DFS-N: Client Cache of Known Domain Names

Microsoft.Windows.FileServer.DFSN.2008R2.DomainReferralOverflow (UnitMonitor)

This monitor checks whether the list of known domain names is too big to fit in the client computer’s cache. If the list doesn’t fit, the client computer might not be able to access domain-based DFS namespaces in other domains.

Knowledge Base article:

Summary

This object monitors the list of known domain names maintained by a domain controller. If the list is too big to fit in the DFS client computer’s cache, the domain controller logs DfsSvc event 14536 locally, and generates a Warning alert. The client computer will not be able to access domain-based DFS namespaces whose domain names were omitted from the list of trusted domains that the domain controller provided to the client computer.

Causes

The cache of known domains contains all domains in the client computer’s Active Directory Domain Services (AD DS) forest and all domains trusted by the client computer’s domain or forest. The DFS Namespace service populates the cache on domain controllers starting with local domains and domains that are explicitly trusted by the domain in which the client computer’s account resides.

The following factors contribute to filling the cache:

The number of domains in the client computer’s forest
The number of domains that the client computer’s domain has an explicit trust relationship with
Domains that have long names or large Unicode characters. DFS can store up to 28,000 characters in a 56-KB cache if all characters are 2-KB Unicode characters (typical for Western character sets), or as few as 14,000 characters if all characters are 4-KB Unicode characters.

Resolutions

Possible resolutions include:

The administrator of DFS Namespaces can configure DFS to use DNS names for referrals, as discussed in this article in the Microsoft Knowledge Base (http://go.microsoft.com/fwlink/?LinkId=171029). After DFS is configured to use DNS names for referrals, you can safely ignore this monitor.
A member of the Domain Administrators group can create explicit trusts in AD DS for important domains, reducing the likelihood that domain-based namespaces in these domains will be inaccessible.

After you resolve the problem, manually reset the health state of this monitor to Healthy.

Additional

DfsSvc Event 14536 (http://go.microsoft.com/fwlink/?LinkId=187107)
Delegate Management Permissions for DFS Namespaces (http://go.microsoft.com/fwlink/?LinkId=186531)

Element properties:

Target

Microsoft.Windows.FileServer.DFSN.2008R2.RoleService

Parent Monitor

System.Health.AvailabilityState

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.SingleEventLogManualReset2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

DFS-N: Client Cache of Known Domain Names is Full

{0}

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.Windows.FileServer.DFSN.2008R2.DomainReferralOverflow" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.FileServer.DFSN.2008R2.RoleService" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.SingleEventLogManualReset2StateMonitorType" ConfirmDelivery="true">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.FileServer.DFSN.2008R2.DomainReferralOverflow_AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="EventRaised" MonitorTypeStateID="EventRaised" HealthState="Warning"/>

    <OperationalState ID="ManualResetEventRaised" MonitorTypeStateID="ManualResetEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>System</LogName>

    <Expression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">14536</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <RegExExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>ContainsSubstring</Operator>

            <Pattern>DfsSvc</Pattern>

          </RegExExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">LoggingComputer</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetbiosComputerName$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="String">LoggingComputer</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="String">$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

          </Or>

        </Expression>

      </And>

    </Expression>

  </Configuration>

</UnitMonitor>