This rule creates a report that shows important changes to the domain. Use the AD Domain Changes report to view these changes. Changes that are reported include the following:
Operations master changes
Conversion to native mode
Booting to restore mode
The purpose of this rule is allow for the Domain Changes Report to be generated while turning off the alerts notifying you that it was generated. This can help reduce the noise generated by the AD MP.
To have the report generated without a corresponding alert being generated disable the 'Create Domain Changes Report and Alert' rule and enable this rule 'Create Domain Changes report'.
For more information, see:
Target | Microsoft.Windows.Server.2012.R2.AD.DomainControllerRole |
Category | EventCollection |
Enabled | False |
Event Source | Microsoft-Windows-Directory-Services-SAM |
Alert Generate | False |
Remotable | True |
Event Log | System |
Comment | Mom2005ID='{5F24596F-47D9-4696-ABDD-6E92ACA51054}';MOM2005GroupID= |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.EventProvider | Default |
CollectEventData | WriteAction | Microsoft.SystemCenter.CollectEvent | Default |
CollectEventDataWarehouse | WriteAction | Microsoft.SystemCenter.DataWarehouse.PublishEventData | Default |
<Rule ID="The_Domain_Changes_report_Create_Only_Rule" Comment="Mom2005ID='{5F24596F-47D9-4696-ABDD-6E92ACA51054}';MOM2005GroupID=" Enabled="false" Target="AD2012R2Core!Microsoft.Windows.Server.2012.R2.AD.DomainControllerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>MatchesMOM2005BooleanRegularExpression</Operator>
<Pattern>^(16408|12297|16652)$</Pattern>
</RegExExpression>
</Expression>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>Microsoft-Windows-Directory-Services-SAM</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="CollectEventData" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="CollectEventDataWarehouse" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
</WriteActions>
</Rule>