000037413 - Event ID :28005 error filling up Windows Event Logs in RSA NetWitness Endpoint

Document created by RSA Customer Support Employee on May 28, 2019
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000037413
Applies ToRSA Product Set: NetWitness Endpoint
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition: 4.4.x
Platform: Windows
IssueEvent viewer and SQL error log both show errors indicating 28005 error code. Sample error is below:

User-added image

This explains the possible situations this is seen in, such as when the relevant account is used in the GPO policy is removed from Active Directory, or the account name is incorrect within the relevant GPO.
ResolutionThis is not an issue with ECAT itself but rather an Active Directory and how it handles errors with account names and security ID's. The article http://www.rebeladmin.com/2016/01/how-to-fix-error-no-mapping-between-account-names-and-security-ids-in-active-directory/ can be used to troubleshoot this issue.