Event logging and reporting

The password filter logs events to the Application log on the domain controllers using the event source LithnetPasswordProtection. Reporting is easily performed using a logging and analytics service such as Microsoft OMS or Splunk. The following table lists the event log messages that are logged by the module, and their descriptions.

Code	Severity	Message	Notes
1	Error	An unexpected error occurred	The filter encountered an unexpected error and could not process the request
2	Warning	The Lithnet AD Password Filter is currently disabled and has not evaluated the password change request	This message appears when the filter is installed and registered with LSASS, but has been disabled and is not evaluating password changes
3	Info	The password filter has been successfully loaded	Appears in the event log at startup when the password filter has been successfully loaded by windows (v1.0.7234 and later)
4	Success	Processing a password %1 request for %2 (%3).	Each password set/change attempt will cause this event to be logged
5	Success	The password %1 request for %2 (%3) was approved.	This event is logged when a password is approved by the filter
8	Error	An unexpected error occurred	The filter encountered an unexpected win32 error and could not process the request
9	Error	There was a problem opening the store file. Check that the store folder exists and is accessible	The store could not be accessed by the filter. Make sure that SYSTEM has permission to read the folder and files if the store is local, if its on a remote share, ensure that the machines computer account has read access to the share
8193	Warning	The password %1 request was rejected. The module is configured to deny password requests when an error occurs.
8194	Warning	The password %1 request for %2 (%3) was rejected because its length (%4) did not meet the minimum configured length (%5).
8195	Warning	The password %1 request for %2 (%3) was rejected because it matched a password in the compromised password store.
8196	Warning	The password %1 request for %2 (%3) was rejected after being normalized because it matched a password in the compromised password store.
8197	Warning	The password %1 request for %2 (%3) was rejected because it did not match the approval regular expression.
8198	Warning	The password %1 request for %2 (%3) was rejected because it matched the rejection regular expression.
8199	Warning	The password %1 request for %2 (%3) was rejected because it achieved only %4 of the required %5 complexity points.
8200	Warning	The password %1 request for %2 (%3) was rejected because it did not meet the complexity requirements of a password below the specified threshold.
8201	Warning	The password %1 request for %2 (%3) was rejected because it did not meet the complexity requirements of a password above the specified threshold.
8202	Warning	The password %1 request for %2 (%3) was rejected because it contained the account name
8203	Warning	The password %1 request for %2 (%3) was rejected because it contained at least part of the display name
8204	Warning	The password %1 request for %2 (%3) was rejected because it did not meet the complexity requirements of a password of %4 characters.
8205	Warning	The password %1 request for %2 (%3) was rejected after being normalized because it matched a password in the banned word store.