> For the complete documentation index, see [llms.txt](https://docs.lithnet.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.lithnet.io/password-protection/advanced-help/event-logging-and-reporting.md). # Event logging and reporting The password filter logs events to the `Application` log on the domain controllers using the event source `LithnetPasswordProtection`. Reporting is easily performed using a logging and analytics service such as Microsoft OMS or Splunk. The following table lists the event log messages that are logged by the module, and their descriptions. | Code | Severity | Message | Notes | | ---- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | 1 | Error | An unexpected error occurred | The filter encountered an unexpected error and could not process the request | | 2 | Warning | The Lithnet AD Password Filter is currently disabled and has not evaluated the password change request | This message appears when the filter is installed and registered with LSASS, but has been disabled and is not evaluating password changes | | 3 | Info | The password filter has been successfully loaded | Appears in the event log at startup when the password filter has been successfully loaded by windows (v1.0.7234 and later) | | 4 | Success | Processing a password %1 request for %2 (%3). | Each password set/change attempt will cause this event to be logged | | 5 | Success | The password %1 request for %2 (%3) was approved. | This event is logged when a password is approved by the filter | | 8 | Error | An unexpected error occurred | The filter encountered an unexpected win32 error and could not process the request | | 9 | Error | There was a problem opening the store file. Check that the store folder exists and is accessible | The store could not be accessed by the filter. Make sure that `SYSTEM` has permission to read the folder and files if the store is local, if its on a remote share, ensure that the machines computer account has read access to the share | | 8193 | Warning | The password %1 request was rejected. The module is configured to deny password requests when an error occurs. | | | 8194 | Warning | The password %1 request for %2 (%3) was rejected because its length (%4) did not meet the minimum configured length (%5). | | | 8195 | Warning | The password %1 request for %2 (%3) was rejected because it matched a password in the compromised password store. | | | 8196 | Warning | The password %1 request for %2 (%3) was rejected after being normalized because it matched a password in the compromised password store. | | | 8197 | Warning | The password %1 request for %2 (%3) was rejected because it did not match the approval regular expression. | | | 8198 | Warning | The password %1 request for %2 (%3) was rejected because it matched the rejection regular expression. | | | 8199 | Warning | The password %1 request for %2 (%3) was rejected because it achieved only %4 of the required %5 complexity points. | | | 8200 | Warning | The password %1 request for %2 (%3) was rejected because it did not meet the complexity requirements of a password below the specified threshold. | | | 8201 | Warning | The password %1 request for %2 (%3) was rejected because it did not meet the complexity requirements of a password above the specified threshold. | | | 8202 | Warning | The password %1 request for %2 (%3) was rejected because it contained the account name | | | 8203 | Warning | The password %1 request for %2 (%3) was rejected because it contained at least part of the display name | | | 8204 | Warning | The password %1 request for %2 (%3) was rejected because it did not meet the complexity requirements of a password of %4 characters. | | | 8205 | Warning | The password %1 request for %2 (%3) was rejected after being normalized because it matched a password in the banned word store. | | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.lithnet.io/password-protection/advanced-help/event-logging-and-reporting.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.