DHCP IPv4 Runtime DNS Registration Rule

Microsoft.Windows.DHCPServer.Library.IPv4Runtime.DNSRegistration.Warning.Rule (Rule)

Knowledge Base article:

Summary

This rule checks for Warning Events related to DNS Registration issues.

Resolutions

To perform these procedures, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.

You can configure the DHCP Server service to impersonate an account to perform DNS registrations. The Netsh.exe tool can be used to configure the impersonation credentials.

Click Start, click Control Panel, and then click User Accounts.
Click Manage user accounts.
Click Add, and then follow the instructions to create a new user account.
Click Start, typecmd in Start Search, and thenpress ENTER.
Atthe command prompt, type netsh dhcp server set dnscredentials username domainname password (whereusername isthe new accountcreated in the previous step),and then press ENTER.
At the DHCP server computer, click Start, click Run, type services.msc, and then click OK.
Double-click DHCP Server.
Click Stop, wait for the progress bar to complete, click Start, wait for the progress bar to complete, and then click OK.
On the File menu, click Exit.
Type netsh dhcp server delete dnscredentials dhcpfullforce, and then press ENTER.
At the DHCP server computer, click Start, click Run, type services.msc, and then click OK.
Double-click DHCP Server.
Click Start, wait for the progress bar to complete, and then click OK.
On the File menu, click Exit.

Element properties:

Target

Microsoft.Windows.DHCPServer.Library.IPv4Runtime

Category

EventCollection

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

DHCP DNS Registration Configuration Alert

{0}

Event Log

System

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Microsoft.Windows.DHCPServer.Library.ActionAccount
GenerateAlert	WriteAction	System.Health.GenerateAlert	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="Microsoft.Windows.DHCPServer.Library.IPv4Runtime.DNSRegistration.Warning.Rule" Enabled="true" Target="Microsoft.Windows.DHCPServer.Library.IPv4Runtime" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" RunAs="Microsoft.Windows.DHCPServer.Library.ActionAccount" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <Or>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="String">PublisherName</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="String">Microsoft-Windows-DHCP-Server</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="String">PublisherName</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="String">DHCPServer</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

            </Or>

          </Expression>

          <Expression>

            <Or>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">1055</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

              <Expression>

                <SimpleExpression>

                  <ValueExpression>

                    <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                  </ValueExpression>

                  <Operator>Equal</Operator>

                  <ValueExpression>

                    <Value Type="UnsignedInteger">1056</Value>

                  </ValueExpression>

                </SimpleExpression>

              </Expression>

            </Or>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

    <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.DHCPServer.Library.IPv4Runtime.UnitMonitor.DNSRegistration_AlertMessageResourceID"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

    </WriteAction>

  </WriteActions>

</Rule>