Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 9187 Source: MSExchangeSA

Microsoft Exchange System Attendant failed to add the local computer as a member of the DS group object "<name>".

Please stop all the Microsoft Exchange services, add the local computer into the group manually and restart all the services.
On an Exchange cluster these event IDs were being generated for one node in the cluster. On the properties for each server in active directory I found that one node had Exchange Domain Servers group as the primary group, on the Member Of tab. The other node had the Domain Computers group as the primary group. Changed both so that Domain Computers was the primary group and are no longer seeing this error.
As per Microsoft: "This event indicates that the System Attendant has detected that the local computer is not a member of the Exchange Domain Servers Security Group and failed to add it to that group. While there may be other causes of this error, it can happen because the Distinguished Name (DN) of the server has changed. This change in the DN can occur because the computer may have been moved to another organizational unit (OU) in Active Directory. This error may show up if even if the server is in the Exchange Domain Servers Security Group". See MSEX2K3DB for additional information about this event.
See ME271335 to find out why this event occurs.
From a newsgroup post: "A restart of the System Attendant should resolve this". Another sugestion is "to run (re-run) domainprep (also ensure this has been run in the root domain regardless of whether or not you have exchange servers installed in the root) and always restart System Attendant after moving exchange computer accounts to different OU's (the errors occur for the same reasons as in the case of moving the exchange groups out of the users container)".

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.