Home
  •  

KHI: The 'Manage auditing and security log' permission is removed from the Exchange Servers group on one or more domain controllers.

_1C40945A_92BF_478c_9D27_614CE2D73C4E_ (UnitMonitor)

Knowledge Base article:

External Knowledge Sources

For more information, see the respective topic at the Microsoft Exchange Server TechCenter

Element properties:

TargetMicrosoft.Exchange.2010.CommonActiveDirectoryAccess
Parent MonitorSystem.Health.AvailabilityState
CategoryAvailabilityHealth
EnabledTrue
Alert GenerateFalse
Alert Auto ResolveTrue
Monitor TypeCorrelation.StatefulRepeatedWindowsEventTimerMonitorType
RemotableTrue
AccessibilityPublic
RunAsDefault
CommentActionable='True';Urgent='False';EscalationTeam='Ops Support'

Source Code:

<UnitMonitor ID="_1C40945A_92BF_478c_9D27_614CE2D73C4E_" Target="Microsoft.Exchange.2010.CommonActiveDirectoryAccess" Enabled="onEssentialMonitoring" Accessibility="Public" Remotable="true" ParentMonitorID="SystemHealth!System.Health.AvailabilityState" TypeID="Correlation.StatefulRepeatedWindowsEventTimerMonitorType" Comment="Actionable='True';Urgent='False';EscalationTeam='Ops Support'">

  <Category>AvailabilityHealth</Category>

  <OperationalStates>

    <OperationalState ID="Success" MonitorTypeStateID="TimerEventRaised" HealthState="Success"/>

    <OperationalState ID="Warning" MonitorTypeStateID="EventRaised" HealthState="Warning"/>

  </OperationalStates>

  <Configuration>

    <MonitorType>KHI</MonitorType>

    <VoteWeight>100</VoteWeight>

    <TimeWindowInSeconds>1020</TimeWindowInSeconds>

    <RepeatThreshold>3</RepeatThreshold>

    <ComputerName>.</ComputerName>

    <LogName>Application</LogName>

    <Expression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">6006</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">MSExchange SACL Watcher</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </Expression>

    <TimerWaitInSeconds>86400</TimerWaitInSeconds>

  </Configuration>

</UnitMonitor>