Share via

Event Collector display Security event message without values

Question

Wednesday, August 30, 2017 9:43 PM

I have set to forward MS Windows Server 2012 Security (Microsoft Windows Security Auditing) Event logs to another MS Windows 2012 server (Event Collector).
Event Collector display message of Forwarded Event without information.

The General view for the Forwarded Event will display the following:

An account was successfully logged on.

Subject:
Security ID: S-1-5-0
Account Name: -
Account Domain: -
Logon ID: 0x0

Logon Type: 3

Impersonation Level: %21

New Logon:
Security ID: %5
Account Name: %6
Account Domain: %7
Logon ID: %8
Logon GUID: %13

Process Information:
Process ID: %17
Process Name: %18

Network Information:
Workstation Name: %12
Source Network Address: %19
Source Port: %20

Detailed Authentication Information:
Logon Process: %10
Authentication Package: %11
Transited Services: %14
Package Name (NTLM only): %15
Key Length: %16

Why are these variables not filled in when Forwarded? 

The Subscription Event ContentFormat is set to Events.

All replies (8)

Thursday, August 31, 2017 7:11 AM

Hi kingstonen,

What does it display if you switch to the Details tab with Friendly View and XML View?

Please try to set ContentFormat back to RenderedText (default setting) and upped Destination log size to 5 GB. 

For your reference:

Windows Forward Events Missing User Data and Description

https://serverfault.com/questions/597589/windows-forward-events-missing-user-data-and-description

Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
 

Best Regards,

Candy

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

Thursday, August 31, 2017 9:39 AM

Hi Candy Luo,

XML view:

  • <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  • <System>
      <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
      <EventID>4624</EventID> 
      <Version>1</Version> 
      <Level>0</Level> 
      <Task>12544</Task> 
      <Opcode>0</Opcode> 
      <Keywords>0x8020000000000000</Keywords> 
      <TimeCreated SystemTime="2017-08-31T09:27:16.477161400Z" /> 
      <EventRecordID>3036615</EventRecordID> 
      <Correlation /> 
      <Execution ProcessID="540" ThreadID="100" /> 
      <Channel>Security</Channel> 
      <Computer>server.mib.local</Computer> 
      <Security /> 
      </System>
  • <EventData>
      <Data Name="SubjectUserSid">S-1-0-0</Data> 
      <Data Name="SubjectUserName">-</Data> 
      <Data Name="SubjectDomainName">-</Data> 
      <Data Name="SubjectLogonId">0x0</Data> 
      <Data Name="TargetUserSid">S-1-5-21-1254712603-137553960-3431971379-7132</Data> 
      <Data Name="TargetUserName">SERVER$</Data> 
      <Data Name="TargetDomainName">MIB</Data> 
      <Data Name="TargetLogonId">0x1813348</Data> 
      <Data Name="LogonType">3</Data> 
      <Data Name="LogonProcessName">Kerberos</Data> 
      <Data Name="AuthenticationPackageName">Kerberos</Data> 
      <Data Name="WorkstationName" /> 
      <Data Name="LogonGuid">{989BBC9E-8583-D1E4-71D9-9F0669468B16}</Data> 
      <Data Name="TransmittedServices">-</Data> 
      <Data Name="LmPackageName">-</Data> 
      <Data Name="KeyLength">0</Data> 
      <Data Name="ProcessId">0x0</Data> 
      <Data Name="ProcessName">-</Data> 
      <Data Name="IpAddress">-</Data> 
      <Data Name="IpPort">-</Data> 
      <Data Name="ImpersonationLevel">%%1833</Data> 
      </EventData>
      </Event>

When ContentFormat is RenderedText:

The description for Event ID 4624 from source Microsoft-Windows-Security-Auditing cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event: 

S-1-0-0

0x0 S-1-5-21-1254712603-137303960-3431971379-7168 SERVER$ MIB 0x1813348 3 Kerberos Kerberos {989BBC9E-8583-D1E4-71D9-9F0669468B16}

0 0x0

%%1833

The locale specific resource for the desired message is not present

Thursday, August 31, 2017 10:49 AM

Event Log Forwarding does not display event message on collector

Windows Security Log Event ID 4624: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624

https://support.microsoft.com/en-us/help/2739740/event-log-descriptions-are-not-displayed-correctly-in-the-security-eve

Hope this helps!

Solution for Active Directory auditing, monitoring and management.

Wednesday, September 6, 2017 7:07 AM

Hi kingstonen,

Just checking in to see if the information provided was helpful.

Please let us know if you would like further assistance.

Best Regards,

Candy

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

Thursday, May 10, 2018 3:01 PM

Having same issue as above with Server 2016 DC event forwarding

Tried all suggestions, and some events look okay, but nearly all 4624 events same as above example

Did you fix it or work out cause? or does anyone else know solution? have tried everything I can find on Google etc and all other events forward okay just not 4624

Darren Rose

Tuesday, March 19, 2019 12:57 PM

Hello,

I am facing same issues forwarding to a Windows Event Collector server running 2016 with events originating from 2008 and 2012 R2 servers.

Anyone solve this issue yet ? 

Thanks in advance

Tuesday, March 19, 2019 1:07 PM

Hello,

I am facing same issues forwarding to a Windows Event Collector server running 2016 with events originating from 2008 and 2012 R2 servers.

Anyone solve this issue yet ? 

Thanks in advance

Hi

We eventually moved over to all 2016 servers which resolved the issue, but I spent ages on the issue, talking to Microsoft and trying several patches, I will include below my notes I made at the time in case anything relevant to your issue:-

When forwarding from Server 2008 R2 Domain Controller the contents of Event ID 4624 and 4625 are not forwarded correctly, in that values are shown next to the wrong properties e.g. IP Address shown under Process Name or values appearing as %10, %11 etc

This was logged with Microsoft in October 2016 but still two months and lots of testing later the problem is not solved 

Seems it was known problem in 2012 R2 and fixed, but as 2008 R2 out of mainstream support they won't do anything about it

Initial testing on 2016 seems okay, but cannot fully test until LB has 2016 DC implemented

Update: 02/05/18 - new 2016 DC installed and event forwarding now appears to be working correctly for 4624/4625

Update: 10/06/18 - had similar issue with new 2016 server where % symbol was appearing instead of data for event 4624 - as per original discussion with Microsoft above I installed related patch (links below) which fixed the problem



Addressed issue in the event collector data that caused data corruption with % symbols in the user logon events (ID 4624) from other Domain Controllers (DCs)

https://support.microsoft.com/en-us/help/4034663            Server 2012 R2
https://support.microsoft.com/en-us/help/4034661            Server 2016

Addressed issue where Windows Event Forwarding between two 2012 R2 servers makes reports incompatible with third-party Security Information and Event Management software

https://support.microsoft.com/en-us/help/4019217            Server 2012 R2
https://support.microsoft.com/en-us/help/4019472            Server 2016

Darren Rose

Tuesday, March 19, 2019 1:20 PM

Thank you for your quick answer and useful notes sharing !

Cheers

  • Last updated on