I have a tombstoned device on a domain that has over 80 domain controllers. We are having a very difficult time finding that device. Unfortunately, EventID 1864 in the Directory Service log does not tell me the name of the device. The best way I can think of finding it at this point, is to search the NTDS Replication log on each server in the domain for EventID 2042.
I have found a few scripts out there that help with searching for specific EventID's, but they seem to all require a list of computers to monitor. What I'm looking to do is run a script once, search all domain controllers in a forest for that specific event ID and then tell me which server has the error.
Is there a way to take the Powershell Centralized Log Monitor and make it so it does not require the "monitored_computers.txt" file and will instead search the entire Forest?