Home
  •  

AK157433

Monitor_AK157433 (UnitMonitor)

USN rollback detection via Registry key check

Knowledge Base article:

External

http://go.microsoft.com/fwlink/?LinkId=209935

Element properties:

TargetMicrosoft.KnowledgeServices.Windows.Server.2008.AD.DomainControllerRole
Parent MonitorSystem.Health.ConfigurationState
CategoryAlert
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityHigh
Alert Auto ResolveTrue
Monitor TypeMicrosoft.KnowledgeServices.Library.PowerShellMonitorEx
RemotableTrue
AccessibilityPublic
Alert Message
A update sequence number (USN) rollback was detected on the domain controller
<Details>
<Content>This domain controller has an Active Directory database that has been incorrectly restored or copied into place. This can cause update sequence number (USN) rollback. USN rollbacks can prevent any object type in any Active Directory partition from replicating.

See the Knowledge Base article for information on how to address this issue.</Content>
<CollectedInformation />
</Details>
RunAsDefault
CommentSupportTopic=TBD;VersionNumber=1.0.0.0;

Source Code:

<UnitMonitor ID="Monitor_AK157433" Comment="SupportTopic=TBD;VersionNumber=1.0.0.0;" Accessibility="Public" Enabled="true" Target="MicrosoftKnowledgeServicesWindowsServerADLibrary!Microsoft.KnowledgeServices.Windows.Server.2008.AD.DomainControllerRole" ParentMonitorID="Health!System.Health.ConfigurationState" Remotable="true" Priority="High" TypeID="KnowledgeServicesLibrary!Microsoft.KnowledgeServices.Library.PowerShellMonitorEx" ConfirmDelivery="true">

  <Category>Alert</Category>

  <AlertSettings AlertMessage="MonitorMessage1a651f5ae0ff42e2ba30ee0bc64c3f51">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>High</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Success" MonitorTypeStateID="Success" HealthState="Success"/>

    <OperationalState ID="Error" MonitorTypeStateID="Error" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ScriptName>AK157433.ps1</ScriptName>

    <Parameters/>

    <ScriptBody><Script>



$ErrorActionPreference = "Stop"



# Set up the arguments

$scriptargs = new-object psobject



# Set up the output

$global:scriptoutput = new-object psobject

$scriptoutput | add-member NoteProperty "HasIssue" $false

#-----------------------------------------------------

# Environment

#-----------------------------------------------------



$scriptenv = new-object psobject

$scriptenv | add-member ScriptMethod "GetDSANotWritableRegValue" -value {

		(Get-ItemProperty "HKLM:\System\CurrentControlSet\Services\NTDS\Parameters")."Dsa Not Writable"

}



function AdvisorRule($scriptargs, $scriptoutput)

{

	$DsaNotWritable = $scriptenv.GetDSANotWritableRegValue()

	

	if ($DsaNotWritable -eq 4)

	{

		$scriptoutput.HasIssue = $true

	}

	else 

	{

		$scriptoutput.HasIssue = $false

	}

	

}

AdvisorRule $scriptargs $scriptoutput



# set the output

$mom = new-object -comobject "MOM.ScriptAPI"

$bag = $mom.CreatePropertyBag()



if ($scriptoutput.HasIssue -ne $null)

{

	$bag.AddValue("HasIssue", $scriptoutput.HasIssue)

}



$bag



</Script></ScriptBody>

    <SnapIns/>

    <TimeoutSeconds>300</TimeoutSeconds>

    <Schedule>86385</Schedule>

    <ErrorExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="Boolean">Property[@Name='HasIssue']</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="Boolean">true</Value>

        </ValueExpression>

      </SimpleExpression>

    </ErrorExpression>

    <SuccessExpression>

      <Not>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="Boolean">Property[@Name='HasIssue']</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="Boolean">true</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </Not>

    </SuccessExpression>

  </Configuration>

</UnitMonitor>