At least one discovered peer has exceeded the number of internal users they can contact.

OCS_Protocol_Stack_14508_EE (Rule)

Knowledge Base article:

Summary

Causes

The peer has contacted more usernames within your domain via discovery than is allowed. This may be a legitimate peer with extensive connections to your organization, or a badly configured peer, or it could be an attacker.

Resolutions

Verify if the domain is one you wish to communicate with. If you wish to communicate with this peer without a restriction on the number of users contacted, add this domain to the allowed list. If you don't wish this domain to communicate with you, add this domain to the blocked list. If you wish to allow limited communication with this domain, no action is required but whenever this limit is exceeded, communications with additional usernames will fail.

Element properties:

Target

Microsoft_Office_Communications_Server_2007_R2_Enterprise_Edition

Category

EventCollection

Enabled

True

Event_ID

14508

Event Source

OCS Protocol Stack

Alert Generate

True

Alert Severity

Warning

Alert Priority

Normal

Remotable

True

Alert Message

At least one discovered peer has exceeded the number of internal users they can contact.

{0}

Event Log

Office Communications Server

Member Modules:

ID	Module Type	TypeId	RunAs
CollectEvent	DataSource	Microsoft.Windows.EventProvider	Default
WriteAlert	WriteAction	System.Health.GenerateAlert	Default
WriteToDB	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
WriteToDW	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default

Source Code:

<Rule ID="OCS_Protocol_Stack_14508_EE" Enabled="true" Target="Microsoft_Office_Communications_Server_2007_R2_Enterprise_Edition" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="CollectEvent" TypeID="SCWindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="SCWindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Office Communications Server</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">OCS Protocol Stack</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">14508</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SCSystemLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteAlert" TypeID="SCHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="At_least_one_discovered_peer_has_exceeded_the_number_of_internal_users_they_can_contact_"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

      </Suppression>

    </WriteAction>

    <WriteAction ID="WriteToDW" TypeID="SCDataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>