DFS-N: Folders Overlap

Microsoft.Windows.FileServer.DFSN.10.0.LinksOverlap (Rule)

This object monitors whether there are overlapping DFS folders (links) by looking for DFS Namespaces event 14544, and if there are, generates an alert.

Knowledge Base article:

Summary

This object monitors whether there are overlapping DFS folders (links) by looking for DFS Namespaces event 14544, and if there are, generates an alert.

Causes

If a script attempts to create the same DFS folder in a domain-based namespace (Windows Server 2008 mode) at approximately the same time on different namespace servers, the DFS Namespace service could create two identically named folders.

Resolutions

To remove duplicate folders, you must be a member of the Domain Admins group in the domain in which the namespace exists. To remove duplicate folders, see the DFS Namespaces FAQ (http://go.microsoft.com/fwlink/?LinkId=171023).

Additional

DFS Namespaces Event 14544 (http://go.microsoft.com/fwlink/?LinkId=186549)

Element properties:

Target

Microsoft.Windows.FileServer.DFSN.10.0.RoleService

Category

Custom

Enabled

True

Event_ID

14544

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

DFS-N: Folders Overlap

{0}

Event Log

System

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.Windows.FileServer.DFSN.10.0.LinksOverlap" Enabled="true" Target="Microsoft.Windows.FileServer.DFSN.10.0.RoleService" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Custom</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">14544</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>ContainsSubstring</Operator>

              <Pattern>DfsSvc</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.FileServer.DFSN.10.0.LinksOverlap.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/Channel$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/EventDescription$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[1]$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[2]$</SuppressionValue>

        <SuppressionValue>$Data/Params/Param[3]$</SuppressionValue>

      </Suppression>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>