Return
-
Title
Cannot find events from failed domain controller -
Description
A domain controller failed and was rebuilt with the same name, however performing a search does not return any events from before the server was recreated. -
Cause
Although the host name is the same, the SID will be different and as such using the add option to select the computer will only return results for the newly created DC. -
Resolution
When searching for events that were generated before the server was rebuilt, use the Add Wildcard Expression option:
