DFS could not access its private data from the DS

DFS_could_not_access_its_private_data_from_the_DS_4_Rule (Rule)

Knowledge Base article:

Management Pack

Summary
Event ID 14530 in the System log: Distributed File System (DFS) failed to refresh metadata from the primary domain controller or domain controller for any domain-based DFS namespace.

Causes
Possible causes include: An error occurred with the network connection when DFS retrieved metadata from the primary domain controller or domain controller. The primary domain controller or domain controllers are down.

Resolutions
Use the following tools to perform the following checks. Check network connectivity: Event Viewer Ping Ipconfig NLTest NetDiag Check name resolution: DNS Server log in Event Viewer Nslookup Nbtstat DnsCmd Check domain controllers: Event Viewer DCDiag Dsastat Ntdsutil PortQry Repadmin Check authentication: Event Viewer Check access control: Event Viewer Dsacls NetDom Sdcheck

External Knowledge Sources
For more information about DFS, see "Distributed File System and File Replication Services" on the Microsoft Web site at http://go.microsoft.com/fwlink/?LinkID=18421.

Sample Event
DFS could not access its private data from the Active Directory® directory service. Please manually check network connectivity, security access, and/or consistency of DFS information in Active Directory. This error occurred on root Public.

Other Information
In the System log, event ID 14532 indicates the problem is resolved for Error event ID 14530.

Element properties:

Target

Microsoft.Windows.Server.DFS.Microsoft_Windows_2003_Distributed_File_System_Servers_Installation

Category

EventCollection

Enabled

True

Event_ID

14530

Event Source

DfsSvc

Alert Generate

True

Alert Severity

Error

Alert Priority

Low

Remotable

True

Alert Message

DFS could not access its private data from the DS

$Data/EventDescription$

Event Log

System

Comment

Mom2005ID='{4E557860-D609-4335-A4B4-66803E423469}';MOM2005ComputerGroupID={7D9735C6-343D-422F-ADF0-929F514183FD}

Member Modules:

ID	Module Type	TypeId	RunAs
_907D4578_146C_11D3_AB21_00A0C98620CE_	DataSource	Microsoft.Windows.EventProvider	Default
CollectEventData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
CollectEventDataWarehouse	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="DFS_could_not_access_its_private_data_from_the_DS_4_Rule" Target="Microsoft.Windows.Server.DFS.Microsoft_Windows_2003_Distributed_File_System_Servers_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{4E557860-D609-4335-A4B4-66803E423469}';MOM2005ComputerGroupID={7D9735C6-343D-422F-ADF0-929F514183FD}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_907D4578_146C_11D3_AB21_00A0C98620CE_" Comment="{907D4578-146C-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>14530</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>DfsSvc</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>50</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>DFS could not access its private data from the DS</Name>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>