Microsoft-Windows-RemoteAccess-RemoteAccessServer

114 events across 2 channels

Event	Title	Channel	Sample
10001	TransitionTechnology is Action on the Remote Access server.	Operational	N
10005	Forwarding has been Action on the TransitionTechnology adapter.	Operational	N
10007	The ISATAP router has been configured.	Operational	N
10008	The ISATAP router configuration settings have been cleared.	Operational	N
10009	IP-HTTPS has been enabled on the Remote Access server.	Operational	N
10010	IP-HTTPS has been disabled on the Remote Access server.	Operational	N
10011	NAT64 has been enabled on the Remote Access server.	Operational	N
10012	NAT64 has been disabled on the Remote Access server.	Operational	N
10013	An IIS binding has been created on the Remote Access server.	Operational	N
10014	An IIS binding has been removed from the Remote Access server.	Operational	N
10015	An IIS filter has been created on the Remote Access server for the prefix …	Operational	N
10016	NLB is Action on the Remote Access server.	Operational	N
10017	NLB is Action on the Remote Access server.	Operational	N
10018	Configuration completed successfully.	Operational	N
10019	6to4 cannot be enabled on the Remote Access server	Admin	N
10019	Event ID 10019	Operational	N
10020	6to4 cannot be disabled on the Remote Access server	Admin	N
10020	Event ID 10020	Operational	N
10021	Forwarding cannot be enabled on the 6to4 adapter.	Admin	N
10021	Event ID 10021	Operational	N
10022	Forwarding cannot be disabled on the 6to4 adapter.	Admin	N
10022	Event ID 10022	Operational	N
10023	Teredo cannot be enabled on the Remote Access server.	Admin	N
10023	Event ID 10023	Operational	N
10024	Teredo cannot be disabled on the Remote Access server.	Admin	N
10024	Event ID 10024	Operational	N
10025	Forwarding cannot be enabled on the Teredo adapter.	Admin	N
10025	Event ID 10025	Operational	N
10026	Forwarding cannot be disabled on the Teredo adapter.	Admin	N
10026	Event ID 10026	Operational	N
10027	The ISATAP router cannot be configured as expected.	Admin	N
10027	Event ID 10027	Operational	N
10028	Configuration settings cannot be cleared as expected for the ISATAP router.	Admin	N
10028	Event ID 10028	Operational	N
10029	IP-HTTPS cannot be enabled on the Remote Access server.	Admin	N
10029	Event ID 10029	Operational	N
10030	IP-HTTPS cannot be disabled on the Remote Access server.	Admin	N
10030	Event ID 10030	Operational	N
10031	NAT64 cannot be enabled on the Remote Access server.	Admin	N
10031	Event ID 10031	Operational	N
10032	NAT64 cannot be disabled on the Remote Access server.	Admin	N
10032	Event ID 10032	Operational	N
10033	An IIS binding cannot be created on the Remote Access server.	Admin	N
10033	Event ID 10033	Operational	N
10034	An IIS binding cannot be removed from the Remote Access server.	Admin	N
10034	Event ID 10034	Operational	N
10035	An IIS filter cannot be created on the Remote Access server.	Admin	N
10035	Event ID 10035	Operational	N
10036	NLB cannot be enabled on the Remote Access server.	Admin	N
10036	Event ID 10036	Operational	N
10037	NLB cannot be disabled on the Remote Access server.	Admin	N
10037	Event ID 10037	Operational	N
10038	MonitorName monitor has gone from FromStateName state to ToStateName state on …	Admin	N
10038	Event ID 10038	Operational	N
10039	MonitorName monitor has gone from FromStateName state to ToStateName state on …	Admin	N
10039	Event ID 10039	Operational	N
10040	MonitorName monitor has gone from FromStateName state to ToStateName state on …	Admin	N
10040	Event ID 10040	Operational	N
10041	The OTP credentials of user OTPUserName were verified by RADIUS server …	Operational	N
10042	The OTP credentials of user OTPUserName were not verified by RADIUS server …	Admin	N
10042	Event ID 10042	Operational	N
10044	The user name (CertificateEnrollmentRequestUserName) in the certificate …	Admin	N
10044	Event ID 10044	Operational	N
10045	The CA template from which user OTPUserName requested a certificate is not …	Admin	N
10045	Event ID 10045	Operational	N
10046	The DaOTPAuth ISAPI extension started on the Remote Access server.	Operational	N
10047	The DaOTPAuth ISAPI extension stopped on the Remote Access server.	Operational	N
10049	ServerType server CurrentActiveServerName is unavailable and cannot currently be …	Admin	N
10049	Event ID 10049	Operational	N
10050	OTP authentication will be enabled on the Remote Access server.	Operational	N
10051	failedComponent cannot be configured.	Admin	N
10051	Event ID 10051	Operational	N
10052	ServerType servers were sorted in the following order: SortedServersNames.	Operational	N
10053	DirectAccess OTP settings cannot be applied because the WebDAV IIS extension is …	Admin	N
10053	Event ID 10053	Operational	N
10054	The user name (OTPUserName) specified for OTP authentication does not exist.	Admin	N
10054	Event ID 10054	Operational	N
10055	The OTP certificate enrollment request is invalid.	Admin	N
10055	Event ID 10055	Operational	N
10056	An OTP signing certificate cannot be found.	Admin	N
10056	Event ID 10056	Operational	N
10057	An OTP signing certificate cannot be enrolled using certificate template …	Admin	N
10057	Event ID 10057	Operational	N
10058	Read permissions for the Network Service cannot be configured for the OTP …	Admin	N
10058	Event ID 10058	Operational	N
10059	OTP authentication is enabled on the Remote Access server.	Operational	N
10060	NLB was started on the Remote Access server after the task completed …	Operational	N
10061	NLB was stopped on the Remote Access server because a task did not complete …	Operational	N
10062	Failure encountered during configuration.	Admin	N
10062	Event ID 10062	Operational	N
10063	OTP client authentication cannot complete.	Admin	N
10063	Event ID 10063	Operational	N
10064	An error occurred when configuring Remote Access settings in the Windows …	Admin	N
10064	Event ID 10064	Operational	N
10065	Remote Access static address pool configuration settings stored in the Windows …	Operational	N
10066	Remote Access configuration settings stored in the Windows DirectAccess NLB …	Operational	N
10067	The Windows DirectAccess NLB helper driver was loaded	Operational	N
10068	The Windows DirectAccess NLB helper driver was unloaded	Operational	N
10069	OTP authentication settings cannot be applied.	Admin	N
10069	Event ID 10069	Operational	N
10073	OTP authentication will be disabled on the Remote Access server.	Operational	N
10074	OTP authentication is disabled on the Remote Access server, and CGI and ISAPI …	Operational	N
10075	OTP authentication cannot be enabled.	Admin	N
10075	Event ID 10075	Operational	N
10076	OTP authentication cannot be disabled.	Admin	N
10076	Event ID 10076	Operational	N
10077	OTP authentication cannot be enabled.	Admin	N
10077	Event ID 10077	Operational	N
10078	OTP authentication cannot be disabled.	Admin	N
10078	Event ID 10078	Operational	N
10079	OTP authentication cannot be enabled on the Remote Access server.	Admin	N
10079	Event ID 10079	Operational	N
10080	OTP authentication cannot be disabled on the Remote Access server.	Admin	N
10080	Event ID 10080	Operational	N

Event ID 10001: TransitionTechnology is Action on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

TransitionTechnology is Action on the Remote Access server.

Message #

%1 is %2 on the Remote Access server.

Fields #

Name	Description
`TransitionTechnology` UInt32
`Action` UInt32

Event ID 10005: Forwarding has been Action on the TransitionTechnology adapter.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

Forwarding has been Action on the TransitionTechnology adapter.

Message #

Forwarding has been %2 on the %1 adapter.

Fields #

Name	Description
`TransitionTechnology` UInt32
`Action` UInt32

Event ID 10007: The ISATAP router has been configured.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

The ISATAP router has been configured. Router name: ISATAPRouterName. ISATAP prefix: ISATAPPrefix.

Message #

The ISATAP router has been configured. Router name: %1. ISATAP prefix: %2.

Fields #

Name	Description
`ISATAPRouterName` UnicodeString
`ISATAPPrefix` UnicodeString

Event ID 10008: The ISATAP router configuration settings have been cleared.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

The ISATAP router configuration settings have been cleared.

Message #

The ISATAP router configuration settings have been cleared.

Event ID 10009: IP-HTTPS has been enabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

IP-HTTPS has been enabled on the Remote Access server. IP-HTTPS prefix: IPHTTPSprefix.

Message #

IP-HTTPS has been enabled on the Remote Access server. IP-HTTPS prefix: %1.

Fields #

Name	Description
`IPHTTPSprefix` UnicodeString

Event ID 10010: IP-HTTPS has been disabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

IP-HTTPS has been disabled on the Remote Access server.

Message #

IP-HTTPS has been disabled on the Remote Access server.

Event ID 10011: NAT64 has been enabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

NAT64 has been enabled on the Remote Access server. NAT64 prefix: NAT64Prefix.

Message #

NAT64 has been enabled on the Remote Access server. NAT64 prefix: %1.

Fields #

Name	Description
`NAT64Prefix` UnicodeString

Event ID 10012: NAT64 has been disabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

NAT64 has been disabled on the Remote Access server.

Message #

NAT64 has been disabled on the Remote Access server.

Event ID 10013: An IIS binding has been created on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

An IIS binding has been created on the Remote Access server. Address: Address. Certificate hash: Certhash.

Message #

An IIS binding has been created on the Remote Access server. Address: %1. Certificate hash: %2.

Fields #

Name	Description
`Address` UnicodeString
`Certhash` UnicodeString

Event ID 10014: An IIS binding has been removed from the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

An IIS binding has been removed from the Remote Access server. Address: Address. Certificate hash: Certhash.

Message #

An IIS binding has been removed from the Remote Access server.  Address: %1. Certificate hash: %2.

Fields #

Name	Description
`Address` UnicodeString
`Certhash` UnicodeString

Event ID 10015: An IIS filter has been created on the Remote Access server for the prefix IISFilterPrefix.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

An IIS filter has been created on the Remote Access server for the prefix IISFilterPrefix.

Message #

An IIS filter has been created on the Remote Access server for the prefix %1.

Fields #

Name	Description
`IISFilterPrefix` UnicodeString
`Allowed` Boolean

Event ID 10016: NLB is Action on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

NLB is Action on the Remote Access server.

Message #

NLB is %1 on the Remote Access server.

Fields #

Name	Description
`Action` UInt32
`NLBType` UInt32
`InternalVIPs` UnicodeString
`InternalDIPs` UnicodeString
`InternetVIPs` UnicodeString
`InternetDIPs` UnicodeString

Event ID 10017: NLB is Action on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

NLB is Action on the Remote Access server.

Message #

NLB is %1 on the Remote Access server.

Fields #

Name	Description
`Action` UInt32
`NLBType` UInt32
`InternalVIPs` UnicodeString
`InternalDIPs` UnicodeString
`InternetVIPs` UnicodeString
`InternetDIPs` UnicodeString

Event ID 10018: Configuration completed successfully.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

Configuration completed successfully.

Message #

Configuration completed successfully.

Event ID 10019: 6to4 cannot be enabled on the Remote Access server

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

6to4 cannot be enabled on the Remote Access server.

Message #

6to4 cannot be enabled on the Remote Access server

Event ID 10019

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

6to4 cannot be enabled on the Remote Access server.

Event ID 10020: 6to4 cannot be disabled on the Remote Access server

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

6to4 cannot be disabled on the Remote Access server.

Message #

6to4 cannot be disabled on the Remote Access server

Event ID 10020

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

6to4 cannot be disabled on the Remote Access server.

Event ID 10021: Forwarding cannot be enabled on the 6to4 adapter.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

Forwarding cannot be enabled on the 6to4 adapter.

Message #

Forwarding cannot be enabled on the 6to4 adapter.

Event ID 10021

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

Forwarding cannot be enabled on the 6to4 adapter.

Event ID 10022: Forwarding cannot be disabled on the 6to4 adapter.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

Forwarding cannot be disabled on the 6to4 adapter.

Message #

Forwarding cannot be disabled on the 6to4 adapter.

Event ID 10022

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

Forwarding cannot be disabled on the 6to4 adapter.

Event ID 10023: Teredo cannot be enabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

Teredo cannot be enabled on the Remote Access server.

Message #

Teredo cannot be enabled on the Remote Access server.

Event ID 10023

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

Teredo cannot be enabled on the Remote Access server.

Event ID 10024: Teredo cannot be disabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

Teredo cannot be disabled on the Remote Access server.

Message #

Teredo cannot be disabled on the Remote Access server.

Event ID 10024

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

Teredo cannot be disabled on the Remote Access server.

Event ID 10025: Forwarding cannot be enabled on the Teredo adapter.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

Forwarding cannot be enabled on the Teredo adapter.

Message #

Forwarding cannot be enabled on the Teredo adapter.

Event ID 10025

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

Forwarding cannot be enabled on the Teredo adapter.

Event ID 10026: Forwarding cannot be disabled on the Teredo adapter.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

Forwarding cannot be disabled on the Teredo adapter.

Message #

Forwarding cannot be disabled on the Teredo adapter.

Event ID 10026

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

Forwarding cannot be disabled on the Teredo adapter.

Event ID 10027: The ISATAP router cannot be configured as expected.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

The ISATAP router cannot be configured as expected.

Message #

The ISATAP router cannot be configured as expected.

Event ID 10027

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

The ISATAP router cannot be configured as expected.

Event ID 10028: Configuration settings cannot be cleared as expected for the ISATAP router.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

Configuration settings cannot be cleared as expected for the ISATAP router.

Message #

Configuration settings cannot be cleared as expected for the ISATAP router.

Event ID 10028

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

Configuration settings cannot be cleared as expected for the ISATAP router.

Event ID 10029: IP-HTTPS cannot be enabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

IP-HTTPS cannot be enabled on the Remote Access server.

Message #

IP-HTTPS cannot be enabled on the Remote Access server.

Event ID 10029

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

IP-HTTPS cannot be enabled on the Remote Access server.

Event ID 10030: IP-HTTPS cannot be disabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

IP-HTTPS cannot be disabled on the Remote Access server.

Message #

IP-HTTPS cannot be disabled on the Remote Access server.

Event ID 10030

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

IP-HTTPS cannot be disabled on the Remote Access server.

Event ID 10031: NAT64 cannot be enabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

NAT64 cannot be enabled on the Remote Access server.

Message #

NAT64 cannot be enabled on the Remote Access server.

Event ID 10031

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

NAT64 cannot be enabled on the Remote Access server.

Event ID 10032: NAT64 cannot be disabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

NAT64 cannot be disabled on the Remote Access server.

Message #

NAT64 cannot be disabled on the Remote Access server.

Event ID 10032

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

NAT64 cannot be disabled on the Remote Access server.

Event ID 10033: An IIS binding cannot be created on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

An IIS binding cannot be created on the Remote Access server.

Message #

An IIS binding cannot be created on the Remote Access server.

Event ID 10033

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

An IIS binding cannot be created on the Remote Access server.

Event ID 10034: An IIS binding cannot be removed from the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

An IIS binding cannot be removed from the Remote Access server.

Message #

An IIS binding cannot be removed from the Remote Access server.

Event ID 10034

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

An IIS binding cannot be removed from the Remote Access server.

Event ID 10035: An IIS filter cannot be created on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

An IIS filter cannot be created on the Remote Access server.

Message #

An IIS filter cannot be created on the Remote Access server.

Event ID 10035

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

An IIS filter cannot be created on the Remote Access server.

Event ID 10036: NLB cannot be enabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

NLB cannot be enabled on the Remote Access server.

Message #

NLB cannot be enabled on the Remote Access server.

Fields #

Name	Description
`NLBType` UInt32

Event ID 10036

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

NLB cannot be enabled on the Remote Access server.

Fields #

Name	Description
`NLBType` UInt32

Event ID 10037: NLB cannot be disabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

NLB cannot be disabled on the Remote Access server.

Message #

NLB cannot be disabled on the Remote Access server.

Fields #

Name	Description
`NLBType` UInt32

Event ID 10037

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

NLB cannot be disabled on the Remote Access server.

Fields #

Name	Description
`NLBType` UInt32

Event ID 10038: MonitorName monitor has gone from FromStateName state to ToStateName state on DateStr at TimeStr on ServerName.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask_2

Description

MonitorName monitor has gone from FromStateName state to ToStateName state on DateStr at TimeStr on ServerName. The failure heuristic IDs for state change of MonitorName are operationState.

Message #

%2 monitor has gone from %4 state to %6 state on %8 at %9 on %10. The failure heuristic IDs for state change of %2 are %11.

Fields #

Name	Description
`MonitorId` UInt32
`MonitorName` UnicodeString
`FromState` UInt32
`FromStateName` UnicodeString
`ToState` UInt32
`ToStateName` UnicodeString
`TimeStamp` FILETIME
`DateStr` UnicodeString
`TimeStr` UnicodeString
`ServerName` UnicodeString
`operationState` UnicodeString
`HeuristicIdListLen` UInt32
`HeuristicIdList` Binary

Event ID 10038

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask_2

Description

monitor has gone from state to state on at on . The failure heuristic IDs for state change of are .

Fields #

Name	Description
`MonitorId` UInt32
`MonitorName` UnicodeString
`FromState` UInt32
`FromStateName` UnicodeString
`ToState` UInt32
`ToStateName` UnicodeString
`TimeStamp` FILETIME
`DateStr` UnicodeString
`TimeStr` UnicodeString
`ServerName` UnicodeString
`operationState` UnicodeString
`HeuristicIdListLen` UInt32
`HeuristicIdList` Binary

Event ID 10039: MonitorName monitor has gone from FromStateName state to ToStateName state on DateStr at TimeStr on ServerName.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask_2

Description

MonitorName monitor has gone from FromStateName state to ToStateName state on DateStr at TimeStr on ServerName. The failure heuristic IDs for state change of MonitorName are operationState.

Message #

%2 monitor has gone from %4 state to %6 state on %8 at %9 on %10. The failure heuristic IDs for state change of %2 are %11.

Fields #

Name	Description
`MonitorId` UInt32
`MonitorName` UnicodeString
`FromState` UInt32
`FromStateName` UnicodeString
`ToState` UInt32
`ToStateName` UnicodeString
`TimeStamp` FILETIME
`DateStr` UnicodeString
`TimeStr` UnicodeString
`ServerName` UnicodeString
`operationState` UnicodeString
`HeuristicIdListLen` UInt32
`HeuristicIdList` Binary

Event ID 10039

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask_2

Description

monitor has gone from state to state on at on . The failure heuristic IDs for state change of are .

Fields #

Name	Description
`MonitorId` UInt32
`MonitorName` UnicodeString
`FromState` UInt32
`FromStateName` UnicodeString
`ToState` UInt32
`ToStateName` UnicodeString
`TimeStamp` FILETIME
`DateStr` UnicodeString
`TimeStr` UnicodeString
`ServerName` UnicodeString
`operationState` UnicodeString
`HeuristicIdListLen` UInt32
`HeuristicIdList` Binary

Event ID 10040: MonitorName monitor has gone from FromStateName state to ToStateName state on DateStr at TimeStr on ServerName.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask_2

Description

MonitorName monitor has gone from FromStateName state to ToStateName state on DateStr at TimeStr on ServerName.

Message #

%2 monitor has gone from %4 state to %6 state on %8 at %9 on %10.

Fields #

Name	Description
`MonitorId` UInt32
`MonitorName` UnicodeString
`FromState` UInt32
`FromStateName` UnicodeString
`ToState` UInt32
`ToStateName` UnicodeString
`TimeStamp` FILETIME
`DateStr` UnicodeString
`TimeStr` UnicodeString
`ServerName` UnicodeString
`operationState` UnicodeString
`HeuristicIdListLen` UInt32
`HeuristicIdList` Binary

Event ID 10040

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask_2

Description

monitor has gone from state to state on at on .

Fields #

Name	Description
`MonitorId` UInt32
`MonitorName` UnicodeString
`FromState` UInt32
`FromStateName` UnicodeString
`ToState` UInt32
`ToStateName` UnicodeString
`TimeStamp` FILETIME
`DateStr` UnicodeString
`TimeStr` UnicodeString
`ServerName` UnicodeString
`operationState` UnicodeString
`HeuristicIdListLen` UInt32
`HeuristicIdList` Binary

Event ID 10041: The OTP credentials of user OTPUserName were verified by RADIUS server RadiusName.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

The OTP credentials of user OTPUserName were verified by RADIUS server RadiusName. The OTP certificate enrollment request was signed by the Remote Access server.

Message #

The OTP credentials of user %1 were verified by RADIUS server %2. The OTP certificate enrollment request was signed by the Remote Access server.

Fields #

Name	Description
`OTPUserName` UnicodeString
`RadiusName` UnicodeString

Event ID 10042: The OTP credentials of user OTPUserName were not verified by RADIUS server RadiusName.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: DirectAccessOTPAuthentication

Description

The OTP credentials of user OTPUserName were not verified by RADIUS server RadiusName. Error: ErrorReason.

Message #

The OTP credentials of user %1 were not verified by RADIUS server %2. Error: %3.

Fields #

Name	Description
`OTPUserName` UnicodeString
`RadiusName` UnicodeString
`ErrorReason` UnicodeString

Event ID 10042

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

The OTP credentials of user were not verified by RADIUS server . Error: .

Fields #

Name	Description
`OTPUserName` UnicodeString
`RadiusName` UnicodeString
`ErrorReason` UnicodeString

Event ID 10044: The user name (CertificateEnrollmentRequestUserName) in the certificate enrollment request does not match the user name (OTPUserName) specified for OTP authentication.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: DirectAccessOTPAuthentication

Description

The user name (CertificateEnrollmentRequestUserName) in the certificate enrollment request does not match the user name (OTPUserName) specified for OTP authentication.

Message #

The user name (%1) in the certificate enrollment request does not match the user name (%2) specified for OTP authentication.

Fields #

Name	Description
`CertificateEnrollmentRequestUserName` UnicodeString
`OTPUserName` UnicodeString

Event ID 10044

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

The user name () in the certificate enrollment request does not match the user name () specified for OTP authentication.

Fields #

Name	Description
`CertificateEnrollmentRequestUserName` UnicodeString
`OTPUserName` UnicodeString

Event ID 10045: The CA template from which user OTPUserName requested a certificate is not configured to issue OTP certificates.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: DirectAccessOTPAuthentication

Description

The CA template from which user OTPUserName requested a certificate is not configured to issue OTP certificates.

Message #

The CA template from which user %1 requested a certificate is not configured to issue OTP certificates.

Fields #

Name	Description
`OTPUserName` UnicodeString
`TemplateName` UnicodeString

Event ID 10045

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

The CA template from which user requested a certificate is not configured to issue OTP certificates.

Fields #

Name	Description
`OTPUserName` UnicodeString
`TemplateName` UnicodeString

Event ID 10046: The DaOTPAuth ISAPI extension started on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication
Opcode: Start

Description

The DaOTPAuth ISAPI extension started on the Remote Access server. This extension is used for DirectAccess OTP authentication.

Message #

The DaOTPAuth ISAPI extension started on the Remote Access server. This extension is used for DirectAccess OTP authentication.

Event ID 10047: The DaOTPAuth ISAPI extension stopped on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication
Opcode: Stop

Description

The DaOTPAuth ISAPI extension stopped on the Remote Access server. This extension is used for DirectAccess OTP authentication. OTP might not work as expected when the extension is not running.

Message #

The DaOTPAuth ISAPI extension stopped on the Remote Access server. This extension is used for DirectAccess OTP authentication. OTP might not work as expected when the extension is not running.

Event ID 10049: ServerType server CurrentActiveServerName is unavailable and cannot currently be used.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: DirectAccessOTPAuthentication

Description

ServerType server CurrentActiveServerName is unavailable and cannot currently be used. Remote Access will attempt to use ServerType server FailoverServerName for OTP authentication.

Message #

%1 server %2 is unavailable and cannot currently be used. Remote Access will attempt to use %1 server %3 for OTP authentication.

Fields #

Name	Description
`ServerType` UnicodeString
`CurrentActiveServerName` UnicodeString
`FailoverServerName` UnicodeString

Event ID 10049

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

server is unavailable and cannot currently be used. Remote Access will attempt to use server for OTP authentication.

Fields #

Name	Description
`ServerType` UnicodeString
`CurrentActiveServerName` UnicodeString
`FailoverServerName` UnicodeString

Event ID 10050: OTP authentication will be enabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication will be enabled on the Remote Access server. CGI and ISAPI extensions for IIS will be enabled.

Message #

OTP authentication will be enabled on the Remote Access server. CGI and ISAPI extensions for IIS will be enabled.

Event ID 10051: failedComponent cannot be configured.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

failedComponent cannot be configured. The IIS default web site cannot be located on the Remote Access server, and is required for failedComponent deployment. Verify that IIS is installed and enabled.

Message #

%1 cannot be configured. The IIS default web site cannot be located on the Remote Access server, and is required for %1 deployment. Verify that IIS is installed and enabled.

Fields #

Name	Description
`failedComponent` UnicodeString

Event ID 10051

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

cannot be configured. The IIS default web site cannot be located on the Remote Access server, and is required for deployment. Verify that IIS is installed and enabled.

Fields #

Name	Description
`failedComponent` UnicodeString

Event ID 10052: ServerType servers were sorted in the following order: SortedServersNames.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

ServerType servers were sorted in the following order: SortedServersNames.

Message #

%1 servers were sorted in the following order: %2.

Fields #

Name	Description
`ServerType` UnicodeString
`SortedServersNames` UnicodeString

Event ID 10053: DirectAccess OTP settings cannot be applied because the WebDAV IIS extension is running on the server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

DirectAccess OTP settings cannot be applied because the WebDAV IIS extension is running on the server. Remove WebDAV and apply the settings again.

Message #

DirectAccess OTP settings cannot be applied because the WebDAV IIS extension is running on the server. Remove WebDAV and apply the settings again.

Event ID 10053

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

DirectAccess OTP settings cannot be applied because the WebDAV IIS extension is running on the server. Remove WebDAV and apply the settings again.

Event ID 10054: The user name (OTPUserName) specified for OTP authentication does not exist.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: DirectAccessOTPAuthentication

Description

The user name (OTPUserName) specified for OTP authentication does not exist.

Message #

The user name (%1) specified for OTP authentication does not exist.

Fields #

Name	Description
`OTPUserName` UnicodeString

Event ID 10054

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

The user name () specified for OTP authentication does not exist.

Fields #

Name	Description
`OTPUserName` UnicodeString

Event ID 10055: The OTP certificate enrollment request is invalid.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: DirectAccessOTPAuthentication

Description

The OTP certificate enrollment request is invalid. Error: ErrorCode (ErrorMessage).

Message #

The OTP certificate enrollment request is invalid. Error: %1 (%2).

Fields #

Name	Description
`ErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 10055

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

The OTP certificate enrollment request is invalid. Error: ().

Fields #

Name	Description
`ErrorCode` UInt32
`ErrorMessage` UnicodeString

Event ID 10056: An OTP signing certificate cannot be found.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: DirectAccessOTPAuthentication

Description

An OTP signing certificate cannot be found. The OTP certificate enrollment request cannot be signed.

Message #

An OTP signing certificate cannot be found. The OTP certificate enrollment request cannot be signed.

Event ID 10056

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

An OTP signing certificate cannot be found. The OTP certificate enrollment request cannot be signed.

Event ID 10057: An OTP signing certificate cannot be enrolled using certificate template Template.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: DirectAccessOTPAuthentication

Description

An OTP signing certificate cannot be enrolled using certificate template Template.

Message #

An OTP signing certificate cannot be enrolled using certificate template %1.

Fields #

Name	Description
`Template` UnicodeString

Event ID 10057

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

An OTP signing certificate cannot be enrolled using certificate template .

Fields #

Name	Description
`Template` UnicodeString

Event ID 10058: Read permissions for the Network Service cannot be configured for the OTP signing certificate.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: DirectAccessOTPAuthentication

Description

Read permissions for the Network Service cannot be configured for the OTP signing certificate.

Message #

Read permissions for the Network Service cannot be configured for the OTP signing certificate.

Event ID 10058

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

Read permissions for the Network Service cannot be configured for the OTP signing certificate.

Event ID 10059: OTP authentication is enabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication is enabled on the Remote Access server. CGI and ISAPI extensions for IIS have been enabled.

Message #

OTP authentication is enabled on the Remote Access server. CGI and ISAPI extensions for IIS have been enabled.

Event ID 10060: NLB was started on the Remote Access server after the task completed successfully.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

NLB was started on the Remote Access server after the task completed successfully.

Message #

NLB was started on the Remote Access server after the task completed successfully.

Event ID 10061: NLB was stopped on the Remote Access server because a task did not complete successfully.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

NLB was stopped on the Remote Access server because a task did not complete successfully.

Message #

NLB was stopped on the Remote Access server because a task did not complete successfully.

Event ID 10062: Failure encountered during configuration.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

Failure encountered during configuration.

Message #

Failure encountered during configuration.

Event ID 10062

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

Failure encountered during configuration.

Event ID 10063: OTP client authentication cannot complete.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: DirectAccessOTPAuthentication

Description

OTP client authentication cannot complete. A connection to the domain controller in order to retrieve the user name cannot be established.

Message #

OTP client authentication cannot complete. A connection to the domain controller in order to retrieve the user name cannot be established.

Event ID 10063

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: DirectAccessOTPAuthentication

Description

OTP client authentication cannot complete. A connection to the domain controller in order to retrieve the user name cannot be established.

Event ID 10064: An error occurred when configuring Remote Access settings in the Windows DirectAccess NLB helper driver.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

An error occurred when configuring Remote Access settings in the Windows DirectAccess NLB helper driver.

Message #

An error occurred when configuring Remote Access settings in the Windows DirectAccess NLB helper driver.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10064

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

An error occurred when configuring Remote Access settings in the Windows DirectAccess NLB helper driver.

Fields #

Name	Description
`ErrorCode` UInt32

Event ID 10065: Remote Access static address pool configuration settings stored in the Windows DirectAccess NLB helper driver have been modified.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessNLBhelperdriverconfigurationtask

Description

Remote Access static address pool configuration settings stored in the Windows DirectAccess NLB helper driver have been modified.

Message #

Remote Access static address pool configuration settings stored in the Windows DirectAccess NLB helper driver have been modified.

Fields #

Name	Description
`Action` UInt32
`Owner` UInt32
`StartIPAddress` UnicodeString
`EndIPAddress` UnicodeString

Event ID 10066: Remote Access configuration settings stored in the Windows DirectAccess NLB helper driver have been modified.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessNLBhelperdriverconfigurationtask

Description

Remote Access configuration settings stored in the Windows DirectAccess NLB helper driver have been modified.

Message #

Remote Access configuration settings stored in the Windows DirectAccess NLB helper driver have been modified.

Fields #

Name	Description
`IPHttpsPrefix` UnicodeString
`RasIPv6prefix` UnicodeString
`InternalinterfaceGUID` UnicodeString

Event ID 10067: The Windows DirectAccess NLB helper driver was loaded

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessNLBhelperdriverconfigurationtask

Description

The Windows DirectAccess NLB helper driver was loaded.

Message #

The Windows DirectAccess NLB helper driver was loaded

Event ID 10068: The Windows DirectAccess NLB helper driver was unloaded

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessNLBhelperdriverconfigurationtask

Description

The Windows DirectAccess NLB helper driver was unloaded.

Message #

The Windows DirectAccess NLB helper driver was unloaded

Event ID 10069: OTP authentication settings cannot be applied.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication settings cannot be applied. There is a problem with the IP-HTTPS settings or the IP-HTTPS certificate.

Message #

OTP authentication settings cannot be applied. There is a problem with the IP-HTTPS settings or the IP-HTTPS certificate.

Event ID 10069

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication settings cannot be applied. There is a problem with the IP-HTTPS settings or the IP-HTTPS certificate.

Event ID 10073: OTP authentication will be disabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication will be disabled on the Remote Access server. CGI and ISAPI extensions for IIS will be disabled.

Message #

OTP authentication will be disabled on the Remote Access server. CGI and ISAPI extensions for IIS will be disabled.

Event ID 10074: OTP authentication is disabled on the Remote Access server, and CGI and ISAPI extensions for IIS have been disabled.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Message #

OTP authentication is disabled on the Remote Access server, and CGI and ISAPI extensions for IIS have been disabled. In addition, other Windows features might have been disabled. For more details see Event 10 in the Setup section of the Windows Logs in the Event Viewer.

Event ID 10075: OTP authentication cannot be enabled.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be enabled. SSL settings cannot be applied on the OTP site in IIS.

Message #

OTP authentication cannot be enabled. SSL settings cannot be applied on the OTP site in IIS.

Event ID 10075

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be enabled. SSL settings cannot be applied on the OTP site in IIS.

Event ID 10076: OTP authentication cannot be disabled.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be disabled. SSL settings cannot be applied on the OTP site in IIS.

Message #

OTP authentication cannot be disabled. SSL settings cannot be applied on the OTP site in IIS.

Event ID 10076

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be disabled. SSL settings cannot be applied on the OTP site in IIS.

Event ID 10077: OTP authentication cannot be enabled.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be enabled. An IIS web site required for OTP cannot be created.

Message #

OTP authentication cannot be enabled. An IIS web site required for OTP cannot be created

Event ID 10077

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be enabled. An IIS web site required for OTP cannot be created.

Event ID 10078: OTP authentication cannot be disabled.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be disabled. An IIS web site required for OTP cannot be deleted.

Message #

OTP authentication cannot be disabled. An IIS web site required for OTP cannot be deleted

Event ID 10078

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be disabled. An IIS web site required for OTP cannot be deleted.

Event ID 10079: OTP authentication cannot be enabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be enabled on the Remote Access server.

Message #

OTP authentication cannot be enabled on the Remote Access server.

Event ID 10079

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be enabled on the Remote Access server.

Event ID 10080: OTP authentication cannot be disabled on the Remote Access server.

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Admin
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be disabled on the Remote Access server.

Message #

OTP authentication cannot be disabled on the Remote Access server.

Event ID 10080

Provider: Microsoft-Windows-RemoteAccess-RemoteAccessServer
Channel: Operational
Task: RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be disabled on the Remote Access server.

Provenance

Where this provider's schema came from, and which Windows build it was observed on. Windows can change a provider's event schema between builds, so use this to judge whether it matches the build you collect from.

ETW provider GUID 214609e4-72cc-4e0e-95f8-1d503fc4ad7f

Defined in ramgmtsvc.dll, which carries the event manifest.

Observed on:

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02

Downloads

Microsoft-Windows-RemoteAccess-RemoteAccessServer registered manifest XML (in the WS2022-20348.4893 manifest pack, 1.9 MB) manifest-xml

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)