This alert is generated when a domain controller has been demoted.
A script has been run automatically to clean up the Microsoft Operations Manager (MOM) Latency Monitor objects for this server. The script will log other alerts if it fails.
You can run the AD DC Demoted script to manually clean up the MOM Latency Monitor objects that were generated for this domain controller.
To run the AD DC Demoted script, open the script properties in the Rules/Advanced/Scripts folder in the MOM Administrator console. Copy the entire text of the script, and paste it into a file named AD_DC_Demoted.vbs.
Run the script from a command prompt, specifying the name of the domain controller as a parameter to the script.
For example, to clean up the MOM Latency Monitor objects for the domain controller named DC01, at a command prompt, change to the directory that the AD_DC_DEMOTED.vbs file is in and type:
cscript AD_DC_DEMOTED.vbs DC01
For more information, see:
Target | Microsoft.Windows.Server.2003.AD.DomainControllerRole | ||
Category | EventCollection | ||
Enabled | True | ||
Event Source | LSASRV | ||
Alert Generate | True | ||
Alert Severity | Information | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
| ||
Event Log | System | ||
Comment | Mom2005ID='{BF2B197A-16C2-4592-B237-DCB7C0E488F3}';MOM2005GroupID= |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Windows.EventProvider | Default |
CollectEventData | WriteAction | Microsoft.SystemCenter.CollectEvent | Default |
CollectEventDataWarehouse | WriteAction | Microsoft.SystemCenter.DataWarehouse.PublishEventData | Default |
GenerateAlert | WriteAction | System.Health.GenerateAlert | Default |
<Rule ID="This_server_is_no_longer_a_domain_controller_5_Rule" Comment="Mom2005ID='{BF2B197A-16C2-4592-B237-DCB7C0E488F3}';MOM2005GroupID=" Enabled="onEssentialMonitoring" Target="AD2003Core!Microsoft.Windows.Server.2003.AD.DomainControllerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">
<ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>System</LogName>
<Expression>
<And>
<Expression>
<SimpleExpression>
<ValueExpression>
<XPathQuery>PublisherName</XPathQuery>
</ValueExpression>
<Operator>Equal</Operator>
<ValueExpression>
<Value>LSASRV</Value>
</ValueExpression>
</SimpleExpression>
</Expression>
<Expression>
<RegExExpression>
<ValueExpression>
<XPathQuery>EventDisplayNumber</XPathQuery>
</ValueExpression>
<Operator>MatchesMOM2005BooleanRegularExpression</Operator>
<Pattern>(29224)|(29239)</Pattern>
</RegExExpression>
</Expression>
</And>
</Expression>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>0</Severity>
<AlertOwner>$Data/PublisherName$</AlertOwner>
<AlertMessageId>$MPElement[Name="This_server_is_no_longer_a_domain_controller_5_Rule.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue/>
</Suppression>
</WriteAction>
<WriteAction ID="CollectEventData" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>
<WriteAction ID="CollectEventDataWarehouse" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>
</WriteActions>
</Rule>