This monitor indicates that the trust monitoring service failed to read the federation metadata document.
The default setting for AD FS trust monitoring time interval is 1 day. This monitor will generate a Yellow state if Event ID 166 occurs at least four times within 5 days. If the same problem does not happen again within 1.5 days, the health state of this monitor will change back to a Green state and the alert that is generated by this monitor will be resolved automatically.
The metadata document that the Federation Service received back from its trust partner contained unexpected data.
Use the additional details that are provided within this event to learn the exact context of the metadata document error.
Target | Microsoft.ActiveDirectoryFederationServices2012R2.TrustManagement | ||
Parent Monitor | System.Health.ConfigurationState | ||
Category | ConfigurationHealth | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Warning | ||
Alert Priority | Normal | ||
Alert Auto Resolve | True | ||
Monitor Type | Microsoft.Windows.RepeatedEventLogTimer2StateMonitorType | ||
Remotable | True | ||
Accessibility | Public | ||
Alert Message |
| ||
RunAs | Default |
<UnitMonitor ID="Microsoft.ActiveDirectoryFederationServices2012R2.TrustManagementTrustMonitoringMetadataProcessingErrorMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.ActiveDirectoryFederationServices2012R2.TrustManagement" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.RepeatedEventLogTimer2StateMonitorType" ConfirmDelivery="true">
<Category>ConfigurationHealth</Category>
<AlertSettings AlertMessage="Microsoft.ActiveDirectoryFederationServices2012R2.TrustManagementTrustMonitoringMetadataProcessingErrorMonitor_AlertMessageResourceID">
<AlertOnState>Warning</AlertOnState>
<AutoResolve>true</AutoResolve>
<AlertPriority>Normal</AlertPriority>
<AlertSeverity>Warning</AlertSeverity>
<AlertParameters>
<AlertParameter1>$Data/Context/Context/DataItem/Params/Param[1]$</AlertParameter1>
</AlertParameters>
</AlertSettings>
<OperationalStates>
<OperationalState ID="RepeatedEventRaised" MonitorTypeStateID="RepeatedEventRaised" HealthState="Warning"/>
<OperationalState ID="TimerEventRaised" MonitorTypeStateID="TimerEventRaised" HealthState="Success"/>
</OperationalStates>
<Configuration>
<RepeatedComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</RepeatedComputerName>
<RepeatedLogName>$Target/Host/Property[Type="Microsoft.ActiveDirectoryFederationServices2012R2.FederationServer"]/ADFSEventLog$</RepeatedLogName>
<RepeatedExpression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">167</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>MatchesMOM2005RegularExpression</Operator>
<Pattern>(^AD FS$)</Pattern>
</RegExExpression>
</Expression>
</And>
</RepeatedExpression>
<Consolidator>
<ConsolidationProperties/>
<TimeControl>
<WithinTimeSchedule>
<Interval>432000</Interval>
</WithinTimeSchedule>
</TimeControl>
<CountingCondition>
<Count>4</Count>
<CountMode>OnNewItemTestOutputRestart_OnTimerSlideByOne</CountMode>
</CountingCondition>
</Consolidator>
<TimerWaitInSeconds>129600</TimerWaitInSeconds>
</Configuration>
</UnitMonitor>