Windows 2008 R2 not registering logon events to 2003 RDP sessions

Hi,
I have few windows 2008 R2 terminal servers which I use to RDP into other 2008/2003 servers.
The audit policy for logon/logoff event for success of failure is setup for all servers via group policy.
I've noticed when I log on to any 2003 server from 2008 terminal server there is no logon/log off event generated on the 2008 server.  There is related events on 2003 servers. This does not happen when I log on to 2008 servers from 2008 server.
there is a related event created on both side.
Any idea why there is no even created for 2008 to 2003 rdp sessions?
Thanks in advance

when pre-authentication is used, events are registered on both ends: client, when pre-authentication occurs and server, when client is completely authenticated on the server.
> on the 2008 terminal server when RDP into 2003 from 2008,
you should see, because starting with Windows Server 2008, RDP client always performs pre-authentication.
My weblog: http://en-us.sysadmins.lv
PowerShell PKI Module: http://pspki.codeplex.com
Check out new:
PowerShell FCIV tool.

Similar Messages

  • Windows 2008 R2 backup fails with event 521 error code 2155348001

    Windows Server 2008 R2 SP1.  Hyper-V role installed. 
    OS on drive C.  All VMs stored on Drive D.
    I am attempting to run a Bare Metal backup of the host system to a network share. 
    Drive D is not included in the backup job.  I am getting the following error:
    Log Name:      Application
    Source:        Microsoft-Windows-Backup
    Date:          1/10/2014 11:28:52 PM
    Event ID:      521
    Task Category: None
    Level:         Error
    Keywords:     
    User:          SYSTEM
    Computer:      SHAQTUS.scdl.local
    Description:
    The backup operation that started at '‎2014‎-‎01‎-‎11T04:08:50.683000000Z' has failed because the Volume Shadow Copy Service operation to create a shadow copy of the volumes being backed up failed with following error code '2155348001'. Please review the event
    details for a solution, and then rerun the backup operation once the issue is resolved.
    Reviewing event details, as suggested, does not offer any solution.
    I have tried the suggested solutions in other similar threads of increasing the timeout value with the registry entry. 
    This does not work.
    I have not tried reregistering the VSS writers manually, as the only links I have found are for server 2003/2008 (not R2) and explicitly state that they won’t work on higher versions of the OS, since they now utilize manifests and the manual procedure could
    cause problems for those servers. Haven't found similar procedures for 2008 R2.
    I have been able to narrow this down a bit.
    A Windows 2008 R2 SP1 server with Hyper-V installed – backup to a network share is successful;
    Install the DPM 2012 agent – same backup fails with the 2155348001 error.
    We use DPM 2012 to backup VMs, but DPM cannot perform a bare metal backup/restore of server and the 2012 version no longer has the DPMSRT feature. 
    I prefer to run Bare Metal Backup to a file server share.
    Stuck on this one.
    Rick

    Hi, 
    The issue is related to DPM, I would suggest you ask for help from DPM forums:
    http://social.technet.microsoft.com/Forums/en-US/home?forum=dataprotectionmanager
    Regards, 
    Mandy
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Windows 2008 R2 SP1 Exchange DAG event 1196 and 1579 Bad DNS Key

    Hi,
    I'm running an Exchange 2010 SP1 DAG on Windows 2008 R2 SP1.  We are using an INFOBLOX appliance for DNS resolution.
    DNS resolution is working and SRV records are created.
    On one of the two clusternodes I get warning 1579 and error 1196 every 15 minutes.  After looking around on the internet and technet, I found kb 977158 stating the problem and resolution.  However this hotfix is not applicabel on Windows
    2008 R2 SP1 .
    How can I resolve these annoying events?
    Event 1196 failoverClustering:
    Cluster network name resource 'Cluster Name' failed registration of one or more associated DNS name(s) for the following reason:
    DNS bad key.
    Ensure that the network adapters associated with dependent IP address resources are configured with at least one accessible DNS server.
    Event 1579 Failover Clustering
    Cluster network name resource 'Cluster Name' failed to update the DNS record for name 'DAG.domain.local' over adapter 'NIC1-LAN'. The error code was 'DNS bad key. (9017)'. Ensure that a DNS server is accessible from this cluster node and contact your DNS
    server administrator to verify the cluster identity can update the DNS record 'DAG.domain.local'.
     Frederik

    Cause:
    The cluster name resource which has been added to the DNS prior to setup active passive cluster ( or any type) need to be updated by the Physical nodes on behalf of the resource record itself. When the active node owns the resources it want to update the
    A record in the DNS database and DNS record which was created won’t allow any authenticated user to update the DNS record with the same owner
    Solution:
    Delete the existing A record for the cluster name and re-create it and make sure select the box says “Allow any authenticated user to update DNS record with the same owner name “Don’t worry about breaking anything , this has “ZERO”
    impact to cluster simply delete the A record and re-create as it is suggested here.
    http://amradmin.wordpress.com/2011/01/27/event-id-1196-1119-dns-operation-refused-cluster-servers/
    Thanks,
    Amr Tantawi |MCITP |EMA

  • Windows 2008 r2 not showing installed app in control panell

    Hello,
    I installed a new application on a brand new windows 2008 r2 machine. It does not show in control panel. The same app show in control panel of another machine which has windows 2008 r2  
    I checked the control panel policy in gpedit.msc and enabled all,  but no luck.
    When i try to uninstall the application programatically by browsing to uninstall key in registry it works.
    Any Ideas?
    TIA
    checked the control panel policy in gpedit.msc and enabled all,  but no luck.
    When i try to uninstall the application programatically 
    Any Ideas?
    TIA

    Hi jj1026,
    Can you check if you have an active connection? What type of connection are using? If you are using cellular data connection, try to use Wi-Fi and check if the app updates will appear on the Store. Also, do you have multiple phones registered under your Microsoft account? The App update push notifications may not be shown if you have multiple phones running with the same account. If this is your case, try to remove a registered device from your Microsoft account, please follow the steps below:
    Use a desktop browser, sign in to your Microsoft account by clicking on the link www.windowsphone.com.
    Once signed in, and then hover a mouse pointer over your name at the top right corner of the page.
    On the drop down menu, you will also see the list of devices that are registered on you Microsoft account.
    Select a device that you would like to remove.
    Once you have selected the device, move a mouse pointer over your name and then select Account Settings on the drop down menu.
    At the top left corner, you will see the name and model of the Windows Phone you would like to remove.
    Click on Remove.
    Confirm the action by clicking on Remove on the pop-up window.
    The back-end change to remove device association takes up to 72 hours to replicate through the systems.
    Let us know the outcome.

  • FTP-adapter does not register subscribed events

    I have installed an FTP-adapter and configured it to receive messages. I have created an application with the same name and set up a subscription to an event from an generic adapter. I have another db adapter also subscribing to the same event, and this works fine. However the ftp adapter does not receive the subscribed event. I have checked the MESSAGEINFOIDTABLE table, and the subscription between the FTP adapter and the genric adapter is not registered here. I have tried to resintall the adapter several times using different names etc, but it does not seem to register. Anyone had this situation before, or does anoyone have any tips?

    Audun,
    This is very strange. You haven't got 2 environments have you? Developing on one, but looking at another? Sorry for the dumb question, but I've done that before!!
    If you have 1 event, 1 publishing and 2 subscribing, then your count on the MESSAGEINFOIDTABLE table for this event should be 3.
    Have you tried pushing the metadata in iStudio to your FTP Adapter? Or restarting the FTP Adapter?
    You've definately subscribed to the correct Business Object and Event when mapping your message from Common View to Subscribe view?
    Your repository may be all screwed up. This can happen. iStudio doesn't have the best history! When you've reinstalled the adapter again, or re-designed the message again and again, you could have orphaned objects all over the place preventing proper message design taking place.
    As a sanity check, stop all services connecting the repository (iStudio, Adapters, OEM, sqlplus etc.) Save / backing up your current repository using the "oaiexport" script.
    Once you done that, drop the existing repository, and create a new fresh one. (use the "hubschema" -drop, then -create script).
    Just try creating that same single message design again with just one publishing and one subscribing adapter.
    If you still have the same problem, then I think it is one for Oracle Support.
    Good luck,
    Yan

  • 2nd JFrame at Full Screen not registering key events

    I've written an application that launches other applications distributed as JARs with a particular method (replacing the main method). These other applications run at full screen.
    Whilst I have got these other applications to work in that they display correctly and do everything else, I require them to register key events. If I run these applications on their own (i.e. having not been launched by the primary application) then the key events are processed correctly. However when they are launched from the primary application the key events are not registered.
    I have tried requesting focus from the full screen JFrame but it doesn't seem to be able to.
    Any ideas?

    Possible that the keystrokes are really being trapped by the other gui, which stops registering them when it's not visible.
    IF that's the case, you'll need to re-design your keyboard trap as part of the second JFrame, wholly independent of the original JFrame or originating app. Also, it may be thread-starved i.e. operating off the originating program, which thread may be stopping when it has no focus.
    That's all the ideas I have.

  • SCEP 2012 Client in Windows 8 / 2012 - in Windows 2008 Domain- Not Syncing -/ Not Compatiable

    Dear All ,
    With lots of Hardship I had installed SCEp 2012 in Windows 2012 Virtual machine in WIndows 2008 Domain.
    SCCM 2012 Server in Windows 2008 Server with Sql 2008 was - performing well and there was no issues until our COmpany planned to Convert the Windows 2008 Server to  Windows 2012 Server ( AD is 2008)
    WSUS is not Fully synching with SCCM 2012 ( previously it was )
    Software Updates not pushing properly and to top all the SCEP client is not compatible with win 8.1 pro or win 2012 server
    Error: Failed to download content id 16787046. Error: Access is denied.
    Package:
      Success: The software updates were placed in the existing package:
    •     Deployment Package(JUN2014)
    Software updates that will be downloaded from the internet
      Error: Update for Forefront Endpoint Protection 2010 Client - 4.1.522.0 (KB2780435)
    Errors
        Failed to download content id 16787046. Error: Access is denied.
    Language Selection:
     English
    But the service account has full access - administrative rights and the administrator of the system
    please advise on this

    Hi,
    All the software updates downloaded failed?
    Are there any errors in PatchDownloader.log? If you use Automatic deployment rule, please also check ruleengine.log.
    Please add the account with Full rights to the source share (both NTFS and Share permissions) where the Deployment Package is located.
    Best Regards,
    Joyce
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Windows 2008 failover clustering fails with Event ID 1205 1069 1558

    I have a two nodes Windows 2008 and SQL 2008 cluster running in active\passive.  I was restarting
    my nodes after applying windows update then I received the following error message below within Failover Cluster Manager. I get errors with Event ID 1205 1069 1558  this happens every month ..  Could someone help me on to find the root cause for
    this issue how to check if it is an issue with network or Quorum drive  ?

    First, take a look at the 1069 event. This should point out which resource is failing. 
    Then, open a command prompt and run the command: cluster log /g
    This will generate a cluster.log file that you can use to further troubleshoot this issue. The log file will be located in the C:\Windows\Cluster\Reports folder.
    The cluster.log will be based on GMT time, so you may need to translate this to the local time zone in order to find the events you are looking for. Look for ERR or WARN messages and these should hopefully give you more insight as to why the resource is
    failing.
    Hope this helps. 
    Visit my blog about multi-site clustering

  • Macbook Pro Retina (July 2014) will not register TOUCH events when going through the AIR DEBUG LAUNCHER for MOBILE

    I recently purchased a MACBOOK PRO with a retina screen and have started to transition to it as a primary work computer.
    I have a game that is built on another Macbook Pro (non retina) that works fine in the AIR debug launcher for mobile but when I launch it from the RETINA device, the touch events seem to not register correctly.
    Has anyone else experienced this issue?

    To further clarify, it appears the touch simulator is cutting everything in half, maybe because of the pixel density?

  • Backup failed for Windows 2008 R2 error code 2147755009 event id 19

    Hi Guys,
    I'm doing Windows server backup to a NAS drive via iSCSI target, and everything works fine until a few weeks back where my backup started to fail with the above event ID and error code. Description provided by Microsoft doesn't help either as it simply doesn't
    explain much at all. (http://technet.microsoft.com/en-us/library/cc734218%28v=ws.10%29.aspx)
    I updated the firmware of the NAS drive, make sure iSCSI connection wasn't dropping, and i even manage to do a backup manually via the "Backup Once" action. But when it comes to scheduled backup, it keeps on failing. I'm pretty sure the NAS drive
    is working fine as well as iSCSI connection since i can do a backup manually.
    Any idea guys?

    Hi,
    Could you please provide more detailed information about the error? You could refer to the article below to check if it helps:
    Event ID 19: The backup operation attempted at '‎specific date' has failed to start, error code '2155348032'
    https://bluesolutions.zendesk.com/entries/23345746-Event-ID-19-The-backup-operation-attempted-at-specific-date-has-failed-to-start-error-code-215534803
    Please Note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
    Regards,
    Mandy
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Windows 2008/R2 not getting IP from Lab Manager 3.x

    Hi all.  We had a crash of Lab Manager 3.x here a few months back, and I've rebuilt the infrastructure back up. 
    We currently use three OS's for our lab testing, Win 2K3, RHEL 5, and Win 2K8 R2 and non-R2.  For the Win 2K3 and RHEL VM's, there are no problems with Lab Manager assinging an IP to the boxes when they are spun up.  I have a pool of 192.168.194.0 /24 assigned and each machine will take the next available IP in that pool.
    The Win 2K8 servers, however, are a different story.  No matter what I do, I can't seem to get the Lab Manager to assign an IP to the box when it's spun up from a template.  In LM, it states the machine has been assigned an IP of 192.168.194.x, but when I check the machine via console, it seems to be pulling IP's from other DHCP VM's we have deployed, and not LM. 
    Is there a way to set the template for 2K8 to pull the IP from LM as opposed to an Win DHCP box? 
    Thanks!

    Hi
    Welcome to the communities.
    Please check if windows getting APPIPA IP or not.
    If APPIPA ip not getting something wrong with inbuilt NIC or driver.
    "a journey of a thousand miles starts  with a single step."

  • Windows 2008 Group Policy not working in Windows 8.1

    Hi ,
    We found that the GPO settings created in Windows 2008 is not working in a Windows 8.1 machine.
    One example is the proxy settings.
    We confirmed from gpresult that the GPO is in the list but checking the actual proxy settings, it is not applied.
    Regards,
    Jhun

    Hi,
    How did we configure the proxy settings, using Internet Explorer Maintenance? If it is this case, just as Martin suggested, we can’t use IEM to manage
    IE 10 and IE 11.  However, we can configure the proxy setting via Group Policy Preferences (GPP).
    Regarding this point, the following blog can be referred to for more information.
    Configuring Internet Explorer 10′s
    Proxy Via Group Policy
    http://johnfail.wordpress.com/2013/06/15/configuring-internet-explorer-10s-proxy-via-group-policy/
    In addition, when we use this GPP extension, pay attention to GPP F5-F8 keys.
    Regarding this point, the following blog can be referred to for more information.
    Group Policy Preferences F5 F6 F7 F8 “documentation”
    http://msitpros.com/?p=1014
    Please Note: Since the above two websites are not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy
    of this information.
    In addition, regarding the deprecation of IEM, the following article can be referred to for more information.
    Appendix B: Replacements for Internet Explorer Maintenance
    http://technet.microsoft.com/en-us/library/jj890998.aspx
    Best regards,
    Frank Shen

  • Error Installing Print Driver on Windows 2008 Server R2

    I am getting an error installing the Xerox Print driver on Windows 2008 R2. Here is the event viewer detail. Any ideas?
    Log Name: Microsoft-Windows-PrintService/Admin
    Source: Microsoft-Windows-PrintService
    Date: 06/24/2014 10:47:11 AM
    Event ID: 215
    Task Category: Installing a printer driver
    Level: Error
    Keywords: Printer Setup,Printer
    User: SYSTEM
    Computer: IHE-DEV8NEW-11V.Americas.mittalco.com
    Description:
    Installing printer driver Xerox ColorQube 9303 PS failed, error code 0x0, HRESULT 0x80070705. See the event user data for context information.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <System>
    <Provider Name="Microsoft-Windows-PrintService" Guid="{747EF6FD-E535-4D16-B510-42C90F6873A1}" />
    <EventID>215</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>19</Task>
    <Opcode>12</Opcode>
    <Keywords>0x8000000000000220</Keywords>
    <TimeCreated SystemTime="2014-06-24T15:47:11.407265800Z" />
    <EventRecordID>82</EventRecordID>
    <Correlation />
    <Execution ProcessID="1124" ThreadID="3836" />
    <Channel>Microsoft-Windows-PrintService/Admin</Channel>
    <Computer>IHE-DEV8NEW-11V.Americas.mittalco.com</Computer>
    <Security UserID="S-1-5-18" />
    </System>
    <UserData>
    <SetupInstallPrinterDriver xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events">
    <Label>InternalInstallPrinterDriverFromPackage</Label>
    <Message>pfnPSetupParseInfAndCommitFileQueue failed</Message>
    <AdditionalInfo>-</AdditionalInfo>
    <InfPath>-</InfPath>
    <DriverName>Xerox ColorQube 9303 PS</DriverName>
    <InstallSection>-</InstallSection>
    <ProcessorArchitecture>Windows x64</ProcessorArchitecture>
    <PackageAware>Not package aware</PackageAware>
    <CoreDriverDependencies>-</CoreDriverDependencies>
    <LastError>0x0</LastError>
    <HResult>0x80070705</HResult>
    </SetupInstallPrinterDriver>
    </UserData>
    </Event>
    Ray Pietrzak

    Hi Ray,
    On current situation, please refer to the following KB and check if set
    Point and Print Restrictions policy to Disabled. Then monitor the result.
    Event ID's commonly associated with point and print
    restrictions
    In addition, I noticed that there was a thread which you created one year ago. It seems to be similar with
    current issue. However, please have a look.
    Windows
    2008 Server
    If I misunderstand, please don’t hesitate to let me know.
    Hope this helps.
    Best regards,
    Justin Gu

  • Can we convert Scheduled tasks in Windows 2003 to Windows 2008 Automatically

    Can we convert Scheduled tasks in Windows 2003 to Windows 2008 Automatically. what is the simpler way to convert it

    ... so migration of scheduled tasks from windows 2003 to windows 2008 is not possible.
    sainath anal
    If that is true, then what is the following TechNet article discussing?
    http://technet.microsoft.com/en-us/library/dd363704(v=ws.10).aspx
    Excerpt:
    Task Scheduler Backward Compatible Module Status
    Applies To: Windows Server 2008 R2
    The backward compatibility module is used by Task Scheduler to register and run tasks that were created to run on Windows Server 2003, Windows XP, and Windows 2000.

  • Windows 2008 problems with Delphi and the Crystal Reports VCL

    Anybody had any luck with Crystal XI using the VCL on a Windows 2008 machine?
    In testing we've found that everything seems to work, except that the user can not select a different printer.  When I go to the Printer Setup button, the panel that pulls up used to have, in previous Windows versions, a printer button inside the Printer Options box.  Windows 2008 does not, so the end user can not select a different printer to print to than their default.
    Anybody have any ideas on:
    1) Am I just doing somthing wrong
    2) A fix for the Crystal XI VCL that will address the probelm
    3) An option on how to call Crystal Reports from inside a Delphi program without the VCL?
    Obviously, I'm hoping I don't have to go with #3, but if that's the only solution I guess I need to know now.
    Mike Nielsen

    Hi Mike,
    Try these links:
    https://www.sdn.sap.com/irj/boc/businessobjects-samples?rid=/webcontent/uuid/80774579-b086-2b10-db91-ed58c4dda375
    If that link doesn't work try this one:
    https://www.sdn.sap.com/irj/boc/businessobjects-samples
    Then click on the Crystal Reports .NET SDK link.
    Gets you to the .NET downloads and you should see this, try the RAS samples, gives you the most functionality:
    Crystal Reports .NET SDK Applications
    All Sample Applications
    All | Exporting/Printing | Report Modification | Viewing | Home
    Report Application Server .NET Sample Code Code Sample(ZIP 177 KB)
    Contains Visual Studio 2005 Web sample code pages that highlight features of the RAS SDK, including report parameter and formula modification, database logon, and exporting.10 Oct 2008
    NET-CS2005_CRNET_CR115_Set_Viewer-Locale-by-Page Code Sample(ZIP 51 KB)
    This sample shows you how to change the multilingual settings for the .NET web form viewer control (CrystalReportViewer) to any locale of your choice. The locale is set via a QueryString variable. The settings are changed on the webform page level instead of using the web.config. Changing the Regional Settings or IE Language Settings will not impact this sample. Note: This has only been tested on Crystal Reports XI R2 with Visual Studio .NET 2005.14 Jul 2008
    NET-CS2003_RAS-Unmanaged_CR115_Modify_Command-Table-SQL Code Sample(ZIP 31 KB)
    "This sample application shows how to retrieve and change the text of a SQL command table from a Crystal Report using the CR .NET SDK and in-process Report Application Server (RAS) Report Creation API (RCAPI). Note that you must have SP2 for Crystal Reports XI R2 for this sample to work. Previously you could access the RAS .NET SDK from the ReportDocument object only if you had a dedicated RAS server. Now you can use RAS in-process to accomplish this. "05 Mar 2008
    NET-CPP-Win2005_CRNET_CR115_Change_Record-Selection-Formula Code Sample(ZIP 3 MB)
    A .NET C++ Windows application that demonstrates how to change a record selection formula at runtime.03 Mar 2008
    Crystal Reports 2008 .NET SDK Tutorial Samples Code Sample(ZIP 2 MB)
    This sample contains Visual Studio 2005 Web sample code projects that highlight features of the Crystal Reports .NET SDK, including viewing and exporting reports, filtering data and setting parameters, and connecting to different data sources.19 Feb 2008
    NET-CS2005_CRNET_CR115_Modify_Image-Location Code Sample(ZIP 90 KB)
    This sample application shows how to change an image in a Crystal Report at runtime using the graphic location formula in the CR .NET SDK (C#).16 Feb 2008
    NET2003-CS-Web_CRNET_CR115_change_graphic-location Code Sample(ZIP 103 KB)
    This sample application shows how to change an image in a Crystal Report at runtime using the graphic location formula in the CR .NET SDK (C#).31 Jan 2008
    Crystal Reports .NET SDK u2013 Sample Applications from Tutorials Code Sample(ZIP 1 MB)
    This file contains C# and VB .NET Windows and web sample applications. These samples were built using the tutorials provided in the u2018Crystal Reports .NET SDK u2013 Additional Documentation and Tutorialsu2019 (cr_net_sdk_additional_en.zip). These sample applications apply to Crystal Reports 9 and 10, and Crystal Reports for Visual Studio .NET 2002 and 2003.10 May 2006
    Thanks again
    Don

Maybe you are looking for