Collecting 'Directory Service' Event Logs From A 2012R2 Domain Controller And Send To A 2012R2 Member Server

Question

I have a couple Server 2012R2 domain controllers (we'll call them DC01 and DC02). I also have a Server 2012R2 member server (we'll call it COLLECTOR) that I'm going to use to collect certain event logs from various servers. I have setup the Event Log collecting and I am able to successfully setup subscriptions for the 'Application', 'System', etc logs from multiple servers.

My issue is that I would like to collect events from the 'Directory Service' log on the domain controllers. However, when I setup a new subscription on COLLECTOR, under the 'Query Filter', I do not have the 'Directory Service' log as an option since COLLECTOR does not have the AD DS role installed and therefore doesn't have the logs (such as 'Directory Service') that are associated with domain controllers.

Any idea how I can collect events from specific Active Directory logs from a member server event collector?

score 1 · Answer 1 · edited Jul 05 '19 at 14:35

1

Create a custom XML filter:

<QueryList>
  <Query Id="0" Path="Directory Service">
    <Select Path="Directory Service">*</Select>
  </Query>
</QueryList>

edited Jul 05 '19 at 14:35

Glorfindel

1,213
4
15
22

answered Jul 05 '19 at 06:56

Robert Haugen

11
1

Collecting 'Directory Service' Event Logs From A 2012R2 Domain Controller And Send To A 2012R2 Member Server

1 Answers1