Reputation
739
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
3 6
Newest
 Yearling
Impact
~106k people reached

  • 0 posts edited
  • 0 helpful flags
  • 65 votes cast
Aug
28
answered Track down source of event 4771: Kerberos pre-authentication failed
Jul
28
comment What does Microsoft-Windows-Security-Auditing event with NULL SID mean?
i don't think that's accurate, the LocalSystem account does have a SID, and it's S-1-5-18 (support.microsoft.com/en-us/kb/243330). You didn't mention what event id the event is?
Jul
24
comment Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer
The AccessList is a dynamic part of the event, so if it's just one character differs, the query condition "and Data='..." won't work anymore. That's almost certainly the reason it's not working. But without seeing the events it's hard to say. Are you sure the events are identical?
Jul
23
comment Event Log trigger configuration for scheduled tasks not working despite working with the eventviewer
I would assume that the access list is different between the events, have you looked at that?
Jul
16
answered Check backpressure live on Exchange2010 server
Jul
6
comment How to retrieve previous IP/DNS information from Domain Controller logs?
I don't like recommending our product here, but if this happens frequently then you may want to consider installing a software product which archives (DHCP) log files, makes them searchable, and also keeps a track of MAC to IP mappings. EventSentry (eventsentry.com) does just that and can potentially save you a lot of time.
Jun
30
comment How to fix: The description for event ID %i from source %s cannot be found?
You seem to have gone through the basic troubleshooting steps, Maybe this is a 64-bit vs 32-bit issue. This article may also help: eventsentry.com/blog/2008/04/…
Jun
27
comment why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?
Is the server part of a domain, or is it just in a workgroup?
Jun
24
comment why is ip address sometimes missing from Security audit log Source Network address for log on audit failures?
Somebody asked a similar question here: serverfault.com/questions/399878/…
May
26
comment Event ID 1158: “Remote Desktop Services accepted a connection from IP address xxx.xxx.xxx.xxx”
I was this close to verifying :-) Yes, 10 of course. 11 are cached credentials I believe. Thanks!
May
26
comment Event ID 1158: “Remote Desktop Services accepted a connection from IP address xxx.xxx.xxx.xxx”
Slight correction, the logon type would be 11 for remote desktop. 2 is only for physical console logons (or when using a virtualization client).
May
11
comment Why are DHCP leases not included in DHCP Log?
EventSentry (including the free light edition) can monitor DHCP logs in real time, and you can trigger actions based on certain text being logged to the DHCP file(s) - more info at eventsentry.com. The files shouldn't be locked by the DHCP server service, you should at least be able to read them. Did you try to open the files with administrative permissions?
May
2
comment Event 4625 Audit Failure NULL SID failed network logons
That's surprising, I would consider using a different monitoring solution (if possible), I'm actually in disbelief that this is not possible. You could also limit auditing, but you may then miss actual critical audit failures. But then again, you will probably miss them anyways since they will be masked by the nonsense failures you are getting on a regular basis.
Apr
30
comment Event 4625 Audit Failure NULL SID failed network logons
So you can't exclude/ignore events which contain "NULL SID" for example? What monitoring system do you use?
Apr
30
comment Event 4625 Audit Failure NULL SID failed network logons
To be honest I would just ignore these events. Windows creates a myriad of security events, and this particular event is definitely not harmful.
Mar
27
comment Why is Windows Security Log using different formats on machines that seem to be the same?
I suppose the first question would be which software you are using to forward those events. It looks like you are using some sort of syslog forwarder? Since Windows almost certainly logs it correctly, the issue would most likely be in your event log monitoring software.
Mar
20
comment dropped security events on PDC
The Windows event logging subsystem is pretty solid, I've never heard of an event, particularly as critical as something like a 4740 not "making" it to the event log. Where are you running your PowerShell script? Are you running that on every domain controller, or only on one?
Feb
19
comment EventLog Source “Connect”. No events in EventLog
Interesting, it sounds like "Connect" may be some sort of reserved key word. Any reason why you wouldn't pick a more descriptive name in the first place anyways and just avoid the issue?
Oct
7
comment Program does not run properly as Scheduled Task
OK. Have you tried running it under the LocalSystem account? Also, have you tried monitoring the process launch event with Process Monitor from Sysinternals?
Oct
7
comment Program does not run properly as Scheduled Task
Not sure if I missed this, but under which user account are you launching the task? Are you launching it under the SYSTEM account, or an actual user? Is it a local user or a domain user? Does the app interact with the network?