Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 4143 Source: MSDTC

MS DTC has detected that a DC Promotion has happened since the last time the MS DTC service was started.
EV100632 (MSDTC Event ID 4143 and 53258 on Windows Server 2003 SP1 Domain Controller) provides suggestions on how to resolve an instance of this event when is recording along 53258 Warning on a freshly installed virtual machine using a slipstreamed SP1 installation and promoted to a domain controller.
After some research, I found this tip and I think it could help. The problem is generated only if Windows 2003 Server SP1 is installed before Active Directory. This should resolve the matter:
1. Go to Start -> Administrative tools -> Component Services.
2. Expand Component Services.
3. Right click on "Computer" in the right window pane and select “Properties”.
4. Click the MS DTC Tab.
5. Click the "Security Configuration" button when the dialog box appears. Do not modify anything simply click "OK". Then click "OK" on the Computer's properties box; this will take you back to the console.
7. Stop the MSDTC service by right clicking on "Computer".
8. Finally, restart the MSDTC service by right clicking again on "Computer" and selecting "Start MSDTC".

Daniele Catanesi and Housenet were the first I saw proposing the solution so thanks to them.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.