Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1012 Source: SBCore

Multiple domain controllers running Windows Server 2003 for Small Business Server have been detected in your domain. This computer will shut down in <number> minutes unless you remove all but one of these from the domain.
This event can be expected when migrating away from SBS to full servers. Once you transfer the FSMO roles to another DC this event will trigger, followed by event 1001 from SBcore aswell, shutting down the server.
See ME925652 for information about this event.
This event appears to be caused by the fact that SBS 2003 should be the owner of the FSMO roles. 2 weeks after the installation, SBS must hold all the FSMO roles. This requirement is in the Setup and Upgrade Requirement paper. See ME324801 to find out how to view and transfer FSMO roles in Windows Server 2003. Also, check ME234790 to see how to find servers that hold Flexible Single Master Operations (FSMO). You can also use ntdsutil to verify that all the roles are indeed back to the SBS, see ME255504.

From a newsgroup post: "SBS 2003 must be running as a DC. Please run the SBS integrated setup to complete the DCpromo process and finish the SBS integrated setup. If you want a member server, then please use regular Windows 2003 OS instead of SBS".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.