| | DisplayName | Description | ID | Target | Category | Enabled | Instance Name | Counter Name | Frequency | Event_ID | Event Source | Alert Generate | Alert Severity | Alert Priority | Remotable | Event Log |
|---|
 | Accounts with the same SID have been detected - one has been deleted | | Accounts_with_the_same_SID_have_been_detected___one_has_been_deleted_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 12303 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| Account Changes Report Available | | Account_Changes_Report_Available_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Microsoft-Windows-Directory-Services-SAM | True | Information | Normal | True | System |
| Account creation will fail on this domain controller until the account identifier pool is obtained | | Account_creation_will_fail_on_this_domain_controller_until_the_account_identifier_pool_is_obtained_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 16643 | Microsoft-Windows-Directory-Services-SAM | True | Warning | Normal | True | System |
| Account Name Not Unique | | Account_Name_Not_Unique_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | True | System |
| Active Directory cannot allocate a new domain controller GUID | | Active_Directory_cannot_allocate_a_new_domain_controller_GUID_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1165 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Active Directory cannot be initialized | | Active_Directory_cannot_be_initialized_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1016 | NTDS General | True | Error | Normal | True | Directory Service |
| Active Directory cannot boot normally because the database was in an incorrect state | | Active_Directory_cannot_boot_normally_because_the_database_was_in_an_incorrect_state_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2062 | NTDS General | True | Error | Normal | True | Directory Service |
| Active Directory cannot change the state of the database during a backup operation | | Active_Directory_cannot_change_the_state_of_the_database_during_a_backup_operation_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2061 | NTDS Database | True | Error | Normal | True | Directory Service |
| Active Directory cannot construct a mutual authentication Service Principal Name | | Active_Directory_cannot_construct_a_mutual_authentication_Service_Principal_Name_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1411 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Active Directory cannot create a new security descriptor | | Active_Directory_cannot_create_a_new_security_descriptor_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1450 | NTDS SDPROP | True | Error | Normal | True | Directory Service |
| Active Directory cannot create the default security descriptor for an application directory partition | | Active_Directory_cannot_create_the_default_security_descriptor_for_an_application_directory_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1979 | NTDS General | True | Warning | Normal | True | Directory Service |
| Active Directory cannot delete the access control entry (ACE) for the domain Domain Controllers security group on a newly created application directory partition | | Active_Directory_cannot_delete_the_access_control_entry__ACE__for_the_domain_Domain_Controllers_security_group_on_a_newly_created_application_directory_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1982 | NTDS General | True | Warning | Normal | True | Directory Service |
| Active Directory cannot delete the key "New Database GUID" during the restore recovery process | | Active_Directory_cannot_delete_the_key_New_Database_GUID_during_the_restore_recovery_process_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1537 | NTDS General | True | Error | Normal | True | Directory Service |
| Active Directory cannot find any RPC protocol sequences installed | | Active_Directory_cannot_find_any_RPC_protocol_sequences_installed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1656 | NTDS General | True | Error | Normal | True | Directory Service |
| Active Directory cannot function normally | | Active_Directory_cannot_function_normally_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2011 | NTDS General | True | Error | Normal | True | Directory Service |
| Active Directory cannot perform an authenticated RPC call to another DC because the SPN for the destination DC is not registered on the KDC | | Active_Directory_cannot_perform_an_authenticated_RPC_call_to_another_DC_because_the_SPN_for_the_destination_DC_is_not_registered_on_the_KDC_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1645 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Active Directory cannot rebuild the following number of indices and has failed | | Active_Directory_cannot_rebuild_the_following_number_of_indices_and_has_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2016 | NTDS Database | True | Error | Normal | True | Directory Service |
| Active Directory cannot replicate configuration and schema information | | Active_Directory_cannot_replicate_configuration_and_schema_information_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2047 | NTDS General | True | Error | Normal | True | Directory Service |
| Active Directory cannot set the replication consistency registry key | | Active_Directory_cannot_set_the_replication_consistency_registry_key_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2033 | NTDS General | True | Warning | Normal | True | Directory Service |
| Active Directory cannot update object due to insufficient memory | | Active_Directory_cannot_update_object_due_to_insufficient_memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1479 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Active Directory cannot update the functional level on the NTDS Settings object for the local domain controller | | Active_Directory_cannot_update_the_functional_level_on_the_NTDS_Settings_object_for_the_local_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1721 | NTDS General | True | Error | Normal | True | Directory Service |
| Active Directory cannot validate the functional level of the domain controller | | Active_Directory_cannot_validate_the_functional_level_of_the_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1719 | NTDS General | True | Error | Normal | True | Directory Service |
| Active Directory cannot write a new security descriptor for object | | Active_Directory_cannot_write_a_new_security_descriptor_for_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1452 | NTDS SDPROP | True | Error | Normal | True | Directory Service |
| Active Directory encountered a replication error. Replication will be delayed. | | Active_Directory_encountered_a_replication_error.__Replication_will_be_delayed._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1958 | NTDS General | True | Warning | Normal | True | Directory Service |
| Active Directory has failed to upgrade a critical index as part of initialization | | Active_Directory_has_failed_to_upgrade_a_critical_index_as_part_of_initialization_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2045 | NTDS Database | True | Error | Normal | True | Directory Service |
| AD Replication is occurring slowly | | Active_Directory_Latency_Alert_Rule_For_Windows2000 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | | | 0 | 0 | | False | | | True | |
| AD Replication is occurring slowly | | Active_Directory_Latency_Alert_Rule_For_Windows2003 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | | | 0 | 0 | | False | | | True | |
| AD Replication is occurring slowly | | Active_Directory_Latency_Alert_Rule_For_Windows2008 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | | | 0 | 0 | | False | | | True | |
| Active Directory shadow copy restore was unsuccessful. The contents of Active Directory are unpredictable. | | Active_Directory_shadow_copy_restore_was_unsuccessful.__The_contents_of_Active_Directory_are_unpredictable._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1919 | NTDS Backup | True | Error | Normal | True | Directory Service |
| AD cannot allocate memory | | AD_cannot_allocate_memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NTDS General | True | Error | Normal | True | Directory Service |
| AD cannot find the NTDS object for this domain controller | | AD_cannot_find_the_NTDS_object_for_this_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1038 | | True | Error | Normal | True | Directory Service |
| AD cannot find the partition container | | AD_cannot_find_the_partition_container_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1256 | NTDS General | True | Error | Normal | True | Directory Service |
| AD cannot release memory | | AD_cannot_release_memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1158 | NTDS General | True | Error | Normal | True | Directory Service |
| AD cannot update object because the disk containing the database is full | | AD_cannot_update_object_because_the_disk_containing_the_database_is_full_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1480 | NTDS Replication | True | Error | Normal | True | Directory Service |
| AD cannot update the object | | AD_cannot_update_the_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1084 | NTDS Replication | True | Error | Normal | True | Directory Service |
| AD configuration information is missing from the registry | | AD_configuration_information_is_missing_from_the_registry_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1018 | NTDS General | True | Error | Normal | True | Directory Service |
| AD CPU Overload Event 1 | | AD_CPU_Overload_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD CPU Overload Script Based Test Failed to Complete | | AD_CPU_Overload_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD CPU Overload Script Parameters are configured incorrectly | | AD_CPU_Overload_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Database and Log Event 1 | | AD_Database_and_Log_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Database and Log Script Based Test Failed to Complete | | AD_Database_and_Log_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Database and Log The AD Management Pack does not support the agentless management mode | | AD_Database_and_Log_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD database is corrupt | | AD_database_is_corrupt_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1017 | NTDS General | True | Error | Normal | True | Directory Service |
| AD DC Demoted | | AD_DC_Demoted | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Maintenance | True | | | 0 | 0 | LSASRV | False | | | False | System |
| AD DC Demoted Event 1 | | AD_DC_Demoted_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD DC Demoted Script Based Test Failed to Complete | | AD_DC_Demoted_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD DNS Verification Script Based Test Failed to Complete | | AD_DNS_Verification_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD DNS Verification The AD Management Pack does not support the agentless management mode | | AD_DNS_Verification_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD General Response Last Bind Performance Collection | Collection for General Response - Active Directory Last Bind metric | AD_General_Response.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD General Response Event | | AD_General_Response_Pass_through | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD General Response Script Based Test Failed to Complete | | AD_General_Response_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD General Response Script Parameters are configured incorrectly | | AD_General_Response_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD General Response: The AD Management Pack does not support the agentless management mode | | AD_General_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Global Catalog Search Time Response Performance Collection | Collection for General Response - Global Catalog Search Time | AD_Global_Catalog_Search_Response.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Global Catalog Search Response Event 1 | | AD_Global_Catalog_Search_Response_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Global Catalog Search Response Event 2 | | AD_Global_Catalog_Search_Response_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Global Catalog Search Response Script Parameters are configured incorrectly | | AD_Global_Catalog_Search_Response_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Global Catalog Search Response The AD Management Pack does not support the agentless management mode | | AD_Global_Catalog_Search_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD internal error: reinstall server | | AD_internal_error__reinstall_server_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1021 | NTDS Replication | True | Error | Normal | True | Directory Service |
| AD Lost And Found Object Count Event 1 | | AD_Lost_And_Found_Object_Count_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Lost And Found Object Count Event 2 | | AD_Lost_And_Found_Object_Count_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Lost And Found Object Count Script Based Test Failed to Complete | | AD_Lost_And_Found_Object_Count_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Lost And Found Object Count The AD Management Pack does not support the agentless management mode | | AD_Lost_And_Found_Object_Count_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| Agent Proxy not enabled | AD MP Topology discovery requires that "Agent Proxy" is enabled for all managed DCs. See Knowledge for details | AD_MOM_Agent_Proxy_is_not_enabled | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Monitor Trusts AD Client Side Script Based Test Failed to Complete | | AD_Monitor_Trusts_AD_Client_Side_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Monitor Trusts Event 1 | | AD_Monitor_Trusts_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Monitor Trusts Event 2 | | AD_Monitor_Trusts_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Monitor Trusts The AD Management Pack does not support the agentless management mode | | AD_Monitor_Trusts_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Op Master PDC Last Ping Performance Collection | Collection for PDC Op Master - Op Master PDC Last Ping | AD_Op_Master_Response_1.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Op Master Schema Last Bind Performance Collection | Collection for Schema Op Master - Op Master Schema Last Bind | AD_Op_Master_Response_10.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Op Master PDC Last Bind PerformanceCollection | Collection for PDC Op Master - Op Master PDC Last Bind | AD_Op_Master_Response_2.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Op Master Domain Naming Last Ping Performance Collection | Collection for Domain Naming Op Master - Op Master Domain Naming Last Ping | AD_Op_Master_Response_3.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Op Master Domain Naming Last Bind Performance Collection | Collection for Domain Naming Op Master - Op Master Domain Naming Last Bind | AD_Op_Master_Response_4.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Op Master Infrastructure Last Ping Performance Collection | Collection for Infrastructure Op Master - Op Master Infrastructure Last Ping | AD_Op_Master_Response_5.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Op Master Infrastructure Last Bind Performance Collection | Collection for Infrastructure Op Master - Op Master Infrastructure Last Bind | AD_Op_Master_Response_6.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Op Master RID Last Ping Performance Collection | Collection for RID Op Master - Op Master RID Last Ping | AD_Op_Master_Response_7.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Op Master RID Last Bind Performance Collection | Collection for RID Op Master - Op Master RID Last Bind | AD_Op_Master_Response_8.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Op Master Schema Last Ping Performance Collection | Collection for Schema Op Master - Op Master Schema Last Ping | AD_Op_Master_Response_9.PerformanceCollection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Op Master Response Script Parameters are configured incorrectly | | AD_Op_Master_Response_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Op Master Response The AD Management Pack does not support the agentless management mode | | AD_Op_Master_Response_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Replication Monitoring Performance Collection (Sources) | Enable this rule on source DCs (see rule knowledge for details) | AD_Replication_Monitoring.Helper1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | | | 0 | 0 | | False | | | False | |
| AD Replication Monitoring Performance Collection (Targets) | Enable this rule on target DCs (see rule knowledge for details) | AD_Replication_Monitoring.Helper2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | False | | | 0 | 0 | | False | | | False | |
| AD Replication Performance Collection - Metric Replication Latency | See rule knowledge on how to enable this collection | AD_Replication_Monitoring.PerformanceCollection_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Replication Performance Collection - Metric Replication Latency:Minimum | See rule knowledge on how to enable this collection | AD_Replication_Monitoring.PerformanceCollection_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Replication Performance Collection - Metric Replication Latency:Maximum | See rule knowledge on how to enable this collection | AD_Replication_Monitoring.PerformanceCollection_3 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Replication Performance Collection - Metric Replication Latency:Average | See rule knowledge on how to enable this collection | AD_Replication_Monitoring.PerformanceCollection_4 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Replication Monitoring Access Denied | | AD_Replication_Monitoring_Access_Denied | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Replication Monitoring A problem has been detected with the trust relationship between two domains | | AD_Replication_Monitoring_A_problem_has_been_detected_with_the_trust_relationship_between_two_domains | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Replication Monitoring Event | | AD_Replication_Monitoring_Pass_through | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Replication Monitoring Script Based Test Failed to Complete | | AD_Replication_Monitoring_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Replication Monitoring Script Parameters are configured incorrectly | | AD_Replication_Monitoring_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Replication Monitoring The AD Management Pack does not support the agentless management mode | | AD_Replication_Monitoring_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Replication Monitoring Time skew detected | | AD_Replication_Monitoring_Time_skew_detected | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Replication Partner Count Script Based Test Failed to Complete | | AD_Replication_Partner_Count_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Replication Partner Count Script Parameters are configured incorrectly | | AD_Replication_Partner_Count_Script_Parameters_are_configured_incorrectly | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Replication Partner Count The AD Management Pack does not support the agentless management mode | | AD_Replication_Partner_Count_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Replication Partner Op Master Consistency AD Client Side Script Based Test Failed to Complete | | AD_Replication_Partner_Op_Master_Consistency_AD_Client_Side_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Replication Partner Op_Master Consistency Event 1 | | AD_Replication_Partner_Op_Master_Consistency_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Replication Partner Op_Master Consistency Event 2 | | AD_Replication_Partner_Op_Master_Consistency_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Replication Partner Op Master Consistency The AD Management Pack does not support the agentless management mode | | AD_Replication_Partner_Op_Master_Consistency_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Server Moved Site Rule | | AD_Server_Moved_Site | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Maintenance | True | | | 0 | 0 | | False | | | False | |
| AD Server Moved Site AD Client Side Script Based Test Failed to Complete | | AD_Server_Moved_Site_AD_Client_Side_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Server Moved Site Event 1 | | AD_Server_Moved_Site_Pass_through_1 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Server Moved Site Event 2 | | AD_Server_Moved_Site_Pass_through_2 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| AD Server Moved Site The AD Management Pack does not support the agentless management mode | | AD_Server_Moved_Site_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Validate Server Trust Event Script Based Test Failed to Complete | | AD_Validate_Server_Trust_Event_Script_Based_Test_Failed_to_Complete | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| AD Validate Server Trust Event The AD Management Pack does not support the agentless management mode | | AD_Validate_Server_Trust_Event_The_AD_Management_Pack_does_not_support_the_agentless_management_mode | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| All of the replication partners failed to replicate. | | All_replication_partners_failed_to_synchronize | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | | | 0 | 0 | | True | Warning | Normal | False | |
| An account cannot be added to the group | | An_account_cannot_be_added_to_the_group_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| An account name collision occurred - this may result in authentication failures | | An_account_name_collision_occurred___this_may_result_in_authentication_failures_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 5800 | NetLogon | True | Warning | Normal | True | System |
| An attempt to check whether group caching is enabled has failed | | An_attempt_to_check_whether_group_caching_is_enabled_has_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 12299 | Microsoft-Windows-Directory-Services-SAM | True | Error | Normal | True | System |
| An attempt to set the time was aborted due to the offset being too large | | An_attempt_to_set_the_time_was_aborted_due_to_the_offset_being_too_large_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 34 | W32Time | True | Error | Normal | True | System |
| An attempt to update user credentials failed | | An_attempt_to_update_user_credentials_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 12302 | Microsoft-Windows-Directory-Services-SAM | True | Error | Normal | True | System |
| An error occurred while granting rights to the Domain Administrators group | | An_error_occurred_while_granting_rights_to_the_Domain_Administrators_group_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1196 | NTDS Setup | True | Error | Normal | True | Directory Service |
| An internal AD error occurred | | An_internal_AD_error_occurred_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NTDS General | True | Error | Normal | True | Directory Service |
| An Intersite Messaging Service request to modify an LDAP object failed | | An_Intersite_Messaging_Service_request_to_modify_an_LDAP_object_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1407 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| An object cannot inherit a security identifier (SID) from another object | | An_object_cannot_inherit_a_security_identifier__SID__from_another_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1576 | NTDS Replication | True | Error | Normal | True | Directory Service |
| An object has been duplicated during a cross domain move | | An_object_has_been_duplicated_during_a_cross_domain_move_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1900 | NTDS Replication | True | Warning | Normal | True | Directory Service |
| Attempts to backup or restore Active Directory have failed or will fail | | Attempts_to_backup_or_restore_Active_Directory_have_failed_or_will_fail_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NTDS Backup | True | Error | Normal | True | Directory Service |
| Attempts to update Active Directory are failing | | Attempts_to_update_Active_Directory_are_failing_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1393 | NTDS General | True | Error | Normal | True | Directory Service |
| A certificate was not authenticated because the computer it came from is not a domain controller | | A_certificate_was_not_authenticated_because_the_computer_it_came_from_is_not_a_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1642 | NTDS Replication | True | Error | Normal | True | Directory Service |
| A dll cannot be loaded because the software was incorrectly installed | | A_dll_cannot_be_loaded_because_the_software_was_incorrectly_installed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| A DNS server used by this server for name resolution did not respond within the timeout interval | | A_DNS_server_used_by_this_server_for_name_resolution_did_not_respond_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | DNSAPI | True | Error | Normal | True | System |
| A domain controller has an extremely high number of replication partners | | A_domain_controller_has_an_extremely_high_number_of_replication_partners | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| A domain controller has an unusually high number of replication partners | | A_domain_controller_has_an_unusually_high_number_of_replication_partners | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| A domain controller made a replication request for a writable directory partition that has been denied by the local domain controller | | A_domain_controller_made_a_replication_request_for_a_writable_directory_partition_that_has_been_denied_by_the_local_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1977 | NTDS Replication | True | Warning | Normal | True | Directory Service |
| A GPO extension was not applied because the registry extension failed | | A_GPO_extension_was_not_applied_because_the_registry_extension_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| A Group Policy object cannot be found in Active Directory | | A_Group_Policy_object_cannot_be_found_in_Active_Directory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| A Group Policy Object has not been processed because the filter check could not be performed | | A_Group_Policy_Object_has_not_been_processed_because_the_filter_check_could_not_be_performed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| A Group Policy Object is corrupt. | | A_Group_Policy_Object_is_corrupt._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| A journal wrap error has occurred on the Sysvol | | A_journal_wrap_error_has_occurred_on_the_Sysvol_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | File Replication Service |
| A lingering object has been detected. Replication has been blocked. | | A_lingering_object_has_been_detected.__Replication_has_been_blocked._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1388 | NTDS Replication | True | Error | Normal | True | Directory Service |
| A problem has been detected with the trust relationship between two domains | | A_problem_has_been_detected_with_the_trust_relationship_between_two_domains | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| A replication island has been detected Replication will not occur across the enterprise | | A_replication_island_has_been_detected_Replication_will_not_occur_across_the_enterprise | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| A resource record for the computer name of the DC is not registered in the DNS database | | A_resource_record_for_the_computer_name_of_the_DC_is_not_registered_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | DNSAPI | True | Error | Normal | True | System |
| A RSoP (Resultant Set of Policies) error occurred | | A_RSoP__Resultant_Set_of_Policies__error_occurred_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| A schema collision occurred while replicating attribute definitions | | A_schema_collision_occurred_while_replicating_attribute_definitions_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1546 | NTDS General | True | Error | Normal | True | Directory Service |
| A schema collision occurred while replicating a class definition | | A_schema_collision_occurred_while_replicating_a_class_definition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1547 | NTDS General | True | Error | Normal | True | Directory Service |
| A user from a different forest logged onto this machine. Group policy processing has been effected. | | A_user_from_a_different_forest_logged_onto_this_machine._Group_policy_processing_has_been_effected._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| A well known account has been recreated because it did not exist | | A_well_known_account_has_been_recreated_because_it_did_not_exist_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 16406 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| A well known group has been recreated because it did not exist | | A_well_known_group_has_been_recreated_because_it_did_not_exist_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 16407 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| Cannot access the registry policy file | | Cannot_access_the_registry_policy_file_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Cannot delete a registry value | | Cannot_delete_a_registry_value_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Cannot process client side group policy extension | | Cannot_process_client_side_group_policy_extension_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Cannot read the GPO history | | Cannot_read_the_GPO_history_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Certificate for intersite replication was rejected | | Certificate_for_intersite_replication_was_rejected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Change Password on KRBTGT Account Failed | | Change_Password_on_KRBTGT_Account_Failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| Classes from COM.DLL not registered | | Classes_from_COM.DLL_not_registered_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1469 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| Collection Rule for No DC/GC in Site events | | Collection_Rule_for_No_DC_GC_in_Site_events_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NetLogon | False | | | True | System |
| Collection rule for the Replication Collisions Report | | Collection_rule_for_the_Replication_Collisions_Report_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | True | Directory Service |
| Collection rule for the Replication Failures Report | | Collection_rule_for_the_Replication_Failures_Report_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | True | Directory Service |
| Contacting the Domain Naming FSMO Role Holder has completed successfully | | Contacting_the_Domain_Naming_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| Contacting the Infrastructure FSMO Role Holder has completed successfully | | Contacting_the_Infrastructure_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| Contacting the PDC FSMO Role Holder has completed successfully | | Contacting_the_PDC_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| Contacting the RID Master FSMO Role Holder has completed successfully | | Contacting_the_RID_Master_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| Contacting the Schema Master FSMO Role Holder has completed successfully | | Contacting_the_Schema_Master_FSMO_Role_Holder_has_completed_successfully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| Corrupt Credentials | | Corrupt_Credentials_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| Could not determine the FSMO role holder | | Could_not_determine_the_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| Cross-domain Group Policy processing has been aborted because the other domain cannot be reached | | Cross_domain_Group_Policy_processing_has_been_aborted_because_the_other_domain_cannot_be_reached_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| DC has failed to synchronize naming context with its replication partner | | DC_2000_has_failed_to_synchronize_with_its_replication_partner | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | | | 0 | 0 | | False | | | False | |
| DC has failed to synchronize naming context with its replication partner | | DC_2003_has_failed_to_synchronize_with_its_replication_partner | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | | | 0 | 0 | | False | | | False | |
| DC has failed to synchronize naming context with its replication partner | | DC_2008_has_failed_to_synchronize_with_its_replication_partner | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | | | 0 | 0 | | False | | | False | |
| DC is both a Global Catalog and the Infrastructure Update master | | DC_is_both_a_Global_Catalog_and_the_Infrastructure_Update_master_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1419 | NTDS General | True | Error | Normal | True | Directory Service |
| Direct replication cannot occur as configured | | Direct_replication_cannot_occur_as_configured_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1090 | NTDS KCC | True | Error | Normal | True | Directory Service |
| DNS registrations of essential Domain controller records is failing | | DNS_registrations_of_essential_Domain_controller_records_is_failing_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Netlogon | True | Error | Normal | True | System |
| Domain Operation Mode has been changed to Native Mode | | Domain_Operation_Mode_has_been_changed_to_Native_Mode_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 16408 | Microsoft-Windows-Directory-Services-SAM | True | Information | Normal | True | System |
| Duplicate account names were detected - one account has been renamed | | Duplicate_account_names_were_detected___one_account_has_been_renamed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 12304 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| Duplicate moved object detected | | Duplicate_moved_object_detected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1429 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Duplicate User Principal Names have been detected | | Duplicate_User_Principal_Names_have_been_detected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 11 | KDC | True | Error | Normal | True | System |
| Failed to ping or bind to the Domain Naming Master FSMO role holder | | Failed_to_ping_or_bind_to_the_Domain_Naming_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| Failed to ping or bind to the Infrastructure Master FSMO role holder | | Failed_to_ping_or_bind_to_the_Infrastructure_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| Failed to ping or bind to the PDC FSMO role holder | | Failed_to_ping_or_bind_to_the_PDC_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| Failed to ping or bind to the RID Master FSMO role holder | | Failed_to_ping_or_bind_to_the_RID_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| Failed to ping or bind to the Schema Master FSMO role holder | | Failed_to_ping_or_bind_to_the_Schema_Master_FSMO_role_holder | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| Format of schedule object attribute unrecognized | | Format_of_schedule_object_attribute_unrecognized_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1121 | NTDS KCC | True | Error | Normal | True | Directory Service |
| FRS has not replicated one or more files in the Sysvol to other domain controllers | | FRS_has_not_replicated_one_or_more_files_in_the_Sysvol_to_other_domain_controllers_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | File Replication Service |
| FRS is scanning the system volume before sharing it | | FRS_is_scanning_the_system_volume_before_sharing_it_5_Rule | Microsoft.Windows.Server.2008.AD.EssentialService.NTFRS | EventCollection | True | | | 0 | 13566 | NtFrs | True | Information | Normal | True | File Replication Service |
| Group Cache Refresh cannot obtain a connection schedule to it's preferred site | | Group_Cache_Refresh_cannot_obtain_a_connection_schedule_to_it_s_preferred_site_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1672 | NTDS General | True | Warning | Normal | True | Directory Service |
| Group Cache Refresh cannot schedule an update | | Group_Cache_Refresh_cannot_schedule_an_update_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1671 | NTDS General | True | Warning | Normal | True | Directory Service |
| Group Cache Refresh found a GC in a non-optimal site | | Group_Cache_Refresh_found_a_GC_in_a_non_optimal_site_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1667 | NTDS General | True | Warning | Normal | True | Directory Service |
| Group Cache Refresh has reached the user limit for this domain controller | | Group_Cache_Refresh_has_reached_the_user_limit_for_this_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1669 | NTDS General | True | Warning | Normal | True | Directory Service |
| Group Policy processing aborted because a filter check for the GPO failed | | Group_Policy_processing_aborted_because_a_filter_check_for_the_GPO_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing aborted because the common name for the GPO cannot be accessed | | Group_Policy_processing_aborted_because_the_common_name_for_the_GPO_cannot_be_accessed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group policy processing aborted because the GPO does not have a version number | | Group_policy_processing_aborted_because_the_GPO_does_not_have_a_version_number_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group policy processing aborted - cannot connect to the Directory Service | | Group_policy_processing_aborted___cannot_connect_to_the_Directory_Service_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Group policy processing aborted - cannot determine site | | Group_policy_processing_aborted___cannot_determine_site_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Group policy processing aborted - reboot this machine | | Group_policy_processing_aborted___reboot_this_machine_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Group policy processing aborted - the search for the root AD object failed | | Group_policy_processing_aborted___the_search_for_the_root_AD_object_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Group Policy processing has been aborted because an invalid class of object was discovered | | Group_Policy_processing_has_been_aborted_because_an_invalid_class_of_object_was_discovered_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing has been aborted because GPO lists cannot be set up | | Group_Policy_processing_has_been_aborted_because_GPO_lists_cannot_be_set_up_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing has been aborted because of an invalid access configuration | | Group_Policy_processing_has_been_aborted_because_of_an_invalid_access_configuration_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing has been aborted because the extensions from the registry cannot be read | | Group_Policy_processing_has_been_aborted_because_the_extensions_from_the_registry_cannot_be_read_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing has been aborted because the file gpt.ini cannot be accessed | | Group_Policy_processing_has_been_aborted_because_the_file_gpt.ini_cannot_be_accessed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing has been aborted because the GPLink property of an object cannot be accessed | | Group_Policy_processing_has_been_aborted_because_the_GPLink_property_of_an_object_cannot_be_accessed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing has been aborted because the GPO does not have a functionality version number | | Group_Policy_processing_has_been_aborted_because_the_GPO_does_not_have_a_functionality_version_number_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing has been aborted because the user does not have access to an object | | Group_Policy_processing_has_been_aborted_because_the_user_does_not_have_access_to_an_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing has been aborted (in planning mode) because the user/computer does not have access to a required object | | Group_Policy_processing_has_been_aborted__in_planning_mode__because_the_user_computer_does_not_have_access_to_a_required_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing was aborted because a security check failed | | Group_Policy_processing_was_aborted_because_a_security_check_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing was aborted because historical data cannot be moved from the users old SID to their new one | | Group_Policy_processing_was_aborted_because_historical_data_cannot_be_moved_from_the_users_old_SID_to_their_new_one_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing was aborted because security cannot be set on Group Policy events | | Group_Policy_processing_was_aborted_because_security_cannot_be_set_on_Group_Policy_events_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing was aborted because the refresh timer cannot be set | | Group_Policy_processing_was_aborted_because_the_refresh_timer_cannot_be_set_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing was aborted because the search for objects cannot be completed | | Group_Policy_processing_was_aborted_because_the_search_for_objects_cannot_be_completed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing was aborted because the security ID of the user cannot be obtained | | Group_Policy_processing_was_aborted_because_the_security_ID_of_the_user_cannot_be_obtained_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Policy processing was aborted because the users security ID cannot be written to the registry | | Group_Policy_processing_was_aborted_because_the_users_security_ID_cannot_be_written_to_the_registry_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Group Refresh updates are falling behind | | Group_Refresh_updates_are_falling_behind_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1670 | NTDS General | True | Warning | Normal | True | Directory Service |
| Initial replication after domain controller promotion has not completed | | Initial_replication_after_domain_controller_promotion_has_not_completed | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| Internal async schema cache update failed | | Internal_async_schema_cache_update_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1208 | NTDS General | True | Error | Normal | True | Directory Service |
| Intersite Messaging Service SMTP Transport received a delivery failure | | Intersite_Messaging_Service_SMTP_Transport_received_a_delivery_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1448 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| Inter-Site Messaging Service SMTP Transport plug-in failed to add SMTP routing domain | | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_add_SMTP_routing_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1466 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| Inter-Site Messaging Service SMTP Transport plug-in failed to bind the event sink ismsink.dll to the SMTP Service | | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_bind_the_event_sink_ismsink.dll_to_the_SMTP_Service_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1468 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| Inter-Site Messaging Service SMTP Transport plug-in failed to read the SMTP mail message | | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_read_the_SMTP_mail_message_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1405 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| Inter-Site Messaging Service SMTP Transport plug-in failed to register the event sink ismsink.dll | | Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_register_the_event_sink_ismsink.dll_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1467 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| Inter-Site Messaging (ISM) Service SMTP Transport plug-in has determined that one or more classes from CDO library are not registered as expected | | Inter_Site_Messaging__ISM__Service_SMTP_Transport_plug_in_has_determined_that_one_or_more_classes_from_CDO_library_are_not_registered_as_expected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1527 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| Inter-Site Messaging (ISM) Service SMTP Transport plug-in has encountered an unexpected error from CDO library | | Inter_Site_Messaging__ISM__Service_SMTP_Transport_plug_in_has_encountered_an_unexpected_error_from_CDO_library_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1528 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| Invalid Forwarded AS Request | | Invalid_Forwarded_AS_Request_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| Invalid object class | | Invalid_object_class_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1205 | NTDS SDPROP | True | Error | Normal | True | Directory Service |
| Invalid Policy Data | | Invalid_Policy_Data_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| Invalid Script Parameter Configuration | | Invalid_Script_Parameter_Configuration | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| Invalid site link definition will be ignored | | Invalid_site_link_definition_will_be_ignored_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NTDS KCC | True | Error | Normal | True | Directory Service |
| ISM cannot receive messages | | ISM_cannot_receive_messages_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1373 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| ISM Request Failure | | ISM_Request_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| ISM transport has been shut down | | ISM_transport_has_been_shut_down_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1378 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| KCC cannot compute a replication path | | KCC_cannot_compute_a_replication_path_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1311 | NTDS KCC | True | Error | Normal | True | Directory Service |
| KCC cannot configure replication topology due to ISM failure | | KCC_cannot_configure_replication_topology_due_to_ISM_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1312 | NTDS KCC | True | Error | Normal | True | Directory Service |
| KCC failed to initialize | | KCC_failed_to_initialize_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1008 | NTDS KCC | True | Error | Normal | True | Directory Service |
| KCC failed to stop | | KCC_failed_to_stop_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1024 | NTDS KCC | True | Error | Normal | True | Directory Service |
| KCC failed to update replication topology | | KCC_failed_to_update_replication_topology_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1130 | NTDS KCC | True | Error | Normal | True | Directory Service |
| KCC is ignoring a replication path because non-intersecting schedules are preventing replication along that path | | KCC_is_ignoring_a_replication_path_because_non_intersecting_schedules_are_preventing_replication_along_that_path_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1788 | NTDS KCC | True | Error | Normal | True | Directory Service |
| LDAP agent cannot open security provider | | LDAP_agent_cannot_open_security_provider_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1238 | NTDS LDAP | True | Error | Normal | True | Directory Service |
| Local cleanup failed on cross domain move | | Local_cleanup_failed_on_cross_domain_move_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1432 | NTDS General | True | Error | Normal | True | Directory Service |
| Local group policy is disabled | | Local_group_policy_is_disabled_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Loopback processing has been disabled | | Loopback_processing_has_been_disabled_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The AD Machine Account Authentication Failures Report has data available | | Machine_Account_Authentication_Failure_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Netlogon | True | Error | Normal | True | System |
| Machine account policy failure - Active Directory GPO lookup failure | | Machine_account_policy_failure___Active_Directory_GPO_lookup_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Machine account policy failure - Security Configuration Engine error occurred | | Machine_account_policy_failure___Security_Configuration_Engine_error_occurred_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Manual deregistration of some DNS records is required | | Manual_deregistration_of_some_DNS_records_is_required_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 5808 | NetLogon | True | Warning | Normal | True | System |
| Memory Allocation Error - the system may be overloaded | | Memory_Allocation_Error___the_system_may_be_overloaded_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Memory cannot be allocated | | Memory_cannot_be_allocated_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| AD DC Performance Collection - Metric Memory Available Bytes | | Microsoft.Windows.Server.2008.AD.DomainController.AvailableBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Memory | Available Bytes | 300 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Memory Committed Bytes | | Microsoft.Windows.Server.2008.AD.DomainController.CommittedBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Memory | Committed Bytes | 300 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS DS Search sub-operations/sec | | Microsoft.Windows.Server.2008.AD.DomainController.DSSubSearch.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | DS Search sub-operations/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS KDC AS Requests | | Microsoft.Windows.Server.2008.AD.DomainController.KDCASRequests.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Security System-Wide Statistics | KDC AS Requests | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS KDC TGS Requests | | Microsoft.Windows.Server.2008.AD.DomainController.KDCTGRequests.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Security System-Wide Statistics | KDC TGS Requests | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS Kerberos Authentications | | Microsoft.Windows.Server.2008.AD.DomainController.KerberosAuth.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Security System-Wide Statistics | Kerberos Authentications | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS LDAP Client Sessions | | Microsoft.Windows.Server.2008.AD.DomainController.LDAPClientSessions.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | LDAP Client Sessions | 300 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS LDAP Searches/sec | | Microsoft.Windows.Server.2008.AD.DomainController.LDAPSearches.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | LDAP Searches/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS LDAP UDP operations/sec | | Microsoft.Windows.Server.2008.AD.DomainController.LDAPUDPOperations.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | LDAP UDP operations/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS LDAP Writes/sec | | Microsoft.Windows.Server.2008.AD.DomainController.LDAPWrites.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | LDAP Writes/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Process Handle Count of LSASS | | Microsoft.Windows.Server.2008.AD.DomainController.LSASSHandleCount.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Process | Handle Count | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Process Private Bytes of LSASS | | Microsoft.Windows.Server.2008.AD.DomainController.LSASSPrivateBytes.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Process | Private Bytes | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Process \% Processor Time of LSASS | | Microsoft.Windows.Server.2008.AD.DomainController.LSASSTotalCPU.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Process | \% Processor Time | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS NTLM Authentications | | Microsoft.Windows.Server.2008.AD.DomainController.NTLMAuthentications.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Security System-Wide Statistics | NTLM Authentications | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Memory Pages/sec | | Microsoft.Windows.Server.2008.AD.DomainController.Paging.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Memory | Pages/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Process \% Processor _Total | | Microsoft.Windows.Server.2008.AD.DomainController.ProcessorTime.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Processor | \% Processor Time | 300 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Server - Server Sessions | | Microsoft.Windows.Server.2008.AD.DomainController.ServerSessions.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | Server | Server Sessions | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric System - System Up Time | | Microsoft.Windows.Server.2008.AD.DomainController.SystemUpTime.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | System | System Up Time | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - TCPv4 - Connections Established | | Microsoft.Windows.Server.2008.AD.DomainController.TCPv4Connections.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | TCPv4 | Connections Established | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - TCPv6 - Connections Established | | Microsoft.Windows.Server.2008.AD.DomainController.TCPv6Connections.Collection | Microsoft.Windows.Server.2008.AD.DomainControllerRole | PerformanceCollection | True | TCPv6 | Connections Established | 900 | 0 | | False | | | False | |
| Miscellaneous KDC Errors | | Miscellaneous_KDC_Errors_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| Miscellaneous NetLogon Errors | | Miscellaneous_NetLogon_Errors_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| Miscellaneous SAM Errors | | Miscellaneous_SAM_Errors_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| Miscellaneous UserEnv Errors | | Miscellaneous_UserEnv_Errors_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Missing X.509 Domain Controller certificate | | Missing_X.509_Domain_Controller_certificate_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1383 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Name conflict detected while replicating partition | | Name_conflict_detected_while_replicating_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1127 | NTDS Replication | True | Error | Normal | True | Directory Service |
| None of the preferred bridgehead servers can replicate the directory partition | | None_of_the_preferred_bridgehead_servers_can_replicate_the_directory_partition_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1567 | NTDS KCC | True | Error | Normal | True | Directory Service |
| No changes detected in the list of GPOs | | No_changes_detected_in_the_list_of_GPOs_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| No input provider to sync time | | No_input_provider_to_sync_time_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 21 | W32Time | True | Error | Normal | True | System |
| No Key to Generate Kerberos Ticket | | No_Key_to_Generate_Kerberos_Ticket_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| No suitable domain controller is available for authentication in this domain | | No_suitable_domain_controller_is_available_for_authentication_in_this_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 5790 | NetLogon | True | Warning | Normal | True | System |
| One or more domain controllers may not be replicating | | One_or_more_domain_controllers_may_not_be_replicating_For_2000 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | | | 0 | 0 | | False | | | False | |
| One or more domain controllers may not be replicating | | One_or_more_domain_controllers_may_not_be_replicating_For_2003 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | | | 0 | 0 | | False | | | False | |
| One or more domain controllers may not be replicating | | One_or_more_domain_controllers_may_not_be_replicating_For_2008 | Microsoft.Windows.Server.2008.AD.DomainControllerRole | Custom | True | | | 0 | 0 | | False | | | False | |
| One or more of the DC Locator DNS records are not registered in the DNS database since the primary DNS server doesn't support the dynamic update of the DNS records | | One_or_more_of_the_DC_Locator_DNS_records_are_not_registered_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Netlogon | True | Error | Normal | True | System |
| PAC Verification Failure | | PAC_Verification_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| Policy Update Failure | | Policy_Update_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| Replication error | | Replication_error_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1694 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Replication has been aborted | | Replication_has_been_aborted_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1791 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Replication has been stopped with a source | | Replication_has_been_stopped_with_a_source__5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2042 | NTDS Replication | True | Warning | Normal | True | Directory Service |
| Report Collection - Machine Account Authentication Failures | | Report_Collection___Machine_Account_Authentication_Failures_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 5805 | NetLogon | False | | | True | System |
| Schedule attribute of siteLink object is invalid | | Schedule_attribute_of_siteLink_object_is_invalid_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| Schema cache load failed to convert the string default SD on class-schema object | | Schema_cache_load_failed_to_convert_the_string_default_SD_on_class_schema_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1523 | NTDS General | True | Error | Normal | True | Directory Service |
| Schema cache load failed to inherit all attributes for the class | | Schema_cache_load_failed_to_inherit_all_attributes_for_the_class_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1315 | NTDS General | True | Error | Normal | True | Directory Service |
| Security Descriptor Propagator has been terminated with error | | Security_Descriptor_Propagator_has_been_terminated_with_error_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1262 | NTDS SDPROP | True | Error | Normal | True | Directory Service |
| Session setup failed because no trust account exists : Script - AD Validate Server Trust Event | | Session_setup_failed_because_no_trust_account_exists___Script___AD_Validate_Server_Trust_Event_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 5723 | NetLogon | True | Error | Normal | True | System |
| Setting the administrators password failed. It has been reset to blank. | | Setting_the_administrators_password_failed.__It_has_been_reset_to_blank._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 16397 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| Site has no NTDS Site Settings object | | Site_has_no_NTDS_Site_Settings_object_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1550 | NTDS KCC | True | Error | Normal | True | Directory Service |
| Site link was not found | | Site_link_was_not_found_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1771 | NTDS KCC | True | Error | Normal | True | Directory Service |
| There are no domain-based Group Policy objects for this user/computer. | | There_are_no_domain_based_Group_Policy_objects_for_this_user_computer._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The account identifier pool for this domain controller cannot be updated | | The_account_identifier_pool_for_this_domain_controller_cannot_be_updated_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 16641 | Microsoft-Windows-Directory-Services-SAM | True | Warning | Normal | True | System |
| The Active Directory database is corrupt | | The_Active_Directory_database_is_corrupt_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 404 | NTDS ISAM | True | Error | Normal | True | Directory Service |
| The AD replication process is unable to continue | | The_AD_replication_process_is_unable_to_continue_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1107 | NTDS Replication | True | Error | Normal | True | Directory Service |
| The attempt to change the directory partition name to a name that is not conflicting failed | | The_attempt_to_change_the_directory_partition_name_to_a_name_that_is_not_conflicting_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1890 | NTDS General | True | Warning | Normal | True | Directory Service |
| The attempt to discover the tombstone lifetime from the domain failed | | The_attempt_to_discover_the_tombstone_lifetime_from_the_domain_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Directory Service |
| The attempt to move a child object to a container failed | | The_attempt_to_move_a_child_object_to_a_container_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Directory Service |
| The behavior version of the dsa object is higher than the behavior version of this OS | | The_behavior_version_of_the_dsa_object_is_higher_than_the_behavior_version_of_this_OS_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1720 | NTDS General | True | Error | Normal | True | Directory Service |
| The computer cannot function properly for authentication purposes | | The_computer_cannot_function_properly_for_authentication_purposes_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 5791 | NetLogon | True | Warning | Normal | True | System |
| The computer didn't have sufficient rights to perform the secure dynamic update | | The_computer_didnt_have_sufficient_rights_to_perform_the_secure_dynamic_update_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Netlogon | True | Error | Normal | True | System |
| The computer name cannot be mapped to an object in Active Directory - this may result in authentication failures | | The_computer_name_cannot_be_mapped_to_an_object_in_Active_Directory___this_may_result_in_authentication_failures_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 5801 | NetLogon | True | Warning | Normal | True | System |
| The computer's domain \%1 is unavailable. (\%2). | | The_computer_s_domain__1_is_unavailable.___2_.__5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The connection object translation task in the consistency checker is disabled | | The_connection_object_translation_task_in_the_consistency_checker_is__disabled_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1664 | NTDS KCC | True | Error | Normal | True | Directory Service |
| The DC was unable to obtain the next account-identifier | | The_DC_was_unable_to_obtain_the_next_account_identifier_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 16642 | Microsoft-Windows-Directory-Services-SAM | True | Warning | Normal | True | System |
| The default NTFS security settings have not been applied to Active Directory folders | | The_default_NTFS_security_settings_have_not_been_applied_to_Active_Directory_folders_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2001 | NTDS General | True | Warning | Normal | True | Directory Service |
| The deleted list for an extension cannot be obtained | | The_deleted_list_for_an_extension_cannot_be_obtained_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The directory forest behavior version and/or domain behavior version are changed to values incompatible with this version of Windows | | The_directory_forest_behavior_version_and_or_domain_behavior_version_are_changed_to_values_incompatible_with_this_version_of_Windows_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1726 | NTDS General | True | Error | Normal | True | Directory Service |
| The directory partition cannot be replicated over a specified transport because none of the domain controllers support the transport | | The_directory_partition_cannot_be_replicated_over_a_specified_transport_because_none_of_the_domain_controllers_support_the_transport_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1568 | NTDS KCC | True | Error | Normal | True | Directory Service |
| The DNS server with which this DC will register does not support the dynamic update protocol or the authoritative zone is not configured to allow dynamic updates | | The_DNS_server_with_which_this_DC_will_register_does_not_support_1_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Netlogon | True | Error | Normal | True | System |
| The domain behavior version or the forest behavior version is incompatible with this version of Windows | | The_domain_behavior_version_or_the_forest_behavior_version_is_incompatible_with_this_version_of_Windows_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1718 | NTDS General | True | Error | Normal | True | Directory Service |
| The Domain Changes report has data available | | The_Domain_Changes_report_has_data_available_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Microsoft-Windows-Directory-Services-SAM | True | Information | Normal | True | System |
| The domain controller failed to obtain a new account identifier pool | | The_domain_controller_failed_to_obtain_a_new_account_identifier_pool_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 16651 | Microsoft-Windows-Directory-Services-SAM | True | Warning | Normal | True | System |
| The Domain Controller has been started | | The_Domain_Controller_has_been_started_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 6005 | EventLog | True | Information | Normal | True | System |
| The Domain Controller has been stopped | | The_Domain_Controller_has_been_stopped_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 6006 | EventLog | True | Information | Normal | True | System |
| The Domain Controller has shutdown unexpectedly | | The_Domain_Controller_has_shutdown_unexpectedly_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 6008 | EventLog | True | Error | Normal | True | System |
| The domain controller is booting to directory services restore mode | | The_domain_controller_is_booting_to_directory_services_restore_mode_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 16652 | Microsoft-Windows-Directory-Services-SAM | True | Information | Normal | True | System |
| The DS Service Configuration object is not found. You will not be able to set service parameters. | | The_DS_Service_Configuration_object_is_not_found.__You_will_not_be_able_to_set_service_parameters._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2031 | NTDS General | True | Warning | Normal | True | Directory Service |
| The GPO cannot be processed because it was created by an old version of the GPO editor | | The_GPO_cannot_be_processed_because_it_was_created_by_an_old_version_of_the_GPO_editor_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The group caching option has now been properly updated | | The_group_caching_option_has_now_been_properly_updated_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 12300 | Microsoft-Windows-Directory-Services-SAM | True | Information | Normal | True | System |
| The Group Policy client side extension failed to execute | | The_Group_Policy_client_side_extension_failed_to_execute_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The Intersite Messaging service failed to start the RPC server because it was unable to register authentication information. | | The_Intersite_Messaging_service_failed_to_start_the_RPC_server_because_it_was_unable_to_register_authentication_information._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1861 | NTDS Inter-site Messaging | True | Warning | Normal | True | Directory Service |
| The Inter-Site Messaging Service cannot allocate memory | | The_Inter_Site_Messaging_Service_cannot_allocate__memory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1815 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The Inter-Site Messaging Service cannot perform a requested LDAP bind operation | | The_Inter_Site_Messaging_Service_cannot_perform_a_requested_LDAP_bind_operation_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1824 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The Inter-Site Messaging Service encountered an error while attempting to start the Service Control Dispatcher | | The_Inter_Site_Messaging_Service_encountered_an_error_while__attempting_to_start_the_Service_Control_Dispatcher_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1811 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The Inter-Site Messaging Service encountered a malformed transport distinguished name | | The_Inter_Site_Messaging_Service_encountered_a_malformed__transport_distinguished_name_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1814 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The Inter-Site Messaging Service failed to create an event | | The_Inter_Site_Messaging_Service_failed_to_create_an_event_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1813 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The Inter-Site Messaging Service failed to initialize | | The_Inter_Site_Messaging_Service_failed_to_initialize_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1812 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The Inter-Site Messaging Service failed to start | | The_Inter_Site_Messaging_Service_failed_to_start_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The Inter-Site Messaging Service failed to start the RPC server | | The_Inter_Site_Messaging_Service_failed_to_start_the_RPC_server_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The Inter-Site Messaging Service failed to wait for a message | | The_Inter_Site_Messaging_Service_failed_to_wait_for_a_message_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1810 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The Inter-Site Messaging Service requested to abandon an LDAP notification message | | The_Inter_Site_Messaging_Service_requested_to_abandon_an_LDAP_notification_message_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1823 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The Inter-Site Messaging Service SMTP Transport plug-in failed to remove SMTP routing domain | | The_Inter_Site_Messaging_Service_SMTP_Transport_plug_in_failed_to_remove__SMTP_routing_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1834 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The Knowledge Consistency Checker (KCC) cannot run successfully. Replication may be affected | | The_Knowledge_Consistency_Checker__KCC__cannot_run_successfully.__Replication_may_be_affected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2002 | NTDS KCC | True | Warning | Normal | True | Directory Service |
| The Knowledge Consistency Checker (KCC) detected an incompatible up-to-dateness vector format | | The_Knowledge_Consistency_Checker__KCC__detected_an_incompatible_up_to_dateness_vector_format_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1910 | NTDS KCC | True | Error | Normal | True | Directory Service |
| The list of GPOs for this user or computer has changed | | The_list_of_GPOs_for_this_user_or_computer_has_changed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| The local domain controller has attempted to replicate an object which is not present because it may have been deleted and already garbage collected | | The_local_domain_controller_has_attempted_to_replicate_an_object_which_is_not_present_because_it_may_have_been_deleted_and_already_garbage_collected_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1988 | NTDS Replication | True | Error | Normal | True | Directory Service |
| The local domain controller has denied a replication attempt on a directory partition. This may pose a security risk | | The_local_domain_controller_has_denied_a_replication_attempt_on_a_directory_partition.__This_may_pose_a_security_risk_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1964 | NTDS Replication | True | Error | Normal | True | Directory Service |
| The machine account cannot be found | | The_machine_account_cannot_be_found_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The NetLogon service on remote machines will not be able to connect to this DC over TCP/IP resulting in authentication failure | | The_NetLogon_service_on_remote_machines_will_not_be_able_to_connect_to_this_DC_over_TCP_IP_resulting_in_authentication_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 5809 | NetLogon | True | Warning | Normal | True | System |
| The non-domain naming context has no security descriptor reference domain | | The_non_domain_naming_context_has_no_security_descriptor_reference_domain_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1769 | NTDS General | True | Error | Normal | True | Directory Service |
| The number of Group Policies has exceeded the maximum limit | | The_number_of_Group_Policies_has_exceeded_the_maximum_limit_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The object does not exist in Active Directory | | The_object_does_not_exist_in_Active_Directory_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| The registry key cannot be created | | The_registry_key_cannot_be_created_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| The registry policy file could not be accessed during application of machine policy | | The_registry_policy_file_could_not_be_accessed_during_application_of_machine_policy_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The registry value cannot be set | | The_registry_value_cannot_be_set_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| The script cannot locate the server or its site in Active Directory | | The_script_cannot_locate_the_server_or_its_site_in_Active_Directory | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| The search for objects in the schema directory partition failed | | The_search_for_objects_in_the_schema_directory_partition_failed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1135 | NTDS General | True | Error | Normal | True | Directory Service |
| The security descriptor propagation task encountered an error | | The_security_descriptor_propagation_task_encountered_an_error_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2008 | NTDS SDPROP | True | Warning | Normal | True | Directory Service |
| The server has moved between sites | | The_server_has_moved_between_sites | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Operations Manager |
| The Services container has more than one object of class msExchConfigurationContainer as an immediate child | | The_Services_container_has_more_than_one_object_of_class_msExchConfigurationContainer_as_an_immediate_child_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 2048 | NTDS General | True | Warning | Normal | True | Directory Service |
| The site cannot be found | | The_site_cannot_be_found_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1768 | NTDS KCC | True | Error | Normal | True | Directory Service |
| The site contains one or more domain controllers, but is not connected by any site links | | The_site_contains_one_or_more_domain_controllers_but_is_not_connected_by_any_site_links_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1789 | NTDS KCC | True | Error | Normal | True | Directory Service |
| The site name cannot be queried for | | The_site_name_cannot_be_queried_for_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| The SMTP domain administrative namespace is not available at this time | | The_SMTP_domain_administrative_namespace_is_not_available_at_this_time_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1832 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The system clock has not been synchronized for some time | | The_system_clock_has_not_been_synchronized_for_some_time_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 36 | W32Time | True | Warning | Normal | True | System |
| The system failed to promote this server into a Global Catalog | | The_system_failed_to_promote_this_server_into_a_Global_Catalog_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1790 | NTDS Replication | True | Error | Normal | True | Directory Service |
| The task that monitors Active Directory for changes in the Inter-Site Transport objects failed to start | | The_task_that_monitors_Active_Directory_for_changes_in_the_Inter_Site_Transport_objects_failed_to_start_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1825 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| The user or computer does not have access to a GPO | | The_user_or_computer_does_not_have_access_to_a_GPO_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| The user or computer does not pass the filter check to the GPO | | The_user_or_computer_does_not_pass_the_filter_check_to_the_GPO_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| The WMI service is disabled. A Group Policy object has not been processed | | The_WMI_service_is_disabled.__A_Group_Policy_object_has_not_been_processed_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| This domain controller failed to register as (and will not advertise as) a global catalog | | This_domain_controller_failed_to_register_as__and_will_not_advertise_as__a_global_catalog_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1992 | NTDS General | True | Warning | Normal | True | Directory Service |
| This domain controller has been promoted to PDC | | This_domain_controller_has_been_promoted_to_PDC_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 12297 | Microsoft-Windows-Directory-Services-SAM | True | Information | Normal | True | System |
| This domain controller will not start up because its machine account has been deleted | | This_domain_controller_will_not_start_up_because_its_machine_account_has_been_deleted_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 16405 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| This server cannot process the replication request | | This_server_cannot_process_the_replication_request_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1700 | NTDS Replication | True | Error | Normal | True | Directory Service |
| This server is no longer a domain controller | | This_server_is_no_longer_a_domain_controller_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | LSASRV | True | Information | Normal | True | System |
| This source server failed to add schema information for the mail replication request | | This_source_server_failed_to_add_schema_information_for_the_mail_replication_request_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1701 | NTDS Replication | True | Error | Normal | True | Directory Service |
| This source server failed to generate the changes | | This_source_server_failed_to_generate_the_changes_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1699 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Thread in directory is waiting for remote procedure call | | Thread_in_directory_is_waiting_for_remote_procedure_call_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1188 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Transport initialization failure | | Transport_initialization_failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1377 | NTDS Inter-site Messaging | True | Error | Normal | True | Directory Service |
| Trusted Domain List Update Failure | | Trusted_Domain_List_Update_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| Two replication partners have an inconsistent view of the FSMO role holders | | Two_replication_partners_have_an_inconsistent_view_of_the_FSMO_role_holders | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| Unable to establish connection with any Global Catalog(s) | | Unable_to_establish_connection_with_any_Global_Catalog_s__5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1126 | NTDS General | True | Error | Normal | True | Directory Service |
| Unable to establish connection with server | | Unable_to_establish_connection_with_server_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1125 | NTDS Replication | True | Error | Normal | True | Directory Service |
| Unable to open performance counters | | Unable_to_open_performance_counters_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NTDS General | True | Error | Normal | True | Directory Service |
| Unable to set privileges necessary for security checks | | Unable_to_set_privileges_necessary_for_security_checks_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1209 | NTDS General | True | Error | Normal | True | Directory Service |
| Unexpected Error applying group policy to machine account | | Unexpected_Error_applying_group_policy_to_machine_account_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Unexpected SAM Failure | | Unexpected_SAM_Failure_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | System |
| Windows cannot access information in the registry | | Windows_cannot_access_information_in_the_registry_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Windows cannot determine the role of this computer. | | Windows_cannot_determine_the_role_of_this_computer._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Windows cannot determine the user or computer name. | | Windows_cannot_determine_the_user_or_computer_name._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Windows cannot load extension | | Windows_cannot_load_extension_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| Windows cannot obtain the domain controller name for your computer network. | | Windows_cannot_obtain_the_domain_controller_name_for_your_computer_network._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Windows cannot read the history of GPOs from the registry. | | Windows_cannot_read_the_history_of_GPOs_from_the_registry._5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | True | Application |
| Windows Directory Service (Active Directory) cannot be initialized | | Windows_Directory_Service__Active_Directory__cannot_be_initialized_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1003 | NTDS General | True | Error | Normal | True | Directory Service |
| Windows Directory Service (Active Directory) exception | | Windows_Directory_Service__Active_Directory__exception_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 1046 | NTDS General | True | Error | Normal | True | Directory Service |
| Windows is setting a registry value | | Windows_is_setting_a_registry_value_5_Rule | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Error | Normal | True | Application |
| WMI Replication Provider is not installed Replication cannot be monitored fully | | WMI_Replication_Provider_is_not_installed_Replication_cannot_be_monitored_fully | Microsoft.Windows.Server.2008.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
Home