Active Administrator 8.8.1 - User Guide

Windows Services alerts

Windows Services alerts

 

Table 145. Windows Services alerts

Alert	Description
Microsoft Entra Connect Sync service status	Microsoft Entra Connect Sync service is in a stopped state.
Microsoft Entra Connect Health Sync Insights service status	Microsoft Entra Connect Health Sync Insights is in a stopped state.
Microsoft Entra Connect Health Sync service	Microsoft Entra Connect Health Sync service is in a stopped state.

Connectivity alerts

Connectivity alerts

 

Table 146. Connectivity alerts

Alert	Description
Microsoft Entra connectivity	Microsoft Entra connectivity test failed.
Microsoft Entra database connectivity	Connectivity to the Microsoft Entra Connect database was lost.

Event ID alerts

Event ID alerts

 

Table 147. Event ID alerts

Alert	Description
Event ID 106	Failed to connect to Microsoft Entra ID during the Export step.
Event ID 109	Failed to connect to Microsoft Entra ID during the Import step.
Event ID 6801	Error occurred communicating with Microsoft Entra ID.
Event ID 6803	Generic - the Export step encountered one or more errors.
Event ID 6941	Export encountered one of the following errors: DataValidatinFailed, InvalidSoftMatch, or AttributeValueMustBeUnique. The 6941 error will be logged for each error.
Event ID 6001	Run profile failed because a connection could not be established to the server.
Event ID 611	Password Synchronization Full Sync has failed.
Event ID 6012	Full Import failed - no objects were returned from the operation.
Event ID 6100	Run profile step completed with errors. The event is logged as a warning. Additional information will be returned.
Event ID 6105	The “Exported Change not Reimported” error was returned during an Import run profile operation.
Event ID 6610, 6126, and 6127	The configuration has changed since the last run profile of this type (Import or Sync). A full import or sync was not performed.

 

Event Definitions

Event definitions are used to create alerts and reports. The event definitions file, EventDefinitions.edx, is located in the Active Administrator\Server folder. Occasionally new event definition files are made available. You can import these new event definitions into your auditing database. See Managing event definitions.

 

Table 148. Event Definitions

Event	Type
Active Administrator AFS Service Started	Active Administrator
Active Administrator AFS Service Stopped	Active Administrator
Active Administrator Alert Added	Active Administrator
Active Administrator Alert Deleted	Active Administrator
Active Administrator Alert Updated	Active Administrator
Active Administrator Audit Agent Activated	Active Administrator
Active Administrator Audit Agent Configuration Changed	Active Administrator
Active Administrator Audit Agent Installation Failed	Active Administrator
Active Administrator Audit Agent Installation Succeeded	Active Administrator
Active Administrator Audit Agent Moved	Active Administrator
Active Administrator Audit Agent Uninstalled	Active Administrator
Active Administrator Delegation Added	Active Administrator
Active Administrator Delegation Broken	Active Administrator
Active Administrator Delegation Removed	Active Administrator
Active Administrator Delegation Repaired	Active Administrator
Active Administrator Delegation Updated	Active Administrator
Active Administrator DNS Test Failed	Active Administrator
Active Administrator DNS Test Succeeded	Active Administrator
Active Administrator Domain Controller Excluded	Active Administrator
Active Administrator Event Definition Disabled	Active Administrator
Active Administrator Event Definition Enabled	Active Administrator
Active Administrator Event Purge History Cleared	Active Administrator
Active Administrator Event Purged / Archived	Active Administrator
Active Administrator Global Alert Quiet Time Added	Active Administrator
Active Administrator Global Alert Quiet Time Changed	Active Administrator
Active Administrator Global Alert Quiet Time Removed	Active Administrator
Active Administrator GPO History Backups Purged	Active Administrator
Active Administrator GPO Rollback Completed	Active Administrator
Active Administrator GPO Rollback Failed	Active Administrator
Active Administrator GPO Rollback Started	Active Administrator
Active Administrator Group Policy Object Added to the Repository	Active Administrator
Active Administrator Group Policy Object Checked Into the Repository	Active Administrator
Active Administrator Group Policy Object Checked Out of the Repository	Active Administrator
Active Administrator Group Policy Object Published to Active Directory	Active Administrator
Active Administrator Group Policy Object Removed from the Repository	Active Administrator
Active Administrator Group Policy Object Restored	Active Administrator
Active Administrator new Domain Controller Discovered	Active Administrator
Active Administrator Trustee Added	Active Administrator
Active Administrator Trustee Removed	Active Administrator
Active Directory Backup Completed	Active Administrator
Active Directory Backup Failed	Active Administrator
Active Directory Backup Purge History Cleared	Active Administrator
Active Directory Backup Started	Active Administrator
Active Directory Backups Purged	Active Administrator
Active Directory Replication Test Failed	Active Administrator
Active Directory Replication Test Succeeded	Active Administrator
Active Directory Restore Completed	Active Administrator
Active Directory Restore Failed	Active Administrator
Active Directory Restore Started	Active Administrator
Active Directory Shared Folder Changed	Shared Folder
Active Directory Shared Folder Created	Shared Folder
Active Directory Shared Folder Deleted	Shared Folder
AD Object Changed	General
AD Object Created	General
AD Object Renamed / Moved	General
Audit Agent Database Connectivity Lost	Active Administrator
Audit Agent Database Connectivity Restored	Active Administrator
Microsoft Entra Group Added	Microsoft Entra ID
Microsoft Entra Group Deleted	Microsoft Entra ID
Microsoft Entra Group Updated	Microsoft Entra ID
Microsoft Entra User Added	Microsoft Entra ID
Microsoft Entra User Deleted	Microsoft Entra ID
Microsoft Entra User Updated	Microsoft Entra ID
Certificate Added to Repository	Active Administrator
Computer Account Changed	Computer
Computer Account Created	Computer
Computer Account Deleted	Computer
Contact Changed	Contact
Contact Created	Contact
Contact Deleted	Contact
Domain Master Changed	FSMO
Domain Trust Created (Windows 2000 only)	Trust
Event Log Cleared	Security
Global Distribution Group Changed	Group
Global Distribution Group Created	Group
Global Distribution Group Deleted	Group
Global Group Changed	Group
Global Group Created	Group
Global Group Deleted	Group
GPO Changed	Group Policy
GPO Created	Group Policy
GPO Deleted	Group Policy
GPO Password Complexity Disabled NOTE: The added alert will not state the name of the changed GPO; there is an action description only.	Group Policy
GPO Password Complexity Enabled NOTE: The added alert will not state the name of the changed GPO; there is an action description only.	Group Policy
GPO Security Group Filters Changed	Group Policy
Group Policy Links Changed	Group Policy
Group Type Changed	Group
Infrastructure Master Changed	FSMO
Kerberos authentication ticket (TGT) was requested	User
Kerberos Pre-Auth Failed (Bad Password)	User
Local Distribution Group Changed	Group
Local Distribution Group Created	Group
Local Distribution Group Deleted	Group
Local Group Changed	Group
Local Group Created	Group
Local Group Deleted	Group
Logged onto DC (Local)	User
Logged onto DC (Remote)	User
Logon Failed (Bad Password)	User
Logon Failed (NTLM - Bad Password)	User
Logon Failed (NTLM - Unknown Username)	User
Logon Failed (Unknown Username)	User
Member Added to BUILTIN Group	Group Membership
Member Added to Global Distribution Group	Group Membership
Member Added to Global Group	Group Membership
Member Added to Local Distribution Group	Group Membership
Member Added to Local Group	Group Membership
Member Added to Universal Distribution Group	Group Membership
Member Added to Universal Group	Group Membership
Member Removed from BUILTIN Group	Group Membership
Member Removed from Global Distribution Group	Group Membership
Member Removed from Global Group	Group Membership
Member Removed from Local Distribution Group	Group Membership
Member Removed from Local Group	Group Membership
Member Removed from Universal Distribution Group	Group Membership
Member Removed from Universal Group	Group Membership
Object Owner Changed	Security
Object Permissions Changed	Security
One Way Incoming Trust Created	Trust
One Way Outgoing Trust Created	Trust
OU Changed	Organizational Unit
OU Created	Organizational Unit
OU Deleted	Organizational Unit
PDC Master Changed	FSMO
Printer Changed	Printer
Printer Created	Printer
Printer Deleted	Printer
Rejected Simple LDAP Bind Requests	LDAP Signing
Repository Certificate Delete	Active Administrator
Repository Certificate Updated	Active Administrator
RID Master Changed	FSMO
Schema Master Changed	FSMO
Site Changed	Site
Site Created	Site
Site Deleted	Site
SMTP Virtual Directory Changed	Exchange Server
Subnet Changed	Subnet
Subnet Created	Subnet
Subnet Deleted	Subnet
System Audit Policy Was Changed	Group Policy
System Time was Changed	System
Trust Deleted	Trust
Trust Modified	Trust
Two Way Trust Created	Trust
Universal Distribution Group Changed	Group
Universal Distribution Group Created	Group
Universal Distribution Group Deleted	Group
Universal Group Changed	Group
Universal Group Created	Group
Universal Group Deleted	Group
Unsigned LDAP Client Details	LDAP Signing
User Account Changed	User
User Account Created	User
User Account Deleted	User
User Account Disabled	User
User Account Enabled	User
User Account Locked Out	User
User Account Type Changed	User
User Account Unlocked	User
User Attribute Changed	User
User Change Password Attempt Failed	User
User Change Password Attempt Succeeded	User
User Locked Workstation	Workstation
User Logoff	Workstation
User Logon (Interactive for Windows 2016 Server)	Workstation
User Logon (Interactive)	Workstation
User Logon (Remote Desktop)	Workstation
User Password Reset	User
User Unlocked Workstation	Workstation
Windows Shutdown	System
Windows Started	System