DFS-R：已加密檔案偵測

Microsoft.Windows.FileServer.DFSR.EncryptedFileMonitor (UnitMonitor)

此物件會監視複寫，並在複寫資料夾中發現有透過加密檔案系統 (EFS) 加密的檔案時建立「警告」警示。DFS 複寫不會複寫由 EFS 加密的複寫檔案。

Knowledge Base article:

摘要

此物件會監視複寫，並在複寫資料夾中發現有透過加密檔案系統 (EFS) 加密的檔案時建立「警告」警示。它會透過尋找 DFS 複寫事件 4402 是否存在來執行此操作。DFS 複寫不會複寫由 EFS 加密的複寫檔案。

原因

此監視的狀況不良狀態指出，DFS 複寫在複寫資料夾中發現由 EFS 加密的檔案。如果使用者使用 EFS 來加密儲存在複寫資料夾中的檔案，便可能會發生此情況。

解決方式

解密或移除檔案

若要複寫檔案，請使用 Cipher /d [filename] 命令解密檔案，其中 [filename] 是加密檔案的路徑。將檔案解密之後，便可正常進行複寫。

如果檔案應維持加密狀態，請將其移出複寫資料夾，或將其解密後使用不會對檔案設定 FILE_ATTRIBUTE_ENCRYPTED 屬性的非 Microsoft 加密程式對其進行加密。

其他

DFS 複寫事件 4402 (http://go.microsoft.com/fwlink/?LinkId=187141)

Element properties:

Target

Microsoft.Windows.FileServer.DFSR.ReplicatedFolder

Parent Monitor

System.Health.AvailabilityState

Category

StateCollection

Enabled

True

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

DFS-R：在複寫資料夾中發現由 EFS 加密的檔案

此 DFS 複寫服務發現複寫資料夾中有一個透過加密檔案系統 (EFS) 加密的檔案。此檔案將不會複寫，因為 DFS 複寫服務無法複寫 EFS 所加密的檔案。
其他資訊：檔案路徑：{0} 複寫資料夾根目錄：{1} 複寫資料夾名稱：{2} 複寫資料夾識別碼：{3} 複寫群組名稱：{4} 複寫群組識別碼：{5} 成員識別碼： {6}

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.Windows.FileServer.DFSR.EncryptedFileMonitor" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.FileServer.DFSR.ReplicatedFolder" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="true">

  <Category>StateCollection</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.FileServer.DFSR.EncryptedFileMonitor_AlertMessageResourceID">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Warning</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/Params/Param[2]$</AlertParameter1>

      <AlertParameter2>$Data/Context/Params/Param[3]$</AlertParameter2>

      <AlertParameter3>$Data/Context/Params/Param[4]$</AlertParameter3>

      <AlertParameter4>$Data/Context/Params/Param[1]$</AlertParameter4>

      <AlertParameter5>$Data/Context/Params/Param[5]$</AlertParameter5>

      <AlertParameter6>$Data/Context/Params/Param[6]$</AlertParameter6>

      <AlertParameter7>$Data/Context/Params/Param[7]$</AlertParameter7>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="FirstEventRaised" MonitorTypeStateID="FirstEventRaised" HealthState="Warning"/>

    <OperationalState ID="SecondEventRaised" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>DFS Replication</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">4402</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">DFSR</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="Microsoft.Windows.FileServer.DFSR.ReplicatedFolder"]/ReplicatedFolderGUID$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>DFS Replication</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">DFSR</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">Params/Param[1]</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">$Target/Property[Type="Microsoft.Windows.FileServer.DFSR.ReplicatedFolder"]/ReplicatedFolderGUID$</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <Or>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">4010</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <SimpleExpression>

                <ValueExpression>

                  <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                </ValueExpression>

                <Operator>Equal</Operator>

                <ValueExpression>

                  <Value Type="UnsignedInteger">4114</Value>

                </ValueExpression>

              </SimpleExpression>

            </Expression>

            <Expression>

              <And>

                <Expression>

                  <Or>

                    <Expression>

                      <SimpleExpression>

                        <ValueExpression>

                          <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                        </ValueExpression>

                        <Operator>Equal</Operator>

                        <ValueExpression>

                          <Value Type="UnsignedInteger">9008</Value>

                        </ValueExpression>

                      </SimpleExpression>

                    </Expression>

                    <Expression>

                      <SimpleExpression>

                        <ValueExpression>

                          <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

                        </ValueExpression>

                        <Operator>Equal</Operator>

                        <ValueExpression>

                          <Value Type="UnsignedInteger">9111</Value>

                        </ValueExpression>

                      </SimpleExpression>

                    </Expression>

                  </Or>

                </Expression>

                <Expression>

                  <SimpleExpression>

                    <ValueExpression>

                      <XPathQuery Type="String">Params/Param[3]</XPathQuery>

                    </ValueExpression>

                    <Operator>Equal</Operator>

                    <ValueExpression>

                      <Value Type="String">$Target/Property[Type="Microsoft.Windows.FileServer.DFSR.ReplicatedFolder"]/ReplicatedFolderGUID$</Value>

                    </ValueExpression>

                  </SimpleExpression>

                </Expression>

              </And>

            </Expression>

          </Or>

        </Expression>

      </And>

    </SecondExpression>

  </Configuration>

</UnitMonitor>