DFS-N: Namespace Root Not Created Because of Overlapping Namespace Root Directories

Microsoft.Windows.FileServer.DFSN.10.0.OverlappingExistingRootAlertRule (Rule)

This rule monitors whether DFS failed to create a new namespace because the root directory for the namespace overlaps another namespaces root directory.

Knowledge Base article:

Summary

This rule monitors whether DFS failed to create a new namespace because the root directory for the namespace overlaps another namespaces root directory. It does this by looking for the presence of DfsSvc event 14505 in the System log in Event Viewer.

Causes

This can occur if while creating a namespace, the administrator changes the local path of the shared folder storing the namespace root to a location that is a subdirectory of a folder already hosting another namespace.

Resolutions

To resolve this issue, use the DFS Management snap-in to recreate the namespace. To do so, see Create a DFS Namespace (http://go.microsoft.com/fwlink/?LinkId=186533).

Note: To create a domain-based namespace, you must be a member of the Domain Admins group in the domain that you want to create the namespace, or have been delegated permissions. To create a stand-alone namespace, you must be a member of the Local Administrators group on the namespace server.

Additional

Delegate Management Permissions for DFS Namespaces (http://go.microsoft.com/fwlink/?LinkId=186531)
DFS Namespaces Event 14505 (http://go.microsoft.com/fwlink/?LinkId=186545)

Element properties:

Target

Microsoft.Windows.FileServer.DFSN.10.0.RoleService

Category

Custom

Enabled

True

Event_ID

14505

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Remotable

True

Alert Message

DFS-N: Namespace Root Not Created Because of Overlapping Namespace Root Directories

{0}

Event Log

System

Member Modules:

ID	Module Type	TypeId	RunAs
DS	DataSource	Microsoft.Windows.EventProvider	Default
Alert	WriteAction	System.Health.GenerateAlert	Default

Source Code:

<Rule ID="Microsoft.Windows.FileServer.DFSN.10.0.OverlappingExistingRootAlertRule" Enabled="true" Target="Microsoft.Windows.FileServer.DFSN.10.0.RoleService" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>Custom</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">14505</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>ContainsSubstring</Operator>

              <Pattern>DfsSvc</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.FileServer.DFSN.10.0.OverlappingExistingRootAlertRule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

        <SuppressionValue>$Data/EventDescription$</SuppressionValue>

      </Suppression>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>