DFS-N: Duplicate DFS Folders

Microsoft.Windows.FileServer.DFSN.10.0.DuplicateLinksAlertRule (Rule)

This object monitors for duplicate DFS folders (links).

Knowledge Base article:

Summary

This rule monitors for duplicate DFS folders (links). It does so by looking for the presence of DfsSvc event 14547 in the System log of Event Viewer.

Causes

If a script attempts to create the same DFS folder in a domain-based namespace (Windows Server 2008 mode) at approximately the same time on different namespace servers, the DFS Namespace service could create two identically named folders.

Resolutions

To remove duplicate folders, you must be a member of the Domain Admins group in the domain in which the namespace exists. To remove duplicate folders, see the DFS Namespaces FAQ (http://go.microsoft.com/fwlink/?LinkId=171023).

Additional

DFS Namespaces Event 14547 (http://go.microsoft.com/fwlink/?LinkId=187111)

Element properties:

Target

Microsoft.Windows.FileServer.DFSN.10.0.RoleService

Category

Custom

Enabled

True

Event_ID

14547

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

DFS-N: Duplicate DFS Folders

{0}

Event Log

System

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.Windows.FileServer.DFSN.10.0.DuplicateLinksAlertRule" Enabled="true" Target="Microsoft.Windows.FileServer.DFSN.10.0.RoleService" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Custom</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">14547</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>ContainsSubstring</Operator>

              <Pattern>DfsSvc</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.FileServer.DFSN.10.0.DuplicateLinksAlertRule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/Channel$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/EventDescription$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[2]$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[3]$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[4]$</SuppressionValue>

      </Suppression>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>