Capturing a FSMO role change

If you’re wondering how be notified if you have an AD Operations Master role change, we discovered an undocumented event id that is logged. And of course, if it is logged, MOM can watch for it!
 
Event 1458 in the Directory Services log is logged regardless of which role is changed. The description of this event is:
The operations master role represented by the following object has been transferred to the following domain request at the request of a user.
 
The event is logged to in the Directory Services event log for the new role master, and the message description also indicates the domain controller previously holding that role.
 
When creating the role, the provider is Directory Services, and the eventid is 1458.
 
About these ads
This entry was posted in Management Packs. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s