Active Directory 2012-2016 Addendum packs updated
Man time flies!
Thought I'd share some new functionality for AD DS (Active Directory Domain Services)
Ran across some customer errors with AD Event ID 1084, which exists in the old 8321 pack, but not in the v10.x pack.
Well, if you get these errors, your DC isn't replicating, and most likely will need to be rebuilt.
Broke out the packs to separate the Recovery Tasks in their own pack, versus added functionality in the addendum.
Figured better to send packs NOT sealed, so that meant 2 packs,
WYSIWYG (wizzy-wig acronym)
What this means
v1.0.0.1 pack had just the AD DS Service Recovery Tasks
v1.0.0.2 pack has a Service Recovery Tasks pack, and the Addendum pack
What I think is cool is that the Addendum pack contains 2 rules, simple rule event (enabled by default), and also a PowerShell rule.
Rule Figured out how to simply look for criteria, count it, and alert on it.
We always look for alert suppression, some of the sliding/counting monitors are too much.
Starting with Holman's alerting rule fragment, we can create more powerful combinations than just a single symptom.
Using Variations of the get-date command, we can actually specify how far back to look, to count for alerts.
Easier method to count events, to figure out an alert threshold.
From the rule in the Addendum pack
# Check blog for more detail https://blogs.technet.microsoft.com/heyscriptingguy/2015/01/21/adding-and-subtracting-dates-with-powershell/
# If you want this in other time increments - AddHours, AddSeconds, AddMilliseconds
#
$LastCheck = (Get-Date).AddMinutes(-65)
[int]$TempCount = (get-eventlog -logName "Directory Service" -Source "NTDS Replication" -InstanceID 1084 -Message "*8451 The replication operation encountered a database error*" -After $LastCheck).Count
IF ($TempCount -ge 1)
{
$Result = "BAD"
$Message = "The number of 1084 Replication Database error events was greater than 1"
}
ELSE
{
$Result = "GOOD"
}
Maybe we need multiple event ID's, or search multiple event logs... you decide, and let me know.