Home
  •  

This server is no longer a domain controller

This_server_is_no_longer_a_domain_controller_5_Rule (Rule)

Knowledge Base article:

Summary

This alert is generated when a domain controller has been demoted.

A script has been run automatically to clean up the Microsoft Operations Manager (MOM) Latency Monitor objects for this server. The script will log other alerts if it fails.

You can run the AD DC Demoted script to manually clean up the MOM Latency Monitor objects that were generated for this domain controller.

Resolutions

To run the AD DC Demoted script, open the script properties in the Rules/Advanced/Scripts folder in the MOM Administrator console. Copy the entire text of the script, and paste it into a file named AD_DC_Demoted.vbs.

Run the script from a command prompt, specifying the name of the domain controller as a parameter to the script.

For example, to clean up the MOM Latency Monitor objects for the domain controller named DC01, at a command prompt, change to the directory that the AD_DC_DEMOTED.vbs file is in and type:

cscript AD_DC_DEMOTED.vbs DC01

External

For more information, see:

Element properties:

TargetMicrosoft.Windows.Server.2003.AD.DomainControllerRole
CategoryEventCollection
EnabledTrue
Event SourceLSASRV
Alert GenerateTrue
Alert SeverityInformation
Alert PriorityNormal
RemotableTrue
Alert Message
This server is no longer a domain controller
{0}
Event LogSystem
CommentMom2005ID='{BF2B197A-16C2-4592-B237-DCB7C0E488F3}';MOM2005GroupID=

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="This_server_is_no_longer_a_domain_controller_5_Rule" Comment="Mom2005ID='{BF2B197A-16C2-4592-B237-DCB7C0E488F3}';MOM2005GroupID=" Enabled="onEssentialMonitoring" Target="AD2003Core!Microsoft.Windows.Server.2003.AD.DomainControllerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>LSASRV</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>MatchesMOM2005BooleanRegularExpression</Operator>

              <Pattern>(29224)|(29239)</Pattern>

            </RegExExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>0</Severity>

      <AlertOwner>$Data/PublisherName$</AlertOwner>

      <AlertMessageId>$MPElement[Name="This_server_is_no_longer_a_domain_controller_5_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>