Signs of possible Logon or GPO issues - Windows
| 0 Votes |
Description
Property Details
| 2994789 | |
| Alpha - Code that was just developed | |
| Signs of possible Logon or GPO issues - Windows | |
| BESC | |
| jgstew on 5/6/2015 10:43:17 AM | |
| jgstew on 5/6/2015 10:43:17 AM | |
| 9834 Views / 39 Downloads | |
* Average over 0 ratings.
** Log In or Register to add your rating.
|
Properties
Time of latest user logon
Period
6 hours
| * Results in a true/false |
maximum of times generated of records whose(event id of it = 7001) of system event log
Diff of userLO & GPO update
Period
6 hours
| * Results in a true/false |
(maximum of times generated of records whose(event id of it = 1073743528 AND source of it = "SceCli") of application event log) - (maximum of times generated of records whose(event id of it = 7001) of system event log)
Diff of userLO & first GPO update after LO
Period
6 hours
| * Results in a true/false |
(minimum of times generated of records whose(event id of it = 1073743528 AND time generated of it > (maximum of times generated of records whose(event id of it = 7001) of system event log)) of application event log)-(maximum of times generated of records whose(event id of it = 7001) of system event log)
Time of first GPO update after latest userLO
Period
6 hours
| * Results in a true/false |
(minimum of times generated of records whose(event id of it = 1073743528 AND time generated of it > (maximum of times generated of records whose(event id of it = 7001) of system event log)) of application event log)
number of NTP problems
Period
6 hours
| * Results in a true/false |
number of records whose(event id of it = 129 AND source of it = "Microsoft-Windows-Time-Service") of system event log
number of DNS problems
Period
6 hours
| * Results in a true/false |
number of records whose(event id of it = 1014 AND source of it = "Microsoft-Windows-DNS-Client") of system event log
number of GPO problems
Period
6 hours
| * Results in a true/false |
number of records whose(event id of it = 1129 AND source of it = "Microsoft-Windows-GroupPolicy") of system event log
number of DC errors
Period
6 hours
| * Results in a true/false |
number of records whose(event id of it = 5719 AND source of it = "NETLOGON") of system event log
number of GPO successes
Period
6 hours
| * Results in a true/false |
number of records whose(event id of it = 1073743528 AND source of it = "SceCli") of application event log
NTP 129 error
Period
6 hours
| * Results in a true/false |
(minimum of times generated of records whose(event id of it = 129 AND source of it = "Microsoft-Windows-Time-Service" AND time generated of it > (maximum of times generated of records whose(event id of it = 1 AND source of it = "Microsoft-Windows-Power-Troubleshooter") of system event log)) of system event log)
DNS 1014 error
Period
6 hours
| * Results in a true/false |
(minimum of times generated of records whose(event id of it = 1014 AND source of it = "Microsoft-Windows-DNS-Client" AND time generated of it > (maximum of times generated of records whose(event id of it = 1 AND source of it = "Microsoft-Windows-Power-Troubleshooter") of system event log)) of system event log)
GPO 1129 error
Period
6 hours
| * Results in a true/false |
(minimum of times generated of records whose(event id of it = 1129 AND source of it = "Microsoft-Windows-GroupPolicy" AND time generated of it > (maximum of times generated of records whose(event id of it = 1 AND source of it = "Microsoft-Windows-Power-Troubleshooter") of system event log)) of system event log)
DC 5719 error
Period
6 hours
| * Results in a true/false |
(minimum of times generated of records whose(event id of it = 5719 AND source of it = "NETLOGON" AND time generated of it > (maximum of times generated of records whose(event id of it = 1 AND source of it = "Microsoft-Windows-Power-Troubleshooter") of system event log)) of system event log)
Relevance
isWindows (Relevance 1172)
windows of operating system
/* Windows 7 or later */ version of operating system >= "6.1"
| Used in 1 analsis | * Session Relevance |
"Physical" = (if (mac of operating system) then /* the Mac BES client does not currently support the smbios inspector. This needs refinement, but for now just assuming apple devices are physical since virtualiztion of OS X is relatively rare */ "Physical" else (if ((it contains "VMware" or (it contains "Microsoft" AND /* This check is needed to exclude Microsoft Surface devices */ ((value "product_name" of structure "system_information" of smbios) as string contains "Virtual Machine")) or it contains "Xen" or /* This check is needed to properly identify Parallels VMs as virtual instead of physical */ it contains "Parallels Software") of (value "manufacturer" of structure "system_information" of smbios as string)) then "Virtual" else "Physical"))
| Used in 1 analsis | * Results in a true/false |
"workgroup" != (it as string as lowercase) of (if (exists wmi) then (string value of selects "Domain from Win32_ComputerSystem" of wmi) else ("workgroup"))
Sharing
| Social Media: |
