| | DisplayName | Description | ID | Target | Category | Enabled | Instance Name | Counter Name | Frequency | Event_ID | Event Source | Alert Generate | Alert Severity | Alert Priority | Remotable | Event Log |
|---|
 | Accounts with the same SID have been detected - one has been deleted | | Accounts_with_the_same_SID_have_been_detected___one_has_been_deleted_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 12303 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| Create Account Changes Report | | Account_Changes_Report_Creation_Only_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | False | | | 0 | 0 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| Account creation will fail on this domain controller until the account identifier pool is obtained | | Account_creation_will_fail_on_this_domain_controller_until_the_account_identifier_pool_is_obtained_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 16643 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| Account Name Not Unique | | Account_Name_Not_Unique_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | False | | | 0 | 11 | Microsoft-Windows-Kerberos-Key-Distribution-Center | False | | | True | System |
| Agent Proxy not enabled | AD MP Topology discovery requires that "Agent Proxy" is enabled for all managed DCs. See Knowledge for details | AD_MOM_Agent_Proxy_is_not_enabled | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | True | Warning | Normal | False | Operations Manager |
| An account cannot be added to the group | | An_account_cannot_be_added_to_the_group_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| An account name collision occurred - this may result in authentication failures | | An_account_name_collision_occurred___this_may_result_in_authentication_failures_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 5800 | NetLogon | False | | | True | System |
| An attempt to check whether group caching is enabled has failed | | An_attempt_to_check_whether_group_caching_is_enabled_has_failed_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 12299 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| An attempt to set the time was aborted due to the offset being too large | | An_attempt_to_set_the_time_was_aborted_due_to_the_offset_being_too_large_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 34 | Microsoft-Windows-Time-Service | False | | | True | System |
| An attempt to update user credentials failed | | An_attempt_to_update_user_credentials_failed_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 12302 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| A dll cannot be loaded because the software was incorrectly installed | | A_dll_cannot_be_loaded_because_the_software_was_incorrectly_installed_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | True | Application |
| A DNS server used by this server for name resolution did not respond within the timeout interval | | A_DNS_server_used_by_this_server_for_name_resolution_did_not_respond_1_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | DNSAPI | False | | | True | System |
| A resource record for the computer name of the DC is not registered in the DNS database | | A_resource_record_for_the_computer_name_of_the_DC_is_not_registered_1_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | DNSAPI | False | | | True | System |
| A RSoP (Resultant Set of Policies) error occurred | | A_RSoP__Resultant_Set_of_Policies__error_occurred_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Microsoft-Windows-GroupPolicy | False | | | True | System |
| A user from a different forest logged onto this machine. Group policy processing has been effected. | | A_user_from_a_different_forest_logged_onto_this_machine._Group_policy_processing_has_been_effected._5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 1109 | Microsoft-Windows-GroupPolicy | False | | | True | System |
| A well known account has been recreated because it did not exist | | A_well_known_account_has_been_recreated_because_it_did_not_exist_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 16406 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| A well known group has been recreated because it did not exist | | A_well_known_group_has_been_recreated_because_it_did_not_exist_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 16407 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| Change Password on KRBTGT Account Failed | | Change_Password_on_KRBTGT_Account_Failed_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 10 | Microsoft-Windows-Kerberos-Key-Distribution-Center | False | | | True | System |
| Collection Rule for No DC/GC in Site events | | Collection_Rule_for_No_DC_GC_in_Site_events_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | NetLogon | False | | | True | System |
| Corrupt Credentials | | Corrupt_Credentials_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 13 | Microsoft-Windows-Kerberos-Key-Distribution-Center | False | | | True | System |
| Domain Operation Mode has been changed to Native Mode | | Domain_Operation_Mode_has_been_changed_to_Native_Mode_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 16408 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| Duplicate account names were detected - one account has been renamed | | Duplicate_account_names_were_detected___one_account_has_been_renamed_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 12304 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| Duplicate User Principal Names have been detected | | Duplicate_User_Principal_Names_have_been_detected_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 11 | Microsoft-Windows-Kerberos-Key-Distribution-Center | False | | | True | System |
| Group policy processing aborted - cannot determine site | | Group_policy_processing_aborted___cannot_determine_site_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 1007 | Microsoft-Windows-GroupPolicy | False | | | True | System |
| Invalid Forwarded AS Request | | Invalid_Forwarded_AS_Request_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 15 | Microsoft-Windows-Kerberos-Key-Distribution-Center | False | | | True | System |
| Invalid Policy Data | | Invalid_Policy_Data_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 17 | Microsoft-Windows-Kerberos-Key-Distribution-Center | False | | | True | System |
| Machine account policy failure - Active Directory GPO lookup failure | | Machine_account_policy_failure___Active_Directory_GPO_lookup_failure_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 1030 | Microsoft-Windows-GroupPolicy | False | | | True | System |
| Machine account policy failure - Security Configuration Engine error occurred | | Machine_account_policy_failure___Security_Configuration_Engine_error_occurred_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | True | Application |
| Memory Allocation Error - the system may be overloaded | | Memory_Allocation_Error___the_system_may_be_overloaded_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 1002 | Microsoft-Windows-GroupPolicy | False | | | True | System |
| Active Directory Web Services Error Events | | Microsoft.Windows.Server.2016.AD.ActiveDirectoryWebServices.Error.EventCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Active Directory Web Services |
| Active Directory Web Services Information Events | | Microsoft.Windows.Server.2016.AD.ActiveDirectoryWebServices.Information.EventCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | False | | | 0 | 0 | | False | | | False | Active Directory Web Services |
| Active Directory Web Services Warning Events | | Microsoft.Windows.Server.2016.AD.ActiveDirectoryWebServices.Warning.EventCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Active Directory Web Services |
| Free Disk Space Database Drive Collection | Collection for the amount of free disk space on the drive that holds the database file | Microsoft.Windows.Server.2016.AD.Availability.DiskSpace.DIT.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| Free Disk Space Log Drive Collection | Collection for the amount of free disk space on the drive that holds the log file | Microsoft.Windows.Server.2016.AD.Availability.DiskSpace.Log.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Database Size Collection | Collection for the size of the AD database (DIT) file | Microsoft.Windows.Server.2016.AD.Availability.Size.DIT.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD DC DFS Replication Error Events | | Microsoft.Windows.Server.2016.AD.DFSReplication.Error.EventCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | DFS Replication |
| AD DC DFS Replication Information Events | | Microsoft.Windows.Server.2016.AD.DFSReplication.Information.EventCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | False | | | 0 | 0 | | False | | | False | DFS Replication |
| AD DC DFS Replication Warning Events | | Microsoft.Windows.Server.2016.AD.DFSReplication.Warning.EventCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | DFS Replication |
| AD DC Directory Services Error Events | | Microsoft.Windows.Server.2016.AD.DirectoryService.Error.EventCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Directory Service |
| AD DC Directory Services Information Events | | Microsoft.Windows.Server.2016.AD.DirectoryService.Information.EventCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | False | | | 0 | 0 | | False | | | False | Directory Service |
| AD DC Directory Services Warning Events | | Microsoft.Windows.Server.2016.AD.DirectoryService.Warning.EventCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | False | Directory Service |
| AD DC DNS Server Error Events | | Microsoft.Windows.Server.2016.AD.DNSServer.Error.EventCollection | Microsoft.Windows.Server.2016.AD.DomainController.DNS | EventCollection | True | | | 0 | 0 | | False | | | False | DNS Server |
| AD DC DNS Server Information Events | | Microsoft.Windows.Server.2016.AD.DNSServer.Information.EventCollection | Microsoft.Windows.Server.2016.AD.DomainController.DNS | EventCollection | False | | | 0 | 0 | | False | | | False | DNS Server |
| AD DC DNS Server Warning Events | | Microsoft.Windows.Server.2016.AD.DNSServer.Warning.EventCollection | Microsoft.Windows.Server.2016.AD.DomainController.DNS | EventCollection | True | | | 0 | 0 | | False | | | False | DNS Server |
| AD DC Performance Collection - ATQ Outstanding Queued Requests | | Microsoft.Windows.Server.2016.AD.DomainController.Atq.OutstandingQueuedRequests.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | ATQ Outstanding Queued Requests | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - ATQ Request Latency | | Microsoft.Windows.Server.2016.AD.DomainController.Atq.RequestLatency.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | ATQ Request Latency | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - ATQ Threads LDAP | | Microsoft.Windows.Server.2016.AD.DomainController.Atq.ThreadsLdap.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | ATQ Threads LDAP | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - ATQ Threads Other | | Microsoft.Windows.Server.2016.AD.DomainController.Atq.ThreadsOther.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | ATQ Threads Other | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - ATQ Threads Total | | Microsoft.Windows.Server.2016.AD.DomainController.Atq.ThreadsTotal.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | ATQ Threads Total | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Memory Available Bytes | | Microsoft.Windows.Server.2016.AD.DomainController.AvailableBytes.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Memory | Available Bytes | 300 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Memory Committed Bytes | | Microsoft.Windows.Server.2016.AD.DomainController.CommittedBytes.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Memory | Committed Bytes | 300 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric DNS Private Bytes | | Microsoft.Windows.Server.2016.AD.DomainController.DNSPrivateBytes.Collection | Microsoft.Windows.Server.2016.AD.DomainController.DNS | PerformanceCollection | True | Process | Private Bytes | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric DNS Queries Received/Sec | | Microsoft.Windows.Server.2016.AD.DomainController.DNSQueryReceived.Collection | Microsoft.Windows.Server.2016.AD.DomainController.DNS | PerformanceCollection | True | DNS | Total Query Received/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric DNS Total CPU | | Microsoft.Windows.Server.2016.AD.DomainController.DNSTotalCPU.Collection | Microsoft.Windows.Server.2016.AD.DomainController.DNS | PerformanceCollection | True | Process | \% Processor Time | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS DRA Inbound Bytes Compressed (Between Sites, Before Compression)/sec | | Microsoft.Windows.Server.2016.AD.DomainController.DRAInboundBytes.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | DRA Inbound Bytes Compressed (Between Sites, Before Compression)/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS DRA Inbound Bytes Compressed (Between Sites, After Compression)/sec | | Microsoft.Windows.Server.2016.AD.DomainController.DRAInboundBytesComp.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | DRA Inbound Bytes Compressed (Between Sites, After Compression)/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS DRA Inbound Bytes Not Compressed (Within Site)/sec | | Microsoft.Windows.Server.2016.AD.DomainController.DRAInboundBytesNotComp.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | DRA Inbound Bytes Not Compressed (Within Site)/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS DRA Inbound Bytes Total/sec | | Microsoft.Windows.Server.2016.AD.DomainController.DRAInboundBytesTotal.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | DRA Inbound Bytes Total/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS DRA Outbound Bytes Compressed (Between Sites, After Compression)/sec | | Microsoft.Windows.Server.2016.AD.DomainController.DRAIntersiteOutBytes.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | DRA Outbound Bytes Compressed (Between Sites, After Compression)/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS DRA Outbound Bytes Compressed (Between Sites, Before Compression)/sec | | Microsoft.Windows.Server.2016.AD.DomainController.DRAOutboundBytesComp.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | DRA Outbound Bytes Compressed (Between Sites, Before Compression)/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS DRA Outbound Bytes Not Compressed (Within Site)/sec | | Microsoft.Windows.Server.2016.AD.DomainController.DRAOutboundBytesNotComp.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | DRA Outbound Bytes Not Compressed (Within Site)/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS DRA Outbound Bytes Total/Sec | | Microsoft.Windows.Server.2016.AD.DomainController.DRAOutboundBytesTotal.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | DRA Outbound Bytes Total/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS DS Search sub-operations/sec | | Microsoft.Windows.Server.2016.AD.DomainController.DSSubSearch.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | DS Search sub-operations/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS KDC AS Requests | | Microsoft.Windows.Server.2016.AD.DomainController.KDCASRequests.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Security System-Wide Statistics | KDC AS Requests | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS KDC TGS Requests | | Microsoft.Windows.Server.2016.AD.DomainController.KDCTGRequests.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Security System-Wide Statistics | KDC TGS Requests | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS Kerberos Authentications | | Microsoft.Windows.Server.2016.AD.DomainController.KerberosAuth.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Security System-Wide Statistics | Kerberos Authentications | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS LDAP Client Sessions | | Microsoft.Windows.Server.2016.AD.DomainController.LDAPClientSessions.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | LDAP Client Sessions | 300 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS LDAP Searches/sec | | Microsoft.Windows.Server.2016.AD.DomainController.LDAPSearches.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | LDAP Searches/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS LDAP UDP operations/sec | | Microsoft.Windows.Server.2016.AD.DomainController.LDAPUDPOperations.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | LDAP UDP operations/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS LDAP Writes/sec | | Microsoft.Windows.Server.2016.AD.DomainController.LDAPWrites.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | DirectoryServices | LDAP Writes/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Process Handle Count of LSASS | | Microsoft.Windows.Server.2016.AD.DomainController.LSASSHandleCount.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Process | Handle Count | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Process Private Bytes of LSASS | | Microsoft.Windows.Server.2016.AD.DomainController.LSASSPrivateBytes.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Process | Private Bytes | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Process \% Processor Time of LSASS | | Microsoft.Windows.Server.2016.AD.DomainController.LSASSTotalCPU.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Process | \% Processor Time | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric NTDS NTLM Authentications | | Microsoft.Windows.Server.2016.AD.DomainController.NTLMAuthentications.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Security System-Wide Statistics | NTLM Authentications | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Memory Pages/sec | | Microsoft.Windows.Server.2016.AD.DomainController.Paging.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Memory | Pages/sec | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Process \% Processor _Total | | Microsoft.Windows.Server.2016.AD.DomainController.ProcessorTime.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Processor | \% Processor Time | 300 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric Server - Server Sessions | | Microsoft.Windows.Server.2016.AD.DomainController.ServerSessions.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | Server | Server Sessions | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - Metric System - System Up Time | | Microsoft.Windows.Server.2016.AD.DomainController.SystemUpTime.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | System | System Up Time | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - TCPv4 - Connections Established | | Microsoft.Windows.Server.2016.AD.DomainController.TCPv4Connections.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | TCPv4 | Connections Established | 900 | 0 | | False | | | False | |
| AD DC Performance Collection - TCPv6 - Connections Established | | Microsoft.Windows.Server.2016.AD.DomainController.TCPv6Connections.Collection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | TCPv6 | Connections Established | 900 | 0 | | False | | | False | |
| LDAP Bind Time Performance Collection | Collection for LDAP Bind Time metrics | Microsoft.Windows.Server.2016.AD.Performance.BindTimes.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| Domain Naming Master LDAP Bind Performance Collection | Collection for the Domain Naming Master LDAP bind times. | Microsoft.Windows.Server.2016.AD.Performance.FsmoResponse.Bind.Domain.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| Infrastructure Master LDAP Bind Performance Collection | Collection for the Infrastructure Master LDAP bind times. | Microsoft.Windows.Server.2016.AD.Performance.FsmoResponse.Bind.Infra.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| PDC LDAP Bind Performance Collection | Collection for the PDC LDAP bind times. | Microsoft.Windows.Server.2016.AD.Performance.FsmoResponse.Bind.PDC.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| RID Master LDAP Bind Performance Collection | Collection for the RID Master LDAP bind times. | Microsoft.Windows.Server.2016.AD.Performance.FsmoResponse.Bind.RID.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| Schema Master LDAP Bind Performance Collection | Collection for the Schema Master LDAP bind times. | Microsoft.Windows.Server.2016.AD.Performance.FsmoResponse.Bind.Schema.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| Domain Naming Master Ping Performance Collection | Collection for the Domain Naming Master ping times. | Microsoft.Windows.Server.2016.AD.Performance.FsmoResponse.Ping.Domain.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| Infrastructure Master Ping Performance Collection | Collection for the Infrastructure Master ping times. | Microsoft.Windows.Server.2016.AD.Performance.FsmoResponse.Ping.Infra.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| PDC Ping Performance Collection | Collection for the PDC ping times. | Microsoft.Windows.Server.2016.AD.Performance.FsmoResponse.Ping.PDC.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| RID Master Ping Performance Collection | Collection for the RID Master ping times. | Microsoft.Windows.Server.2016.AD.Performance.FsmoResponse.Ping.RID.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| Schema Master Ping Performance Collection | Collection for the Schema Master ping times. | Microsoft.Windows.Server.2016.AD.Performance.FsmoResponse.Ping.Schema.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| Global Catalog Search Response Time Collection | Collection for Global Catalog Search Time | Microsoft.Windows.Server.2016.AD.Performance.GCResponse.PerformanceCollection | Microsoft.Windows.Server.2016.AD.GlobalCatalogServerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD Replication Queue Performance Collection | Collection for the AD Replication Queue size. | Microsoft.Windows.Server.2016.AD.Replication.Queue.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| AD RID Pool Free Performance Collection | Collection for the AD RID Pool \% Free counter. | Microsoft.Windows.Server.2016.AD.RIDPool.Free.PerformanceCollection | Microsoft.Windows.Server.2016.AD.DomainControllerRole | PerformanceCollection | True | | | 0 | 0 | | False | | | False | |
| No input provider to sync time | | No_input_provider_to_sync_time_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 21 | Microsoft-Windows-Time-Service | False | | | True | System |
| One or more of the DC Locator DNS records are not registered in the DNS database since the primary DNS server does not support the dynamic update of the DNS records | | One_or_more_of_the_DC_Locator_DNS_records_are_not_registered_1_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Netlogon | False | | | True | System |
| PAC Verification Failure | | PAC_Verification_Failure_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 18 | Microsoft-Windows-Kerberos-Key-Distribution-Center | False | | | True | System |
| Policy Update Failure | | Policy_Update_Failure_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 5 | Microsoft-Windows-Kerberos-Key-Distribution-Center | False | | | True | System |
| Report Collection - Machine Account Authentication Failures | | Report_Collection___Machine_Account_Authentication_Failures_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | False | | | 0 | 5805 | NetLogon | False | | | True | System |
| Setting the administrators password failed. It has been reset to blank. | | Setting_the_administrators_password_failed.__It_has_been_reset_to_blank._5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 16397 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| The account identifier pool for this domain controller cannot be updated | | The_account_identifier_pool_for_this_domain_controller_cannot_be_updated_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 16641 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| The computer did not have sufficient rights to perform the secure dynamic update | | The_computer_didnt_have_sufficient_rights_to_perform_the_secure_dynamic_update_1_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Dnsapi | False | | | True | System |
| The computer name cannot be mapped to an object in Active Directory - this may result in authentication failures | | The_computer_name_cannot_be_mapped_to_an_object_in_Active_Directory___this_may_result_in_authentication_failures_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 5801 | NetLogon | False | | | True | System |
| The DC was unable to obtain the next account-identifier | | The_DC_was_unable_to_obtain_the_next_account_identifier_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 16642 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| The DNS server with which this DC will register does not support the dynamic update protocol or the authoritative zone is not configured to allow dynamic updates | | The_DNS_server_with_which_this_DC_will_register_does_not_support_1_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Dnsapi | False | | | True | System |
| Create Domain Changes report | | The_Domain_Changes_report_Create_Only_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | False | | | 0 | 0 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| The domain controller failed to obtain a new account identifier pool | | The_domain_controller_failed_to_obtain_a_new_account_identifier_pool_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 16651 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| The group caching option has now been properly updated | | The_group_caching_option_has_now_been_properly_updated_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 12300 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| The machine account cannot be found | | The_machine_account_cannot_be_found_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 1097 | Microsoft-Windows-GroupPolicy | False | | | True | System |
| The number of Group Policies has exceeded the maximum limit | | The_number_of_Group_Policies_has_exceeded_the_maximum_limit_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 1088 | Microsoft-Windows-GroupPolicy | False | | | True | System |
| The registry policy file could not be accessed during application of machine policy | | The_registry_policy_file_could_not_be_accessed_during_application_of_machine_policy_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 1096 | Microsoft-Windows-GroupPolicy | False | | | True | System |
| The system clock has not been synchronized for some time | | The_system_clock_has_not_been_synchronized_for_some_time_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 36 | Microsoft-Windows-Time-Service | False | | | True | System |
| This domain controller will not start up because its machine account has been deleted | | This_domain_controller_will_not_start_up_because_its_machine_account_has_been_deleted_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 16405 | Microsoft-Windows-Directory-Services-SAM | False | | | True | System |
| Trusted Domain List Update Failure | | Trusted_Domain_List_Update_Failure_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 6 | Microsoft-Windows-Kerberos-Key-Distribution-Center | False | | | True | System |
| Unexpected SAM Failure | | Unexpected_SAM_Failure_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 7 | Microsoft-Windows-Kerberos-Key-Distribution-Center | False | | | True | System |
| Windows cannot determine the role of this computer. | | Windows_cannot_determine_the_role_of_this_computer._5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 1052 | Microsoft-Windows-GroupPolicy | False | | | True | System |
| Windows cannot determine the user or computer name. | | Windows_cannot_determine_the_user_or_computer_name._5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | Microsoft-Windows-GroupPolicy | False | | | True | System |
| Windows cannot obtain the domain controller name for your computer network. | | Windows_cannot_obtain_the_domain_controller_name_for_your_computer_network._5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 1054 | Microsoft-Windows-GroupPolicy | False | | | True | System |
| Windows is setting a registry value | | Windows_is_setting_a_registry_value_5_Rule | Microsoft.Windows.Server.2016.AD.DomainControllerRole | EventCollection | True | | | 0 | 0 | | False | | | True | Application |
Home