DFS-N: Cross-Forest Trust Initialization State

Microsoft.Windows.FileServer.DFSN.10.0.TrustedForestInfoFailed (UnitMonitor)

This monitor checks whether the DFS Namespace service could initialize trusted forest information so that client computers can access trusted domains.

Knowledge Base article:

Summary

This monitor checks whether the DFS Namespace service could initialize trusted forest information so that client computers can access trusted domains. It does so by looking for the presence of DFS Namespaces event 14550 in the System event log.

Causes

An unhealthy state of this monitor indicates that DFS Namespaces could not initialize cross-forest trust information. This can occur for the following reasons:

The forest has only one domain controller
Active Directory Domain Services issues
Network issues

Resolutions

Check the list of domain controllers

To determine if there is only one domain controller in the forest, open a command prompt window from any computer in the domain and then type Nltest /dclist:[domain] where [domain] is the appropriate domain.

If there is only a single domain controller, add one or more domain controllers to reduce the likelihood of losing the domain if the remaining domain controller fails. Administrators of small networks with only a single domain controller can disable this monitor and ignore the corresponding events in the System event log.

Test network connectivity

To test network connectivity with the affected server, use the following procedure:

1. Open a command prompt window and then use the ping command to check basic network connectivity. If the ping command fails, it is likely that the server is not running, or has network problems that require local access to resolve. If ping is blocked in your network environment, skip this step.

2. If the ping command is successful, test the server�s registration in DNS by using the nslookup command. If the nslookup command fails, there is a problem with DNS. Check the DNS server health or contact the DNS server administrator.

3. If the nslookup command succeeds, it is likely that the shared folder is offline (possibly for maintenance) or there are problems with the permissions on the shared folder.

Verification

This monitor resets to a Healthy state after the DFS Namespace service initializes cross forest trust information and it detects DFS Namespaces event 14551.

Additional

DFS Namespaces Event 14550 (http://go.microsoft.com/fwlink/?LinkId=186535)
DFS Namespaces Event 14551 (http://go.microsoft.com/fwlink/?LinkId=186536)
Troubleshooting Active Directory Domain Services (http://go.microsoft.com/fwlink/?LinkId=139118)

Element properties:

Target	Microsoft.Windows.FileServer.DFSN.10.0.RoleService
Parent Monitor	System.Health.AvailabilityState
Category	AvailabilityHealth
Enabled	True
Alert Generate	False
Alert Auto Resolve	True
Monitor Type	Microsoft.Windows.2SingleEventLog2StateMonitorType
Remotable	True
Accessibility	Public
RunAs	Default

Source Code:

<UnitMonitor ID="Microsoft.Windows.FileServer.DFSN.10.0.TrustedForestInfoFailed" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.FileServer.DFSN.10.0.RoleService" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>AvailabilityHealth</Category>

  <OperationalStates>

    <OperationalState ID="FirstEventRaised" MonitorTypeStateID="FirstEventRaised" HealthState="Warning"/>

    <OperationalState ID="SecondEventRaised" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>System</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">14550</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <RegExExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>ContainsSubstring</Operator>

            <Pattern>DfsSvc</Pattern>

          </RegExExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>System</SecondLogName>

    <SecondExpression>

      <Or>

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">14551</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <RegExExpression>

                <ValueExpression>

                  <XPathQuery Type="String">PublisherName</XPathQuery>

                </ValueExpression>

                <Operator>ContainsSubstring</Operator>

                <Pattern>DfsSvc</Pattern>

              </RegExExpression>

            </Expression>

          </And>

        </Expression>

        <Expression>

          <And>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">7036</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">Params/Param[1]</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">DFS Namespace</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">Params/Param[2]</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">stopped</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </And>

        </Expression>

      </Or>

    </SecondExpression>

  </Configuration>

</UnitMonitor>