Greetings, I have two management servers of SCOM 2012 R2. One of them runs is hosting the ACS service. I use ACS for obtaining security logs on all domain controllers.
I notice the domain controller which have their SCOM agent homed to mgmt. server which also runs the ACS, all is well. For domain controller which have their SCOM agent homed to a mgmt. server NOT running the ACS, things are not working. I notice after a while, the audit forwarding services on the domain controller will switch back to point to the mgmt. server which the SCOM agent is pointing to. This means no security logs are sent to the ACS. Thanks in advance for your comments. Cheers Sarbjit Singh
