Hi Guys,
I am facing error while integrating windows devices.
Error is as follows:
Unable to subscribe for events with Windows event source: 401/Unauthorized. Please verify the credentials provided
I am using Basic authentication for log collection. Please suggest some troubleshooting step to resolve this issue.
Hi David,
I have enabled debug logs.
Starting work
Starting subscribe
Connecting to 172.X.X.X on port 5985 url /wsman transport mode http user siemmon auth method Basic
Connect succeeded
Subscription Query List : <QueryList><Query Id='0'><Select Path='Application'>*</Select><Select Path='Security'>*</Select><Select Path='System'>*</Select></Query></QueryList>
Subscribe Message
Error subscribing. Response code = 401/Unknown
Unable to subscribe for events with Windows event source: 401/Unauthorized. Please verify the credentials provided
As per my understanding, If connection is succeeded then credentials are working. Please correct me if I am wrong.
HI Yasmine Dowidar,
I have enabled debug logs.
Starting work
Starting subscribe
Connecting to 172.X.X.X on port 5985 url /wsman transport mode http user siemmon auth method Basic
Connect succeeded
Subscription Query List : <QueryList><Query Id='0'><Select Path='Application'>*</Select><Select Path='Security'>*</Select><Select Path='System'>*</Select></Query></QueryList>
Subscribe Message
Error subscribing. Response code = 401/Unknown
Unable to subscribe for events with Windows event source: 401/Unauthorized. Please verify the credentials provided
As per my understanding, If connection is succeeded then credentials are working. Please correct me if I am wrong.
Hi Atul,
Adding to David's recommendation.
If this is new integration, Please try below.
1. Verify basic authentication is true or false using winrm e winrm/config/listener command in Windows server
2. If above is false, Please enable basic authentication using winrm set winrm/config/service/auth @{Basic="true"}
Thanks,
Sravan
I've seen this behavior before in our environment even when not running Basic auth, i.e. Kerberos or Negotiate.
I'd check a few things first.
Is your time/clock synced with NTP and accurate between the host and your collector?
Is DNS resolution functioning/resolving accurately for the system on the collector?
Other than that, 401 means it authenticated just fine, but your request isn't authorized on the host. Usually a bad SDDL setting for your service account on the host.
After verifying the winrm settings post them here minus the SDDL and/or any other sensitive data and maybe we'll see what is up.
It's more normal to use kerberos / negotiate authentication when collecting form windows sources, especially if they are in a domain. If it was working and nothing has changed, have you checked the the password that you are using is correct?