Home
  •  

An attempt to check whether group caching is enabled has failed

An_attempt_to_check_whether_group_caching_is_enabled_has_failed_5_Rule (Rule)

Knowledge Base article:

Summary

Security Accounts Manager (SAM) encountered an error while attempting to allocate memory. If this persists, look for other out-of-memory conditions.

Sample Event:

The attempt to check whether group caching has been enabled in the Security Accounts Manager has failed, most likely due to lack of resources. This task has been rescheduled to run in one minute.

Related Events:

This event has a matching 'success' event that indicates that the error condition no longer exists. The 'success' event is: 'The group caching option has now been properly updated' (event id 12300)

Resolutions

Schedule a reboot for this computer at the first available opportunity. To escalate issues with memory leaks and use of this process, contact Microsoft Product Support Services.

External

Element properties:

TargetMicrosoft.Windows.Server.2012.R2.AD.DomainControllerRole
CategoryEventCollection
EnabledTrue
Event_ID12299
Event SourceMicrosoft-Windows-Directory-Services-SAM
Alert GenerateFalse
RemotableTrue
Event LogSystem
CommentMom2005ID='{AA4B7285-55C9-473E-A4DE-A86CE398F72D}';MOM2005GroupID=

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default

Source Code:

<Rule ID="An_attempt_to_check_whether_group_caching_is_enabled_has_failed_5_Rule" Comment="Mom2005ID='{AA4B7285-55C9-473E-A4DE-A86CE398F72D}';MOM2005GroupID=" Enabled="true" Target="AD2012R2Core!Microsoft.Windows.Server.2012.R2.AD.DomainControllerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>12299</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Microsoft-Windows-Directory-Services-SAM</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="CollectEventData" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>