Submit a ticketCall us

ebook60.pngHow to be a Cisco® ASA ace

Our eBook, Thou Shalt Not Pass…I Think?! can help you overcome the challenges of monitoring and managing Cisco ASA firewalls. This eBook is a great read if you’ve been frustrated with monitoring firewalls, managing ACL configs, and troubleshooting VPN connections.

Get your free eBook.

Home > Success Center > Log & Event Manager (LEM) > Windows agents are sending limited events

Windows agents are sending limited events

Created by Jason Dee, last modified by Rodim Suarez on Mar 09, 2017

Views: 230 Votes: 1 Revisions: 4

Updated March 9, 2017

Overview

Windows hosts are sending a limited number of events or a very small number of event types.

Environment

All LEM versions

Cause 

Improperly configured Group Policy object or Windows Audit Policy.

Resolution

The events and event types sent over by LEM agents are dictated by the events that are created by Windows. If you are receiving some events from an Agent, we can assume that the Agent and LEM are working properly. The issue is that the events themselves are not being generated due to an improperly configured Group Policy object or Windows Audit Policy.

 

Please refer to Audit Policies and Best Practices for LEM for additional information on our recommended audit policies and how to make those changes.

 

Last modified

Tags

Classifications

Public