1. Course 2786B
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Presentation: 60 minutes
Lab: 60 minutes
This module helps students to implement an Active Directory Domain Services (AD DS) monitoring plan.
After completing this module, students will be able to:
Monitor Active Directory Domain Services Using Event Viewer
Monitor Active Directory Domain Servers Using Reliability and Performance Monitor
Configure Active Directory Domain Services Auditing
Required materials
To teach this module, you need the Microsoft® Office PowerPoint® file 6425A_08.ppt.
Important It is recommended that you use PowerPoint 2002 or a later version to display the slides for this course. If you use PowerPoint Viewer or an earlier version of PowerPoint, all the features of the slides might not be displayed correctly.
Preparation tasks
To prepare for this module:
Read all of the materials for this module.
Complete the practices.
This section contains information that will help you to teach this module.
For some topics in this module, references to additional information appear in notes at the end of the topics. Read the additional information so that you can prepare to teach the module. During class, ensure that students are aware of the additional information.
Module 8: Implementing an Active Directory Domain Services Monitoring Plan

2. Course 2786B
Module Overview
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Monitoring Active Directory Domain Services Using Event Viewer
Monitoring Active Directory Domain Servers Using Reliability and Performance Monitor
Configuring Active Directory Domain Services Auditing

3. Course 2786B
Lesson 1: Monitoring Active Directory Domain Services Using Event Viewer
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Event Viewer Features
Demonstration: Overview of the Event Viewer
Active Directory Domain Services Logs
What Are Custom Views?
What Are Subscriptions?
Demonstration: Configuring Custom Views and Subscriptions

4. Event Viewer Features Course 2786B
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Explain that Event Viewer has been rewritten from the ground up. It has a new interface and is integrated with a new, centralized event logging system. Event Viewer works with native Windows Server® 2008 and Windows Vista® event log files (.elf). It also provides backward compatibility with Event Viewer files from earlier Windows operating systems. Point out that updated features include summary and custom views, subscriptions, cross-log queries, integration with Task Scheduler, many new log files, and increased multipage support for larger result sets.
Reference
Selected Scenarios for Managing Desktops with Windows Vista technet.microsoft.com/en- us/windowsvista/aa aspx
Event Viewer Overview
aec03dc08cd51033.mspx?mfr=true
How Longhorn Server’s Server Manager will Change Server Management
Part2.html#

5. Demonstration: Overview of the Event Viewer
Course 2786B
Demonstration: Overview of the Event Viewer
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
In this demonstration, you will see how to navigate the Event Viewer
To complete this demonstration, you must have the 6425A-NYC-DC1 virtual machine running.
Demonstration steps:
Open Event Viewer and briefly discuss the new look of the Microsoft Management Console (MMC).
Point out the default summary view.
Expand custom views and show the default custom views.
Expand Windows Logs, and point out the traditional logs and the new logs.
Open one of the logs and briefly discuss the options available in the Actions pane.
Show how you could attach a task to an event using the Create a Basic Task Wizard.
Demonstrate copying en event’s details as text into Notepad.
Double-click an event to show the details.
Expand the Microsoft Windows folder and show the logs.
Show how you would connect to another computer. Mention that the Remote event-log management must be enabled on the remote computer’s firewall.
Question
You have an issue with Group Policy. What log should you view for detailed Group Policy events?
Answer: The Group Policy log is one of the new application and service logs that Event Viewer includes.
Reference
Event Viewer Overview
aec03dc08cd51033.mspx?mfr=true
New Tools for Event Management in Windows Vista
ag/issues/2006/11/EventManagement

6. Active Directory Domain Services Logs
Course 2786B
Active Directory Domain Services Logs
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
The following logs can provide specific information about Active Directory issues:
Application log connections
System Log
DFS Replication log
Directory Service Log
DNS Server log
Group Policy\Operational
Event Viewer now provides a wide range of application and service logs. Explain how these logs can provide granular information about Active Directory and other services, like Group Policy, offline files, Windows Update client, and many others. Point out that the system log is often the first stop in troubleshooting. You can use a number of logs to track Active Directory issues. For example, the Distributed File System (DFS) Replication log, Directory Service log, Domain Name Service (DNS) Server log, and Group Policy\Operational log can provide valuable information about a Active Directory related problems. Discuss how the event log online-help feature provides the latest information about known issues.

7. What Are Custom Views? Custom views :
Course 2786B
What Are Custom Views?
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Custom views :
Allow you to aggregate and filter information from multiple logs into a single view
Are reusable
Can be exported to other computers
Explain that Custom Views allow you to view event log information based on dynamic queries. Point out how to create a custom view. Custom views allow you to select from which event logs you want to view information and puts it into a single view. This can be useful for monitoring services such as AD DS – you can view all of the AD DS specific logs in one view rather than checking multiple logs.
Explain that once you have queried and sorted your way to just the events you wanted to analyze, you can save that work as a named view and it will be available for your future reuse. You even can export the view to use on other computers or share with others.
Reference
Event Viewer Overview
aec03dc08cd51033.mspx?mfr=true
How Longhorn Server’s Server Manager will Change Server Management
Part2.html
Event 1.
Security log
Event 2.
System log
Event Viewer
Event 3: DFS log

8. What Are Subscriptions?
Course 2786B
What Are Subscriptions?
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Explain that Event Viewer includes the ability to collect copies of events from multiple remote computers and store them locally. To specify which events to collect, you create an event subscription. Among other details, the subscription specifies exactly which events will be collected and in which log they will be stored locally. Once a subscription is active and events are being collected, you can view and manipulate these forwarded events as you would any other locally stored events.
Explain that before you can create a subscription to collect events on a computer, you must configure both the collecting computer (collector) and each computer from which events will be collected (source).
Question
Where would subscriptions be most useful on in your organization?
Answer: Answers will vary
Reference
Event Viewer Overview
aec03dc08cd51033.mspx?mfr=true
Subscriptions collect events from multiple computers and store them locally

9. Demonstration: Configuring Custom Views and Subscriptions
Course 2786B
Demonstration: Configuring Custom Views and Subscriptions
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
In this demonstration, you will see how to:
Create a custom view and add the AD DS specific logs to the view.
Create a subscription to collect logs from multiple domain controllers
To complete this demonstration, you must have the 6425A-NYC-DC1 virtual machine running.
Demonstration steps:
Create a custom view
Create a new custom view that captures error events from some Active Directory related logs
Export the view to an XML file
Delete the original custom view and import the XML file
Create a Subscription
Log on to all collector and source computers as administrator
On each source computer, type the following at an elevated command prompt: winrm quickconfig
On the collector computer, type the following at an elevated command prompt: Wecutil qc
Add the computer account of the collector computer to the local Administrators group on each of the source computers
Create the subscription
Filter events to show only errors from the system log
Question
You want to monitor a particular group of events across multiple Web servers. What is the best way to accomplish this?
Answer: Use subscriptions to gather the particular events and filter them to a central workstation.
Reference
Create a Custom View
aec03dc08cd51033.mspx?mfr=true
Create a New Subscription
Configure Computers to Forward and Collect Events

10. Course 2786B
Lesson 2: Monitoring Active Directory Domain Servers Using Reliability and Performance Monitor
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Reliability and Performance Monitor Features
Demonstration: Overview of the Reliability and Performance Monitor
Monitoring AD DS Using Performance Monitor
What Is an Active Directory Baseline?
Monitoring Service Availability with Reliability Monitor
Monitoring Active Directory Domain Services Using Data Collector Sets
Demonstration: Monitoring AD DS

11. Reliability and Performance Monitor Features
Course 2786B
Reliability and Performance Monitor Features
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Reliability and Performance Monitor allows you to:
Perform real-time monitoring ü
Collect data
Explain that Windows Reliability and Performance Monitor enables you to track the performance impact of applications and services, and to generate alerts or take action when user-defined thresholds for optimum performance are exceeded.
Describe the new Microsoft Management Console (MMC). Explain that resource overview gives you real- time graphic monitoring with expandable sections to see activity details.
Explain that Performance Monitor allows you to add counters for real-time viewing or display logging results.
Describe Reliability Monitor. Discuss the System Stability Chart and Report. Discuss the Index value and its meaning. Reliability Monitor provides a system-stability overview and trend analysis with detailed information about individual events that may affect the system’s overall stability, such as software installations, operating- system updates, and hardware failures. It begins collecting data when the system is installed.
Describe data collector sets -- how and when you would use them. Explain that a Data Collector Set is the building block of performance monitoring and reporting. It organizes multiple data collection points into a single component that you can use to to review or log performance. A Data Collector Set can be created and then recorded individually, grouped with other Data Collector Sets and incorporated into logs, viewed in Performance Monitor, configured to generate alerts when thresholds are reached, or used by other non- Microsoft applications. It can be associated with scheduling rules for data collection at specific times.
Discuss the built-in reporting features.
Reference
Windows Server “Longhorn” Performance and Reliability Monitoring Step-by-Step Guide a88e2c8fb4d81033.mspx?mfr=true
Windows Reliability and Performance Monitor
55d9a mspx?mfr=true
Use Reliability Monitor
edb21ee70f0e1033.mspx?mfr=true
Create Data Collector Sets ü
Track performance of applications and services ü
Generate alerts ü
Take action when thresholds are reached ü
Generate reports ü

12. Demonstration: Overview of the Reliability and Performance Monitor
Course 2786B
Demonstration: Overview of the Reliability and Performance Monitor
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
In this demonstration, you will see an overview of the Reliability and Performance monitor
To complete this demonstration, you must have the 6425A-NYC-DC1 virtual machine running.
Demonstration steps:
Open Reliability and Performance Monitor
Briefly show the resource overview screen. Expand some sections to show details.
Open Performance Monitor – mention that this has not changed significantly from Server 2003.
Open Reliability Monitor – expand some details.
Open Reports and show the system reports that are available.
Question
Where can you find real-time information about network activity?
Answer: The Resource Overview page has a Network section that supplies real-time data on network activity.
Reference
Windows Vista Performance and Reliability Monitoring Step-by-Step Guide
edb21ee70f0e1033.mspx?mfr=true

13. Monitoring AD DS Using Performance Monitor
Course 2786B
Monitoring AD DS Using Performance Monitor
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Useful NTDS Counters for Monitoring Active Directory:
NTDS\ DRA Inbound Bytes Total/sec ü
Explain that in addition to the normal baseline counters that you monitor for all servers, there are objects and counters that are specific to active directory. The Directory Services object provides access to the NT Directory Service (NTDS) counters. Briefly describe the most important counters.
Mention that there are also a number of database counters that allow you to monitor the Active Directory database at an advanced level. These counters provide information regarding the performance of the database cache, database files, and database tables. You can use some of these counters to determine whether you need more hard disks to store additional Active Directory data.
Also mention that there is a predefined data collector set for Active Directory Diagnostics that collects data from many different objects.
Reference
Active Directory Operations Guide ide/part1/adogd02.mspx
NTDS\ DRA Inbound Object ü
NTDS\ DRA Outbound Bytes Total/sec ü
NTDS\ DRA Pending Replication Synchronizations ü
NTDS\ Kerberos Authentications/sec ü
NTDS\ NTLM Authentications ü

14. What Is an Active Directory Baseline?
Course 2786B
What Is an Active Directory Baseline?
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
A baseline defines what a server looks like under normal workload conditions ü
Describe the basic counter set that should be included in any server baseline: Pages/sec, Avg. Disk Queue Length, %Processor Time.
Refer to the previous topic for the Active Directory. Active Directory counters that you should include in the Active Directory baseline.
Explain that a baseline needs to be established prior to troubleshooting. You need to know what the counters look like under normal conditions before you can understand a problem’s source. Data needs to be collected for a period of time, over weeks or months, to establish a baseline. During that period, collect data at different times of the day. For example, collect it during the morning when users are authenticating, or during idle times and periods of replication.
When Active Directory problems arise, compare the baseline findings to the current statistics to help identify the problem’s source.
Reference
Deploying Active Directory for Branch Office Environments
Chapter 9 - Post Deployment Monitoring of Domain Controllers
eploy/addch09.mspx?mfr=true
Servers performing different functions will have different baselines measurements ü
Baseline measurements should include basic server counters and function specific counters ü
Problems areas can be identified by comparing baseline measurements to current statistics ü

15. Monitoring Service Availability with Reliability Monitor
Course 2786B
Monitoring Service Availability with Reliability Monitor
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Explain that Reliability Monitor calculates a System Stability Index that reflects whether unexpected problems reduced the system’s reliability. A graph of the Stability Index over time quickly identifies dates when problems began to occur. The accompanying System Stability Report provides details to help troubleshoot the root cause of reduced reliability. By viewing system changes (installation or removal of applications and updates to the operating system) and failures (application, operating system, or hardware failures), you can develop a strategy for addressing issues quickly.
Reference
Windows Vista Performance and Reliability Monitoring Step-by-Step Guide
edb21ee70f0e1033.mspx?mfr=true

16. Monitoring Active Directory Domain Services Using Data Collector Sets
Course 2786B
Monitoring Active Directory Domain Services Using Data Collector Sets
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Organizes multiple data collection points into a single component
Can be grouped with other data collection sets
Explain that a Data Collector Set is the building block of performance monitoring and reporting in Windows Reliability and Performance Monitor. It organizes multiple data collection points into a single component that you can use to review or log performance. You can create a Data Collector Set and then record it individually, group it with other Data Collector Sets and incorporate it into logs, view it in Performance Monitor, configure it to generate alerts when thresholds are reached, or for use by other non-Microsoft applications. You also can associate it with scheduling rules for data collection at specific times.
Explain that you can create a Data Collector Set from a template, from an existing set of Data Collectors in a Performance Monitor view, or by selecting individual Data Collectors and setting each individual option in the Data Collector Set properties.
Question
You want to create an alert to notify you when free disk space is low. How would you create one?
Answer: Create a new data collector set manually and then check the Performance Counter Alert. Add the %Free Space counter in the Logical Disk object and set the threshold as required.
Reference
Create Data Collector Sets
edb21ee70f0e1033.mspx?mfr=true
Can be incorporated into logs
Can be created individually or from templates
Data Collector Sets can contain the following types of data collectors:
Performance counters
Event trace data
System configuration information (registry key values)

17. Demonstration: Monitoring AD DS
Course 2786B
Demonstration: Monitoring AD DS
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
In this demonstration, you will see how to set up monitoring of Active Directory
To complete this demonstration, you must have the 6425A-NYC-DC1 virtual machine running.
Demonstration steps:
Create a new data collector set named Active Directory
Add the server baseline counters
Add some of the Active Directory counters and start the data collector set
Perform some activity to generate statistics
Stop the data collector set and look at the user-defined report
In the system container, start the Active Directory Diagnostics data collection set
Stop the data collector set and look at the system-defined report
Question
What is the easiest way to log the same set of data across multiple computers?
Answer: Create a data collector set that captures the information you want and save it as an XML template.
Reference
Using Performance Logs and Alerts

18. Lesson 3: Configuring Active Directory Domain Services Auditing
Course 2786B
Lesson 3: Configuring Active Directory Domain Services Auditing
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
What Is Active Directory Domain Services Auditing?
Demonstration: Configuring an Audit Policy
Types of Events to Audit
Demonstration: Configuring AD DS Auditing

19. What Is Active Directory Domain Services Auditing?
Course 2786B
What Is Active Directory Domain Services Auditing?
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Active Directory auditing can show old values and new values of changed attributes in audit entries
Active Directory audit policy is divided into four subcategories
Directory service access
Directory service changes
Directory service replication
Detailed Directory service replication
Only directory service access is enabled for success by default
Use the Auditpol.exe command-line tool to view or set audit policy subcategories
Explain that Active Directory auditing is a critical part of Active Directory administration and security. It is often a legal requirement to maintain a certain audit policy.
Explain how in Windows® 2000 and Windows Server® 2003, there was one audit policy, Audit directory service access. That policy controlled whether auditing for directory service events was enabled. In Windows Server® 2008, this policy is divided into four subcategories:
-Directory service access (enabled by default)
-Directory service changes
-Directory service replication
-Detailed Directory service replication
Describe how to enable the global audit policy. Explain that using the Group Policy Management Console (GPMC) to enable Directory service auditing will enable all the subcategories.
Explain that you must use Auditpol.exe to view or set audit policy subcategories. There is no Windows interface tool available in Windows Server 2008 to view or set audit policy subcategories. Explain that the system access control list (SACL) on the object is still the ultimate authority in determining whether an access check must be audited. If there is no access control entry (ACE) in the SACL that requires that attribute modifications be logged, then no change-auditing events are logged, even if the Directory Service Changes subcategory is enabled.
Reference
Windows Server “Longhorn” Beta 3 Auditing AD DS Changes Step-by-Step Guide
ea8e02b4b2a51033.mspx?mfr=true
How to use Group Policy to configure detailed security auditing settings for Windows Vista client computers in a Windows Server 2003 domain or in a Windows 2000 domain
Auditpol
7230c8e mspx?mfr=true

20. Demonstration: Configuring an Audit Policy
Course 2786B
Demonstration: Configuring an Audit Policy
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
In this demonstration, you will see how to configure a global audit policy with the GPMC and adjust it with Auditpol.exe
Demonstration steps:
Open a command prompt as Administrator
Use the Auditpol.exe to see the current audit policy – the only subcategory that is enabled is Directory Service Access - Success Auditpol /get /category:”DS Access” Note: Auditpol /get /category:* will display the entire audit policy
Use the GPMC to enable Directory Service Access auditing for successes and failures in the Default Domain Controllers Policy
Use gpupdate to refresh the policy
Run the Auditpol utility again to see that the status has changed because you have enabled a global audit policy for all the subcategories of the DS Access service are set to success and failure
Use Auditpol to disable Detailed Directory Service Replication. Auditpol /set /subcategory:"Detailed Directory Service Replication " /failure:disable Auditpol /set /subcategory:" Detailed Directory Service Replication " /success:disable
Use the Auditpol command again to show that the policy has been modified Auditpol /get /category:”DS Access”
Question
What log shows you the results of auditing?
Answer: The Security log displays the audit results.
Reference
Auditpol set
7230c8e mspx?mfr=true

21. Types of Events to Audit
Course 2786B
Types of Events to Audit
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Event ID
Category
Event
4662
Directory service access
An operation was performed on an Active Directory object
4722
User account management
A user account was enabled
4726
A user account was deleted
4738
A user account was changed
5136
Directory service changes
An Active Directory object was modified
5137
A new Active Directory object was created
5138
An Active Directory object was undeleted
The Directory Service Access category still provides information about all the events that occur in the directory. It is enabled by default.
Directory Service Replication and Detailed Directory Service Replication provide information about replication events. These subcategories are disabled by default unless you enable a global directory access policy.
Explain that Directory Services Changes category provides new functionality. The types of changes that you can audit include a user (or any security principal) creating, modifying, moving, or undeleting an object. The new audit policy subcategory adds the following capabilities to auditing in AD DS:
- When a successful modify operation is performed on an attribute, AD DS logs the attribute’s previous and current values.
- If a new object is created, values of the attributes that are populated at creation time are logged. If the user adds attributes during the create operation, those new attribute values are logged.
- If an object is moved, the previous and new location (distinguished name) is logged for moves within the domain.
- If an object is undeleted, the location is logged to which the object is moved.
This subcategory also is disabled by default.
Reference
Windows Server “Longhorn” Beta 3 Auditing AD DS Changes Step-by-Step Guide
ea8e02b4b2a51033.mspx?mfr=true

22. Demonstration: Configuring AD DS Auditing
Course 2786B
Demonstration: Configuring AD DS Auditing
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
In this demonstration, you will see how to configure the site link object to manage replication between sites
To complete this demonstration, you must have the 6425A-NYC-DC1 virtual machine running.
This demonstration is carried over from the last demo where you used Group Policy to enable a global audit policy.
Demonstration steps:
Create a new organizational unit (OU).
Use the properties page to access the security properties of the OU. Ensure that Advanced View is enabled.
Use the Auditing tab in advanced security to enable auditing for Administrator for successful account-object creation.
Refresh Group Policy.
Create a new user in the OU. Set logon hours and a profile path for the user.
Open Event Viewer and display the results.
Examine event 4720 “A user account was created” Examine the last events, 4738, that show the values for logon hours and profile path that you configured. Question
How would enable the tracking of failure events for the directory service change subcategory?
Answer: You must use the Auditpol.exe to enable failure tracking.
Reference
Windows Server “Longhorn” Beta 3 Auditing AD DS Changes Step-by-Step Guide ea8e02b4b2a51033.mspx?mfr=true

23. Lab: Monitoring Active Directory Domain Services
Course 2786B
Lab: Monitoring Active Directory Domain Services
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Exercise 1: Monitor AD DS Using Event Viewer
Exercise 2: Monitor AD DS Using Performance and Reliability Monitor
Exercise 3: Configure AD DS Auditing
Lab objectives
Objectives covered in the Lab:
Monitor AD DS using the Event Viewer
Monitor AD DS using Performance and Reliability Monitor
Configure AD DS Auditing
Scenario:
Woodgrove Bank has completed their deployment of AD DS. As the AD DS administrator, you must monitor AD DS availability and performance. The server administrator has provided a monitoring plan that includes service availability, performance, and Event log monitoring components. Using Performance and Reliability Monitoring, Event Viewer, and other tools, you will monitor AD DS domain controllers.
This lab consists of three exercises.
Exercise 1: Monitor AD DS Using Event Viewer
The student will configure Event Viewer to monitor AD DS based on the monitoring plan prepared by the server administrator. Tasks include creating custom views and creating subscriptions to capture all of the AD DS relevant log information in a single location.
Exercise 2: Monitor AD DS Using Performance and Reliability Monitor
The student will configure Performance and Reliability Monitor to monitor AD DS based on the monitoring plan prepared by the server administrator. Tasks include creating data collector sets, monitoring server performance by using Performance Monitor, and configuring alerts that are triggered when services are not available.
Exercise 3: Configure AD DS Auditing
The student will configure AD DS auditing to comply with the monitoring plan prepared by the server administrator.
Inputs: AD DS monitoring plan provided by the server administrator.
Outputs: AD DS monitoring is configured in compliance with the monitoring plan.
Logon information
Virtual machine
NYC-DC1, NYC-DC2
User name
Administrator
Password
Pa$$w0rd
Estimated time: 60 minutes

24. Course 2786B
Lab Review
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
You want to enable the Directory Service Changes subcategory without enabling a global audit policy. How could you do this?
What services must be running on a source computer in order to provide information to a subscription?
You have enabled a global audit policy to collect directory service access events, but no events are showing up in the security log. What might the problem be?
1. You want to enable the Directory Service Changes subcategory without enabling a global audit policy. How could you do this?
Use the auditpol.exe command to enable just the Directory Service Changes subcategory for success or failure or both.
2. What services must be running on a source computer to provide information to a subscription?
The Windows Event Collector Service and the Windows Remote Management (WS-Management) services must be running.
3. You have enabled a global audit policy to collect directory service access events, but no events are showing up in the security log. What might the problem be?
You have not configured the SACL for the container that you are trying to audit.

25. Module Review and Takeaways
Course 2786B
Module Review and Takeaways
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Review questions
Considerations
Review questions
1. What kinds of events are logged in the Setup log?
Answer: The setup log records events relating to each new application’s installation.
2. For what event ID would you filter to see deleted user accounts?
Answer: Event ID 4726.
3. What service you enable on computers collecting subscription events from remote computers?
Answer: The Windows Event Collector (Wecsvc) service must be enabled on the collecting computer.
4. Where can you get up to date information about event IDs?
Answer: Event log online help.
5. Where can you get historical information about application failures?
Answer: The Reliability Monitor tracks historical information about application failures.
6. The NTDS\ DRA Pending Replication Synchronizations counter is now consistently higher than the established baseline value for that counter. What might this indicate?
Answer: Higher values indicate that the hardware is not adequately servicing replication.
7. You want to view all the occurrences of a particular event ID across multiple logs. What is the best way to accomplish this?
Answer: Create a custom view for that event ID across multiple logs.
Event Viewer allows you to save filters as reusable custom views.

26. Beta Feedback Tool Beta feedback tool helps: Walkthrough of the tool
Course 2786B
Beta Feedback Tool
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Beta feedback tool helps:
Collect student roster information, module feedback, and course evaluations.
Identify and sort the changes that students request, thereby facilitating a quick team triage.
Save data to a database in SQL Server that you can later query.
Walkthrough of the tool

27. Beta Feedback Overall flow of module: Pacing: Learner activities:
Course 2786B
Beta Feedback
Module 8: Implementing an Active Directory® Domain Services Monitoring Plan
Overall flow of module:
Which topics did you think flowed smoothly, from topic to topic?
Was something taught out of order?
Pacing:
Were you able to keep up? Are there any places where the pace felt too slow?
Were you able to process what the instructor said before moving on to next topic?
Did you have ample time to reflect on what you learned? Did you have time to formulate and ask questions?
Learner activities:
Which demos helped you learn the most? Why do you think that is?
Did the lab help you synthesize the content in the module? Did it help you to understand how you can use this knowledge in your work environment?
Were there any discussion questions or reflection questions that really made you think? Were there questions you thought weren’t helpful?