This rule monitors the removal of DFS folders (links) by looking for the presence of DfsSvc event 14540, and generates an Error alert if the folder removal failed.
This can occur if DFS Namespaces fails to delete the overwritten folder when a program or script uses the NetDFSMove function with the DFS_MOVE_FLAG_REPLACE_IF_EXISTS flag to move or rename a folder and overwrite any existing folders with the same name.
To resolve this issue, manually delete the DFS folder using the DFS Management snap-in or the Dfsutil link remove command. Manually reset the health state of this monitor after resolving the problem.
Note: To manage a namespace, you must be a member of the Local Administrators group on each namespace server hosting the namespace or have been delegated permissions.