Comment on page
Event logging and reporting
The password filter logs events to the
Application log on the domain controllers using the event source LithnetPasswordProtection. Reporting is easily performed using a logging and analytics service such as Microsoft OMS or Splunk. The following table lists the event log messages that are logged by the module, and their descriptions.Code | Severity | Message | Notes |
|---|---|---|---|
1 | Error | An unexpected error occurred | The filter encountered an unexpected error and could not process the request |
2 | Warning | The Lithnet AD Password Filter is currently disabled and has not evaluated the password change request | This message appears when the filter is installed and registered with LSASS, but has been disabled and is not evaluating password changes |
3 | Info | The password filter has been successfully loaded | Appears in the event log at startup when the password filter has been successfully loaded by windows (v1.0.7234 and later) |
4 | Success | Processing a password %1 request for %2 (%3). | Each password set/change attempt will cause this event to be logged |
5 | Success | The password %1 request for %2 (%3) was approved. | This event is logged when a password is approved by the filter |
8 | Error | An unexpected error occurred | The filter encountered an unexpected win32 error and could not process the request |
9 | Error | There was a problem opening the store file. Check that the store folder exists and is accessible | The store could not be accessed by the filter. Make sure that SYSTEM has permission to read the folder and files if the store is local, if its on a remote share, ensure that the machines computer account has read access to the share |
8193 | Warning | The password %1 request was rejected. The module is configured to deny password requests when an error occurs. | |
8194 | Warning | The password %1 request for %2 (%3) was rejected because its length (%4) did not meet the minimum configured length (%5). | |
8195 | Warning | The password %1 request for %2 (%3) was rejected because it matched a password in the compromised password store. | |
8196 | Warning | The password %1 request for %2 (%3) was rejected after being normalized because it matched a password in the compromised password store. | |
8197 | Warning | The password %1 request for %2 (%3) was rejected because it did not match the approval regular expression. | |
8198 | Warning | The password %1 request for %2 (%3) was rejected because it matched the rejection regular expression. | |
8199 | Warning | The password %1 request for %2 (%3) was rejected because it achieved only %4 of the required %5 complexity points. | |
8200 | Warning | The password %1 request for %2 (%3) was rejected because it did not meet the complexity requirements of a password below the specified threshold. | |
8201 | Warning | The password %1 request for %2 (%3) was rejected because it did not meet the complexity requirements of a password above the specified threshold. | |
8202 | Warning | The password %1 request for %2 (%3) was rejected because it contained the account name | |
8203 | Warning | The password %1 request for %2 (%3) was rejected because it contained at least part of the display name | |
8204 | Warning | The password %1 request for %2 (%3) was rejected because it did not meet the complexity requirements of a password of %4 characters. | |
8205 | Warning | The password %1 request for %2 (%3) was rejected after being normalized because it matched a password in the banned word store. | |