Using Event Viewer to find error states in the “Active Directory Domain Services” role can be a big pain. I have created a custom filter that only displays errors, warnings and criticals.
<QueryList> <Query Id="0" Path="Directory Service"> <Select Path="Directory Service">*[System[Provider[@Name='Microsoft-Windows-ActiveDirectory_DomainService'] and (Level=1 or Level=2 or Level=3)]]</Select> <Select Path="Directory Service">*[System[Provider[@Name='NTDS ISAM'] and (Level=1 or Level=2 or Level=3)]]</Select> <Select Path="Active Directory Web Services">*[System[Provider[@Name='ADWS'] and (Level=1 or Level=2 or Level=3)]]</Select> <Select Path="DNS Server">*[System[Provider[@Name='Microsoft-Windows-DNS-Server-Service'] and (Level=1 or Level=2 or Level=3)]]</Select> <Select Path="DFS Replication">*[System[Provider[@Name='DFS Replication'] and (Level=1 or Level=2 or Level=3)]]</Select> <Select Path="DFS Replication">*[System[Provider[@Name='DFSR'] and (Level=1 or Level=2 or Level=3)]]</Select> <Select Path="File Replication Service">*[System[Provider[@Name='File Replication Service'] and (Level=1 or Level=2 or Level=3)]]</Select> <Select Path="File Replication Service">*[System[Provider[@Name='NtFrs'] and (Level=1 or Level=2 or Level=3)]]</Select> </Query> </QueryList>