|Applies To||RSA Product Set: enVision|
RSA Product/Service Type: enVision Core
RSA Version/Condition: 4.1
Product Description: RSA enVision 1000 EPS[ ES/LS]
|Issue||How to troubleshoot NIC Windows Agentless collection|
|Tasks||Based on the enVision deployment, which will be either:|
1. (1) WAITING 10.xx.xx.xx Security Microsoft Windows 2000 ( 900 + ) Tue Feb 20 17:22:30 2007 (No new events) (Normal)
|Resolution||If the software is unable to connect to the registry with the error due to improper access permissions|
(2) UNRESPONSIVE 10.xx.xx.xx Security Microsoft Windows XP ( 3600 ~ ) Tue Feb 20 18:07:35 2007 (OpenEventLog failed: A required privilege is not held by the client.) (Improper access rights)
To resolve this issue,
1. On your enVision server launch Windows Explorer:
a. Navigate to the E:\envision\bin folder and run the application runeventvieweras.exe.
b. Enter an account and password that has admin rights (typically this is the same account used to setup the software under “Manage Windows domains”).
c. Click on the Event Viewer folder.
d. Click on the Action menu.
e. Select Connect to remote computer from the drop down list.
f. Type in the IP of the server.
g. Click OK. If it connects, try and open each of the logs. If you can view log information this account has the proper access rights.
If the software is unable to connect to registry with an error due to network path not found
Unable to connect to registry: 53 The network path was not found
This error shows that there is a network transit problem blocking/disrupting the communication between your enVision and your Microsoft Server event source that needs to be checked with your network/systems team.