Home
  •  

Aggregate Repaired Corrupted System File Monitor

Microsoft.Windows.Client.Win10.PhysicalDisk.COFIRE_FixedNR.Monitor (UnitMonitor)

Monitor reports when the Corrupted File Recovery server repairs a corrupted file

Knowledge Base article:

Summary

This Health monitor turns YELLOW when Windows 10 and above detects bad sectors in OS section of the system drive, and has been able to self-heal the drive. While Windows 10 and above was able to recover from the hardware error, the hard drive is highly likely to develop other bad sectors, which could result in loss of data.

.

Resolutions

1. Run ChkDsk on the drive to gauge the extent of bad blocks

2. Consider replacing the hard drive

Element properties:

TargetMicrosoft.Windows.Client.Win10.Aggregate.PhysicalDisk
Parent MonitorSystem.Health.AvailabilityState
CategoryStateCollection
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityLow
Alert Auto ResolveTrue
Monitor TypeMicrosoft.Windows.SingleEventLogManualReset2StateMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
A Windows 10 and above computer has a corrupted system file that was repaired
Windows 10 and above has detected a corrupted system file that it self-healed. There is no direct action to be taken. However, if this problem persists, and there are further bad sectors in the hard drive, please consider replacing the hard drive. Please look at the health state of the machine to better understand what other related hard drive issues are being encountered by Windows 10 and above.
RunAsSystem.PrivilegedMonitoringAccount

Source Code:

<UnitMonitor ID="Microsoft.Windows.Client.Win10.PhysicalDisk.COFIRE_FixedNR.Monitor" RunAs="System!System.PrivilegedMonitoringAccount" Accessibility="Public" ParentMonitorID="SystemHealth!System.Health.AvailabilityState" Target="Microsoft.Windows.Client.Win10.Aggregate.PhysicalDisk" TypeID="Windows!Microsoft.Windows.SingleEventLogManualReset2StateMonitorType" Remotable="true" Enabled="true" Priority="Normal" ConfirmDelivery="false">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.Client.Win10.PhysicalDisk.COFIRE_FixedNR.Monitor.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Low</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="NoProblem" HealthState="Success" MonitorTypeStateID="ManualResetEventRaised"/>

    <OperationalState ID="ProblemFixed" HealthState="Error" MonitorTypeStateID="EventRaised"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</ComputerName>

    <LogName>Microsoft-Windows-CorruptedFileRecovery-Server/Operational</LogName>

    <Expression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>Microsoft-Windows-CorruptedFileRecovery-Server</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>7</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <Value>$Target/Property[Type="Microsoft.Windows.Client.Win10.Aggregate.PhysicalDisk"]/ContainsSystemDrive$</Value>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>1</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </Expression>

  </Configuration>

</UnitMonitor>