1021 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| TS Session Broker farm is in an inconsistent state | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker.EventCollection.1023 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSSessionBroker | EventCollection | True | True |
| No terminal server was specified for TS Web Access. | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSWebAccess.EventCollection.6 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSWebAccess | EventCollection | True | True |
| TS Web Access was not able to access the terminal server | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSWebAccess.EventCollection.8 | Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSWebAccess | EventCollection | True | True |
Home
ENU 
Show Management Pack References