Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 1202

This computer is now hosting the specified directory instance but Active Directory Web Services could not service it. Active Directory Web Services will retry this operation periodically.

Directory instance: GC
Directory instance LDAP port: 3268
Directory instance SSL port: 3269
To clean this error, you must delay the ADWS service:
1. CMD
2. sc config ADWS start= delayed-auto
From a support forum: Are both domain controllers also GC (Global Catalog)? Please verify that they are fully synchronized. Generally speaking, the 1202 event indicates the machine became a GC but ADWS couldn't establish a connection to it on the GC port. ADWS will keep retrying, so if there's a subsequent 1200 event ("is now servicing the specified directory instance") for the GC instance, it was a transient issue and solved itself.
I got this in Active Directory Web Services log on a W2k8 R2 DC in a domain with a W2k3 R2 server holding all FSMO roles. The event is followed by informational events 1006 "Active Directory Web Services is advertising." 1004 "Active Directory Web Services has successfully started and is now accepting requests" and 1200 "Active Directory Web Services is now servicing the specified directory instance.
See EV100100 (a Microsoft discussion thread called Edge Transport - RODC's - ADWS and ADAM Errors) - it has some comments about a particular instance of this error.
From a support forum: "I had the same issue here on a TMG server and I resolved it by disabling the Active Directory Web Services service.

If the configuration storage server is setup on a different computer, the ADAM instance on the TMG firewall server will be disabled. You can disable the ADWS service on the firewall to prevent that this service fills your event log. (This service can't reach ADAM on the local machine because it's disabled, and is complaining about it.)

If your ADAM instance is on the same box, it might be something else that is causing this issue."

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.