User-ID Agent - [Error 115]: Cannot open security log for DC..

[AllwynMascarenhas]

These errors just don't make sense to me, I have followed everything as required.

I am currently doing this in my lab and I'm stuck with this error about permissions, I have given permisions for event log readers, server operators and distributed com users.

Any ideas on what's missing?

I have installed the agent on win7 and the AD is on win srv 2012.

09/30/18 23:59:40:445[ Info 2145]: ------------Service is being started------------

09/30/18 23:59:40:445[ Info 2152]: Os version is 6.1.1.

09/30/18 23:59:40:445[ Info 608]: Load debug log level Info.

09/30/18 23:59:40:445[ Info 557]: Service version is 8.0.10.7.

09/30/18 23:59:40:445[ Info 611]: Product version is 8.0.10.

09/30/18 23:59:40:460[ Info 1132]: Found 0 ACL config. 0 processed.

09/30/18 23:59:40:460[ Info 1160]: Found 0 VM info source config. 0 processed.

09/30/18 23:59:40:460[ Info 1168]: Found 0 Syslog Profile(s) config.

09/30/18 23:59:40:460[ Info 1230]: Found 1 server config.

09/30/18 23:59:40:460[ Info 1265]: Found 0 include-exclude networks. 0 processed.

09/30/18 23:59:40:460[ Info 1290]: Found 0 custom log format config.

09/30/18 23:59:40:460[ Info 1297]: No xml element servercert.

09/30/18 23:59:40:460[ Info 148]: Load 8 build-in formats and 0 custom formats for parsing security log.

09/30/18 23:59:40:460[ Info 345]: DC security log and session query threads for server dc.akmlab.com(index 0) are started.

09/30/18 23:59:40:460[ Info 707]: Active Directory gets started.

09/30/18 23:59:40:460[ Info 742]: User-ID VM monitor service started.

09/30/18 23:59:40:460[ Warn 923]: Unsupported file format for UserIpMap.txt. We support ANSI and UTF-8 format.

09/30/18 23:59:40:913[Error 115]: Cannot open security log for DC dc.akmlab.com - A required privilege is not held by the client.

09/30/18 23:59:41:084[ Info 1241]: New connection 127.0.0.1 : 57678.

09/30/18 23:59:41:084[ Info 1314]: Device thread 0 with 127.0.0.1 : 57678 is started.

09/30/18 23:59:41:178[ Info 3396]: Device thread 0 accept finished

[BinTn7]

In my case I removed patch KB5003646 from the User-ID server and it resolved the issue for most but unfortunately our patch team didn't apply the patches to all DC's so it's hit or miss.

Does anyone know if the latest User-ID agent version is unaffected? I'm currently on 10.0.0-30.

[Guillaume-A]

Thanks for the KB like and the same level patch working fine for us now

[24796]

Hi

Same issue... June 2021 Patch. Do you have the KB Number ?

[Guillaume-A]

This one for me https://www.catalog.update.microsoft.com/Search.aspx?q=KB5003637

[VinceM]

Hi MichaelMelone

Can you give me more detail about the windows patch which solve your issue please ?

Rgds

V.

[MichaelMelone]

Hi Vince, it was the  June 2021 Cumulative Update for Windows Server

[jasonrakers]

Looks like latest Windows server patches may be causing this issue again.

[AdminNCBR]

2022-03 update same problem  😞 ffs

[NicoloB]

I encountered this problem one year ago and resole it easily with made last update of windows server.

But now it returned on Windows 2019 server and It's very difficult undestrand wich update cause it, because windows updates are deploy with cumulative release.

Anyone resolved it?Advice