Custom Active Directory Domain Services Filter

Using Event Viewer to find error states in the “Active Directory Domain Services” role can be a big pain. I have created a custom filter that only displays errors, warnings and criticals.

<QueryList>
  <Query Id="0" Path="Directory Service">
    <Select Path="Directory Service">*[System[Provider[@Name='Microsoft-Windows-ActiveDirectory_DomainService'] and (Level=1  or Level=2 or Level=3)]]</Select>
    <Select Path="Directory Service">*[System[Provider[@Name='NTDS ISAM'] and (Level=1  or Level=2 or Level=3)]]</Select>
    <Select Path="Active Directory Web Services">*[System[Provider[@Name='ADWS'] and (Level=1  or Level=2 or Level=3)]]</Select>
    <Select Path="DNS Server">*[System[Provider[@Name='Microsoft-Windows-DNS-Server-Service'] and (Level=1  or Level=2 or Level=3)]]</Select>
    <Select Path="DFS Replication">*[System[Provider[@Name='DFS Replication'] and (Level=1  or Level=2 or Level=3)]]</Select>
    <Select Path="DFS Replication">*[System[Provider[@Name='DFSR'] and (Level=1  or Level=2 or Level=3)]]</Select>
    <Select Path="File Replication Service">*[System[Provider[@Name='File Replication Service'] and (Level=1  or Level=2 or Level=3)]]</Select>
    <Select Path="File Replication Service">*[System[Provider[@Name='NtFrs'] and (Level=1  or Level=2 or Level=3)]]</Select>
  </Query>
</QueryList>

Leave a Reply

Your email address will not be published.