Configuring event sources
Follow the step-by-step procedure below to configure event sources in EventLog Analyzer.
- To start with, ensure that the following ports and protocols are available for configuring the event source.
- Port 139 and 445: SMB and Remcom protocols
- 135, 137, and 138: RPC protocol
- Check if the following conditions are satisfied.
- The Windows Remote Registry service should be running on the source machine.
- Files should be available in the event file location. Event file is located at C:\Windows\System32\winevt\Logs.
- The Winreg registry key should at least have read access. Winreg registry key is located at Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg.
- Full control permission should be granted for credentials in the EventLog registry key. The EventLog registry key is located at Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog.
- In the registry key, LocalAccountTokenFilterPolicy should be enabled when local accounts are used. You can verify it in this file path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.
If all the above conditions are satisfied, restart the Remote Registry service on the remote machine and check if Configure Event Source populates in EventLog Analyzer.
New to ADSelfService Plus?
Related Articles
How to configure an event source for multiple devices via Group Policy
Objective This article explains how to configure event sources for multiple Windows devices using Group Policy and a PowerShell script. This helps with enabling the Event Source file individually for each machine. Prerequisites User permissions: ...Configuring SSL certification
Enable SSL certification in the GUI: Log in to EventLog Analyzer as an administrator. Go to Settings > System Settings > Connection Settings > General Settings. Enable SSL [HTTPS] and enter the desired web port number. The default web port used is ...Error: Some of the dashboard widgets show "No Data Available"
Issue description Some dashboard widgets display a "No Data Available" message, which impacts the real-time monitoring of data for the security operations center (SOC) or network operations center (NOC) team. Applicable across multiple builds, ...Partial log collection or no logs are collected due to flooding of events in Event Viewer | EventLog Analyzer troubleshooting
Issue description When high log flow is observed, Event Viewer may flood out, leading to partial or no logs being collected. Possible cause A high number of events being generated in a production environment server might exhaust or exceed the Event ...How does EventLog Analyzer store the collected data
Objective This document provides details on how EventLog Analyzer stores the collected event logs or data. Prerequisites Understanding of the duration of log management needed by the organization. Understanding of the duration of logs searched by ...