Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

ZeroLogon Rule: Alert on Windows Server Event

Hi,

We are updating from LEM 6.6 to SEM 2020.2.1. Before doing so, I would like to create a rule to filter on Windows Server Event Viewer ID '5829' This is the event created for non-secure RPC connections. I only want this to apply to domain controllers. I am new to LEM. can anyone help me out with this rule?

Thank you.

Find more posts tagged with

Accepted answers

All comments

pgisclair

I am looking for exactly the same thing. If I find a way I will post it here!

Perry

code_heaven

have you been able to create the rule?

code_heaven

have you been able to create the rule?

ihsanjhakeem

Check first if you have any events for this before creating a rule.

Once you find the event you can create easily

Here is a script to check

https://support.microsoft.com/en-us/help/4557233/script-to-help-in-monitoring-event-ids-related-to-c...

read this too

https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc#:~:text=Log%20event%20ID%205829%20in,starts%20on%20February%209%2C%202021.

vitezslav.papiez

Hello,

I would try something like this

Screenshot 2020-10-30 at 10.31.31.png

Let me know if this helps.

ihsanjhakeem

you can create something like this

Rule is true when

ServiceWarning.ProviderSID

is equal to *5828

ServiceWarning.ProviderSID

is equal to *5827

ServiceWarning.ProviderSID

is equal to *5829

npatterson

I notice you only want to to check DC and I would recommend creating a connection profile under nodes to gather all the DC in one group This you can follow what the process of the that was listed above but also filter by connection profile so into checks DCs. This should cut down on the noise of other agents on your sem.