Jimmy Harper recently found that many Event Log rules in the Active Directory Management Pack for Windows Server 2008 (version 6.0.7065.0) do not work correctly, resulting no alert being generated for these rules.  This is happening because the MP uses the old event sources from Server 2003 in its event rules, rather than the new ones for Server 2008/R2.

He wrote a little management pack for correcting this issue

http://blogs.technet.com/b/jimmyharper/archive/2010/08/27/admp-for-windows-server-2008-alerts-not-generated-for-some-rules.aspx

blogs · Directory · Log · Management · mp