This rule checks for Warning Events related to DNS Registration issues.
To perform these procedures, you must be a member of the Administrators group, or you must have been delegated the appropriate authority.
You can configure the DHCP Server service to impersonate an account to perform DNS registrations. The Netsh.exe tool can be used to configure the impersonation credentials.
Click Start, click Control Panel, and then click User Accounts.
Click Manage user accounts.
Click Add, and then follow the instructions to create a new user account.
Click Start, typecmd in Start Search, and thenpress ENTER.
Atthe command prompt, type netsh dhcp server set dnscredentials username domainname password (whereusername isthe new accountcreated in the previous step),and then press ENTER.
At the DHCP server computer, click Start, click Run, type services.msc, and then click OK.
Double-click DHCP Server.
Click Stop, wait for the progress bar to complete, click Start, wait for the progress bar to complete, and then click OK.
On the File menu, click Exit.
Type netsh dhcp server delete dnscredentials dhcpfullforce, and then press ENTER.
At the DHCP server computer, click Start, click Run, type services.msc, and then click OK.
Double-click DHCP Server.
Click Start, wait for the progress bar to complete, and then click OK.
On the File menu, click Exit.
Target | Microsoft.Windows.DHCPServer.Library.IPv4Runtime | ||
Category | EventCollection | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Warning | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
| ||
Event Log | System |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.EventProvider | Microsoft.Windows.DHCPServer.Library.ActionAccount |
GenerateAlert | WriteAction | System.Health.GenerateAlert | Default |
WriteToDB | WriteAction | Microsoft.SystemCenter.CollectEvent | Default |
WriteToDW | WriteAction | Microsoft.SystemCenter.DataWarehouse.PublishEventData | Default |
<Rule ID="Microsoft.Windows.DHCPServer.Library.IPv4Runtime.DNSRegistration.Warning.Rule" Enabled="true" Target="Microsoft.Windows.DHCPServer.Library.IPv4Runtime" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" RunAs="Microsoft.Windows.DHCPServer.Library.ActionAccount" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">Microsoft-Windows-DHCP-Server</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="String">PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="String">DHCPServer</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
<Expression>
<Or>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1055</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value Type="UnsignedInteger">1056</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</Or>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
<WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>1</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Windows.DHCPServer.Library.IPv4Runtime.UnitMonitor.DNSRegistration_AlertMessageResourceID"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
</WriteAction>
</WriteActions>
</Rule>