detection.wiki

Microsoft-Windows-RemoteAccess-RemoteAccessServer

EventTitleChannelSampleRule
10001TransitionTechnology is Action on the Remote Access server.OperationalNN
10005Forwarding has been Action on the TransitionTechnology adapter.OperationalNN
10007The ISATAP router has been configured.OperationalNN
10008The ISATAP router configuration settings have been cleared.OperationalNN
10009IP-HTTPS has been enabled on the Remote Access server.OperationalNN
10010IP-HTTPS has been disabled on the Remote Access server.OperationalNN
10011NAT64 has been enabled on the Remote Access server.OperationalNN
10012NAT64 has been disabled on the Remote Access server.OperationalNN
10013An IIS binding has been created on the Remote Access server.OperationalNN
10014An IIS binding has been removed from the Remote Access server.OperationalNN
10015An IIS filter has been created on the Remote Access server for the prefix …OperationalNN
10016NLB is Action on the Remote Access server.OperationalNN
10017NLB is Action on the Remote Access server.OperationalNN
10018Configuration completed successfully.OperationalNN
100196to4 cannot be enabled on the Remote Access serverAdminNN
10019Event ID 10019OperationalNN
100206to4 cannot be disabled on the Remote Access serverAdminNN
10020Event ID 10020OperationalNN
10021Forwarding cannot be enabled on the 6to4 adapter.AdminNN
10021Event ID 10021OperationalNN
10022Forwarding cannot be disabled on the 6to4 adapter.AdminNN
10022Event ID 10022OperationalNN
10023Teredo cannot be enabled on the Remote Access server.AdminNN
10023Event ID 10023OperationalNN
10024Teredo cannot be disabled on the Remote Access server.AdminNN
10024Event ID 10024OperationalNN
10025Forwarding cannot be enabled on the Teredo adapter.AdminNN
10025Event ID 10025OperationalNN
10026Forwarding cannot be disabled on the Teredo adapter.AdminNN
10026Event ID 10026OperationalNN
10027The ISATAP router cannot be configured as expected.AdminNN
10027Event ID 10027OperationalNN
10028Configuration settings cannot be cleared as expected for the ISATAP router.AdminNN
10028Event ID 10028OperationalNN
10029IP-HTTPS cannot be enabled on the Remote Access server.AdminNN
10029Event ID 10029OperationalNN
10030IP-HTTPS cannot be disabled on the Remote Access server.AdminNN
10030Event ID 10030OperationalNN
10031NAT64 cannot be enabled on the Remote Access server.AdminNN
10031Event ID 10031OperationalNN
10032NAT64 cannot be disabled on the Remote Access server.AdminNN
10032Event ID 10032OperationalNN
10033An IIS binding cannot be created on the Remote Access server.AdminNN
10033Event ID 10033OperationalNN
10034An IIS binding cannot be removed from the Remote Access server.AdminNN
10034Event ID 10034OperationalNN
10035An IIS filter cannot be created on the Remote Access server.AdminNN
10035Event ID 10035OperationalNN
10036NLB cannot be enabled on the Remote Access server.AdminNN
10036Event ID 10036OperationalNN
10037NLB cannot be disabled on the Remote Access server.AdminNN
10037Event ID 10037OperationalNN
10038MonitorName monitor has gone from FromStateName state to ToStateName state on …AdminNN
10038Event ID 10038OperationalNN
10039MonitorName monitor has gone from FromStateName state to ToStateName state on …AdminNN
10039Event ID 10039OperationalNN
10040MonitorName monitor has gone from FromStateName state to ToStateName state on …AdminNN
10040Event ID 10040OperationalNN
10041The OTP credentials of user OTPUserName were verified by RADIUS server …OperationalNN
10042The OTP credentials of user OTPUserName were not verified by RADIUS server …AdminNN
10042Event ID 10042OperationalNN
10044The user name (CertificateEnrollmentRequestUserName) in the certificate …AdminNN
10044Event ID 10044OperationalNN
10045The CA template from which user OTPUserName requested a certificate is not …AdminNN
10045Event ID 10045OperationalNN
10046The DaOTPAuth ISAPI extension started on the Remote Access server.OperationalNN
10047The DaOTPAuth ISAPI extension stopped on the Remote Access server.OperationalNN
10049ServerType server CurrentActiveServerName is unavailable and cannot currently be …AdminNN
10049Event ID 10049OperationalNN
10050OTP authentication will be enabled on the Remote Access server.OperationalNN
10051failedComponent cannot be configured.AdminNN
10051Event ID 10051OperationalNN
10052ServerType servers were sorted in the following order: SortedServersNames.OperationalNN
10053DirectAccess OTP settings cannot be applied because the WebDAV IIS extension is …AdminNN
10053Event ID 10053OperationalNN
10054The user name (OTPUserName) specified for OTP authentication does not exist.AdminNN
10054Event ID 10054OperationalNN
10055The OTP certificate enrollment request is invalid.AdminNN
10055Event ID 10055OperationalNN
10056An OTP signing certificate cannot be found.AdminNN
10056Event ID 10056OperationalNN
10057An OTP signing certificate cannot be enrolled using certificate template …AdminNN
10057Event ID 10057OperationalNN
10058Read permissions for the Network Service cannot be configured for the OTP …AdminNN
10058Event ID 10058OperationalNN
10059OTP authentication is enabled on the Remote Access server.OperationalNN
10060NLB was started on the Remote Access server after the task completed …OperationalNN
10061NLB was stopped on the Remote Access server because a task did not complete …OperationalNN
10062Failure encountered during configuration.AdminNN
10062Event ID 10062OperationalNN
10063OTP client authentication cannot complete.AdminNN
10063Event ID 10063OperationalNN
10064An error occurred when configuring Remote Access settings in the Windows …AdminNN
10064Event ID 10064OperationalNN
10065Remote Access static address pool configuration settings stored in the Windows …OperationalNN
10066Remote Access configuration settings stored in the Windows DirectAccess NLB …OperationalNN
10067The Windows DirectAccess NLB helper driver was loadedOperationalNN
10068The Windows DirectAccess NLB helper driver was unloadedOperationalNN
10069OTP authentication settings cannot be applied.AdminNN
10069Event ID 10069OperationalNN
10073OTP authentication will be disabled on the Remote Access server.OperationalNN
10074OTP authentication is disabled on the Remote Access server, and CGI and ISAPI …OperationalNN
10075OTP authentication cannot be enabled.AdminNN
10075Event ID 10075OperationalNN
10076OTP authentication cannot be disabled.AdminNN
10076Event ID 10076OperationalNN
10077OTP authentication cannot be enabled.AdminNN
10077Event ID 10077OperationalNN
10078OTP authentication cannot be disabled.AdminNN
10078Event ID 10078OperationalNN
10079OTP authentication cannot be enabled on the Remote Access server.AdminNN
10079Event ID 10079OperationalNN
10080OTP authentication cannot be disabled on the Remote Access server.AdminNN
10080Event ID 10080OperationalNN

Event ID 10001: TransitionTechnology is Action on the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Message #

%1 is %2 on the Remote Access server.

Fields #

NameDescription
TransitionTechnology UInt32
Action UInt32

Event ID 10005: Forwarding has been Action on the TransitionTechnology adapter.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Message #

Forwarding has been %2 on the %1 adapter.

Fields #

NameDescription
TransitionTechnology UInt32
Action UInt32

Event ID 10007: The ISATAP router has been configured.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

The ISATAP router has been configured. Router name: ISATAPRouterName. ISATAP prefix: ISATAPPrefix.

Message #

The ISATAP router has been configured. Router name: %1. ISATAP prefix: %2.

Fields #

NameDescription
ISATAPRouterName UnicodeString
ISATAPPrefix UnicodeString

Event ID 10008: The ISATAP router configuration settings have been cleared.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Event ID 10009: IP-HTTPS has been enabled on the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

IP-HTTPS has been enabled on the Remote Access server. IP-HTTPS prefix: IPHTTPSprefix.

Message #

IP-HTTPS has been enabled on the Remote Access server. IP-HTTPS prefix: %1.

Fields #

NameDescription
IPHTTPSprefix UnicodeString

Event ID 10010: IP-HTTPS has been disabled on the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Event ID 10011: NAT64 has been enabled on the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

NAT64 has been enabled on the Remote Access server. NAT64 prefix: NAT64Prefix.

Message #

NAT64 has been enabled on the Remote Access server. NAT64 prefix: %1.

Fields #

NameDescription
NAT64Prefix UnicodeString

Event ID 10012: NAT64 has been disabled on the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Event ID 10013: An IIS binding has been created on the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

An IIS binding has been created on the Remote Access server. Address: Address. Certificate hash: Certhash.

Message #

An IIS binding has been created on the Remote Access server. Address: %1. Certificate hash: %2.

Fields #

NameDescription
Address UnicodeString
Certhash UnicodeString

Event ID 10014: An IIS binding has been removed from the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

An IIS binding has been removed from the Remote Access server. Address: Address. Certificate hash: Certhash.

Message #

An IIS binding has been removed from the Remote Access server.  Address: %1. Certificate hash: %2.

Fields #

NameDescription
Address UnicodeString
Certhash UnicodeString

Event ID 10015: An IIS filter has been created on the Remote Access server for the prefix IISFilterPrefix.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Message #

An IIS filter has been created on the Remote Access server for the prefix %1.

Fields #

NameDescription
IISFilterPrefix UnicodeString
Allowed Boolean

Event ID 10016: NLB is Action on the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Message #

NLB is %1 on the Remote Access server.

Fields #

NameDescription
Action UInt32
NLBType UInt32
InternalVIPs UnicodeString
InternalDIPs UnicodeString
InternetVIPs UnicodeString
InternetDIPs UnicodeString

Event ID 10017: NLB is Action on the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Message #

NLB is %1 on the Remote Access server.

Fields #

NameDescription
Action UInt32
NLBType UInt32
InternalVIPs UnicodeString
InternalDIPs UnicodeString
InternetVIPs UnicodeString
InternetDIPs UnicodeString

Event ID 10018: Configuration completed successfully.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Event ID 10019: 6to4 cannot be enabled on the Remote Access server

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10019

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

6to4 cannot be enabled on the Remote Access server.

Event ID 10020: 6to4 cannot be disabled on the Remote Access server

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10020

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

6to4 cannot be disabled on the Remote Access server.

Event ID 10021: Forwarding cannot be enabled on the 6to4 adapter.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10021

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

Forwarding cannot be enabled on the 6to4 adapter.

Event ID 10022: Forwarding cannot be disabled on the 6to4 adapter.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10022

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

Forwarding cannot be disabled on the 6to4 adapter.

Event ID 10023: Teredo cannot be enabled on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10023

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

Teredo cannot be enabled on the Remote Access server.

Event ID 10024: Teredo cannot be disabled on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10024

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

Teredo cannot be disabled on the Remote Access server.

Event ID 10025: Forwarding cannot be enabled on the Teredo adapter.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10025

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

Forwarding cannot be enabled on the Teredo adapter.

Event ID 10026: Forwarding cannot be disabled on the Teredo adapter.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10026

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

Forwarding cannot be disabled on the Teredo adapter.

Event ID 10027: The ISATAP router cannot be configured as expected.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10027

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

The ISATAP router cannot be configured as expected.

Event ID 10028: Configuration settings cannot be cleared as expected for the ISATAP router.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10028

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

Configuration settings cannot be cleared as expected for the ISATAP router.

Event ID 10029: IP-HTTPS cannot be enabled on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10029

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

IP-HTTPS cannot be enabled on the Remote Access server.

Event ID 10030: IP-HTTPS cannot be disabled on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10030

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

IP-HTTPS cannot be disabled on the Remote Access server.

Event ID 10031: NAT64 cannot be enabled on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10031

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

NAT64 cannot be enabled on the Remote Access server.

Event ID 10032: NAT64 cannot be disabled on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10032

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

NAT64 cannot be disabled on the Remote Access server.

Event ID 10033: An IIS binding cannot be created on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10033

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

An IIS binding cannot be created on the Remote Access server.

Event ID 10034: An IIS binding cannot be removed from the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10034

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

An IIS binding cannot be removed from the Remote Access server.

Event ID 10035: An IIS filter cannot be created on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10035

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

An IIS filter cannot be created on the Remote Access server.

Event ID 10036: NLB cannot be enabled on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Fields #

NameDescription
NLBType UInt32

Event ID 10036

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

NLB cannot be enabled on the Remote Access server.

Fields #

NameDescription
NLBType UInt32

Event ID 10037: NLB cannot be disabled on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Fields #

NameDescription
NLBType UInt32

Event ID 10037

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

NLB cannot be disabled on the Remote Access server.

Fields #

NameDescription
NLBType UInt32

Event ID 10038: MonitorName monitor has gone from FromStateName state to ToStateName state on DateStr at TimeStr on ServerName.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask_2

Description

MonitorName monitor has gone from FromStateName state to ToStateName state on DateStr at TimeStr on ServerName. The failure heuristic IDs for state change of MonitorName are operationState.

Message #

%2 monitor has gone from %4 state to %6 state on %8 at %9 on %10. The failure heuristic IDs for state change of %2 are %11.

Fields #

NameDescription
MonitorId UInt32
MonitorName UnicodeString
FromState UInt32
FromStateName UnicodeString
ToState UInt32
ToStateName UnicodeString
TimeStamp FILETIME
DateStr UnicodeString
TimeStr UnicodeString
ServerName UnicodeString
operationState UnicodeString
HeuristicIdListLen UInt32
HeuristicIdList Binary

Event ID 10038

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask_2

Description

monitor has gone from state to state on at on . The failure heuristic IDs for state change of are .

Fields #

NameDescription
MonitorId UInt32
MonitorName UnicodeString
FromState UInt32
FromStateName UnicodeString
ToState UInt32
ToStateName UnicodeString
TimeStamp FILETIME
DateStr UnicodeString
TimeStr UnicodeString
ServerName UnicodeString
operationState UnicodeString
HeuristicIdListLen UInt32
HeuristicIdList Binary

Event ID 10039: MonitorName monitor has gone from FromStateName state to ToStateName state on DateStr at TimeStr on ServerName.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask_2

Description

MonitorName monitor has gone from FromStateName state to ToStateName state on DateStr at TimeStr on ServerName. The failure heuristic IDs for state change of MonitorName are operationState.

Message #

%2 monitor has gone from %4 state to %6 state on %8 at %9 on %10. The failure heuristic IDs for state change of %2 are %11.

Fields #

NameDescription
MonitorId UInt32
MonitorName UnicodeString
FromState UInt32
FromStateName UnicodeString
ToState UInt32
ToStateName UnicodeString
TimeStamp FILETIME
DateStr UnicodeString
TimeStr UnicodeString
ServerName UnicodeString
operationState UnicodeString
HeuristicIdListLen UInt32
HeuristicIdList Binary

Event ID 10039

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask_2

Description

monitor has gone from state to state on at on . The failure heuristic IDs for state change of are .

Fields #

NameDescription
MonitorId UInt32
MonitorName UnicodeString
FromState UInt32
FromStateName UnicodeString
ToState UInt32
ToStateName UnicodeString
TimeStamp FILETIME
DateStr UnicodeString
TimeStr UnicodeString
ServerName UnicodeString
operationState UnicodeString
HeuristicIdListLen UInt32
HeuristicIdList Binary

Event ID 10040: MonitorName monitor has gone from FromStateName state to ToStateName state on DateStr at TimeStr on ServerName.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask_2

Message #

%2 monitor has gone from %4 state to %6 state on %8 at %9 on %10.

Fields #

NameDescription
MonitorId UInt32
MonitorName UnicodeString
FromState UInt32
FromStateName UnicodeString
ToState UInt32
ToStateName UnicodeString
TimeStamp FILETIME
DateStr UnicodeString
TimeStr UnicodeString
ServerName UnicodeString
operationState UnicodeString
HeuristicIdListLen UInt32
HeuristicIdList Binary

Event ID 10040

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask_2

Description

monitor has gone from state to state on at on .

Fields #

NameDescription
MonitorId UInt32
MonitorName UnicodeString
FromState UInt32
FromStateName UnicodeString
ToState UInt32
ToStateName UnicodeString
TimeStamp FILETIME
DateStr UnicodeString
TimeStr UnicodeString
ServerName UnicodeString
operationState UnicodeString
HeuristicIdListLen UInt32
HeuristicIdList Binary

Event ID 10041: The OTP credentials of user OTPUserName were verified by RADIUS server RadiusName.

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Description

The OTP credentials of user OTPUserName were verified by RADIUS server RadiusName. The OTP certificate enrollment request was signed by the Remote Access server.

Message #

The OTP credentials of user %1 were verified by RADIUS server %2. The OTP certificate enrollment request was signed by the Remote Access server.

Fields #

NameDescription
OTPUserName UnicodeString
RadiusName UnicodeString

Event ID 10042: The OTP credentials of user OTPUserName were not verified by RADIUS server RadiusName.

#
Channel
Admin
Task
DirectAccessOTPAuthentication

Description

The OTP credentials of user OTPUserName were not verified by RADIUS server RadiusName. Error: ErrorReason.

Message #

The OTP credentials of user %1 were not verified by RADIUS server %2. Error: %3.

Fields #

NameDescription
OTPUserName UnicodeString
RadiusName UnicodeString
ErrorReason UnicodeString

Event ID 10042

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Description

The OTP credentials of user were not verified by RADIUS server . Error: .

Fields #

NameDescription
OTPUserName UnicodeString
RadiusName UnicodeString
ErrorReason UnicodeString

Event ID 10044: The user name (CertificateEnrollmentRequestUserName) in the certificate enrollment request does not match the user name (OTPUserName) specified for OTP authentication.

#
Channel
Admin
Task
DirectAccessOTPAuthentication

Message #

The user name (%1) in the certificate enrollment request does not match the user name (%2) specified for OTP authentication.

Fields #

NameDescription
CertificateEnrollmentRequestUserName UnicodeString
OTPUserName UnicodeString

Event ID 10044

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Description

The user name () in the certificate enrollment request does not match the user name () specified for OTP authentication.

Fields #

NameDescription
CertificateEnrollmentRequestUserName UnicodeString
OTPUserName UnicodeString

Event ID 10045: The CA template from which user OTPUserName requested a certificate is not configured to issue OTP certificates.

#
Channel
Admin
Task
DirectAccessOTPAuthentication

Message #

The CA template from which user %1 requested a certificate is not configured to issue OTP certificates.

Fields #

NameDescription
OTPUserName UnicodeString
TemplateName UnicodeString

Event ID 10045

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Description

The CA template from which user requested a certificate is not configured to issue OTP certificates.

Fields #

NameDescription
OTPUserName UnicodeString
TemplateName UnicodeString

Event ID 10046: The DaOTPAuth ISAPI extension started on the Remote Access server.

#
Channel
Operational
Task
DirectAccessOTPAuthentication
Opcode
Start

Description

The DaOTPAuth ISAPI extension started on the Remote Access server. This extension is used for DirectAccess OTP authentication.

Message #

The DaOTPAuth ISAPI extension started on the Remote Access server. This extension is used for DirectAccess OTP authentication.

Event ID 10047: The DaOTPAuth ISAPI extension stopped on the Remote Access server.

#
Channel
Operational
Task
DirectAccessOTPAuthentication
Opcode
Stop

Description

The DaOTPAuth ISAPI extension stopped on the Remote Access server. This extension is used for DirectAccess OTP authentication. OTP might not work as expected when the extension is not running.

Message #

The DaOTPAuth ISAPI extension stopped on the Remote Access server. This extension is used for DirectAccess OTP authentication. OTP might not work as expected when the extension is not running.

Event ID 10049: ServerType server CurrentActiveServerName is unavailable and cannot currently be used.

#
Channel
Admin
Task
DirectAccessOTPAuthentication

Description

ServerType server CurrentActiveServerName is unavailable and cannot currently be used. Remote Access will attempt to use ServerType server FailoverServerName for OTP authentication.

Message #

%1 server %2 is unavailable and cannot currently be used. Remote Access will attempt to use %1 server %3 for OTP authentication.

Fields #

NameDescription
ServerType UnicodeString
CurrentActiveServerName UnicodeString
FailoverServerName UnicodeString

Event ID 10049

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Description

server is unavailable and cannot currently be used. Remote Access will attempt to use server for OTP authentication.

Fields #

NameDescription
ServerType UnicodeString
CurrentActiveServerName UnicodeString
FailoverServerName UnicodeString

Event ID 10050: OTP authentication will be enabled on the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication will be enabled on the Remote Access server. CGI and ISAPI extensions for IIS will be enabled.

Message #

OTP authentication will be enabled on the Remote Access server. CGI and ISAPI extensions for IIS will be enabled.

Event ID 10051: failedComponent cannot be configured.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Description

failedComponent cannot be configured. The IIS default web site cannot be located on the Remote Access server, and is required for failedComponent deployment. Verify that IIS is installed and enabled.

Message #

%1 cannot be configured. The IIS default web site cannot be located on the Remote Access server, and is required for %1 deployment. Verify that IIS is installed and enabled.

Fields #

NameDescription
failedComponent UnicodeString

Event ID 10051

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

cannot be configured. The IIS default web site cannot be located on the Remote Access server, and is required for deployment. Verify that IIS is installed and enabled.

Fields #

NameDescription
failedComponent UnicodeString

Event ID 10052: ServerType servers were sorted in the following order: SortedServersNames.

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Message #

%1 servers were sorted in the following order: %2.

Fields #

NameDescription
ServerType UnicodeString
SortedServersNames UnicodeString

Event ID 10053: DirectAccess OTP settings cannot be applied because the WebDAV IIS extension is running on the server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Description

DirectAccess OTP settings cannot be applied because the WebDAV IIS extension is running on the server. Remove WebDAV and apply the settings again.

Message #

DirectAccess OTP settings cannot be applied because the WebDAV IIS extension is running on the server. Remove WebDAV and apply the settings again.

Event ID 10053

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

DirectAccess OTP settings cannot be applied because the WebDAV IIS extension is running on the server. Remove WebDAV and apply the settings again.

Event ID 10054: The user name (OTPUserName) specified for OTP authentication does not exist.

#
Channel
Admin
Task
DirectAccessOTPAuthentication

Message #

The user name (%1) specified for OTP authentication does not exist.

Fields #

NameDescription
OTPUserName UnicodeString

Event ID 10054

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Description

The user name () specified for OTP authentication does not exist.

Fields #

NameDescription
OTPUserName UnicodeString

Event ID 10055: The OTP certificate enrollment request is invalid.

#
Channel
Admin
Task
DirectAccessOTPAuthentication

Description

The OTP certificate enrollment request is invalid. Error: ErrorCode (ErrorMessage).

Message #

The OTP certificate enrollment request is invalid. Error: %1 (%2).

Fields #

NameDescription
ErrorCode UInt32
ErrorMessage UnicodeString

Event ID 10055

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Description

The OTP certificate enrollment request is invalid. Error: ().

Fields #

NameDescription
ErrorCode UInt32
ErrorMessage UnicodeString

Event ID 10056: An OTP signing certificate cannot be found.

#
Channel
Admin
Task
DirectAccessOTPAuthentication

Description

An OTP signing certificate cannot be found. The OTP certificate enrollment request cannot be signed.

Message #

An OTP signing certificate cannot be found. The OTP certificate enrollment request cannot be signed.

Event ID 10056

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Description

An OTP signing certificate cannot be found. The OTP certificate enrollment request cannot be signed.

Event ID 10057: An OTP signing certificate cannot be enrolled using certificate template Template.

#
Channel
Admin
Task
DirectAccessOTPAuthentication

Message #

An OTP signing certificate cannot be enrolled using certificate template %1.

Fields #

NameDescription
Template UnicodeString

Event ID 10057

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Description

An OTP signing certificate cannot be enrolled using certificate template .

Fields #

NameDescription
Template UnicodeString

Event ID 10058: Read permissions for the Network Service cannot be configured for the OTP signing certificate.

#
Channel
Admin
Task
DirectAccessOTPAuthentication

Event ID 10058

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Description

Read permissions for the Network Service cannot be configured for the OTP signing certificate.

Event ID 10059: OTP authentication is enabled on the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication is enabled on the Remote Access server. CGI and ISAPI extensions for IIS have been enabled.

Message #

OTP authentication is enabled on the Remote Access server. CGI and ISAPI extensions for IIS have been enabled.

Event ID 10060: NLB was started on the Remote Access server after the task completed successfully.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Event ID 10061: NLB was stopped on the Remote Access server because a task did not complete successfully.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Event ID 10062: Failure encountered during configuration.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10062

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

Failure encountered during configuration.

Event ID 10063: OTP client authentication cannot complete.

#
Channel
Admin
Task
DirectAccessOTPAuthentication

Description

OTP client authentication cannot complete. A connection to the domain controller in order to retrieve the user name cannot be established.

Message #

OTP client authentication cannot complete. A connection to the domain controller in order to retrieve the user name cannot be established.

Event ID 10063

#
Channel
Operational
Task
DirectAccessOTPAuthentication

Description

OTP client authentication cannot complete. A connection to the domain controller in order to retrieve the user name cannot be established.

Event ID 10064: An error occurred when configuring Remote Access settings in the Windows DirectAccess NLB helper driver.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Fields #

NameDescription
ErrorCode UInt32

Event ID 10064

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

An error occurred when configuring Remote Access settings in the Windows DirectAccess NLB helper driver.

Fields #

NameDescription
ErrorCode UInt32

Event ID 10065: Remote Access static address pool configuration settings stored in the Windows DirectAccess NLB helper driver have been modified.

#
Channel
Operational
Task
RemoteAccessNLBhelperdriverconfigurationtask

Fields #

NameDescription
Action UInt32
Owner UInt32
StartIPAddress UnicodeString
EndIPAddress UnicodeString

Event ID 10066: Remote Access configuration settings stored in the Windows DirectAccess NLB helper driver have been modified.

#
Channel
Operational
Task
RemoteAccessNLBhelperdriverconfigurationtask

Fields #

NameDescription
IPHttpsPrefix UnicodeString
RasIPv6prefix UnicodeString
InternalinterfaceGUID UnicodeString

Event ID 10067: The Windows DirectAccess NLB helper driver was loaded

#
Channel
Operational
Task
RemoteAccessNLBhelperdriverconfigurationtask

Event ID 10068: The Windows DirectAccess NLB helper driver was unloaded

#
Channel
Operational
Task
RemoteAccessNLBhelperdriverconfigurationtask

Event ID 10069: OTP authentication settings cannot be applied.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication settings cannot be applied. There is a problem with the IP-HTTPS settings or the IP-HTTPS certificate.

Message #

OTP authentication settings cannot be applied. There is a problem with the IP-HTTPS settings or the IP-HTTPS certificate.

Event ID 10069

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication settings cannot be applied. There is a problem with the IP-HTTPS settings or the IP-HTTPS certificate.

Event ID 10073: OTP authentication will be disabled on the Remote Access server.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication will be disabled on the Remote Access server. CGI and ISAPI extensions for IIS will be disabled.

Message #

OTP authentication will be disabled on the Remote Access server. CGI and ISAPI extensions for IIS will be disabled.

Event ID 10074: OTP authentication is disabled on the Remote Access server, and CGI and ISAPI extensions for IIS have been disabled.

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Message #

OTP authentication is disabled on the Remote Access server, and CGI and ISAPI extensions for IIS have been disabled. In addition, other Windows features might have been disabled. For more details see Event 10 in the Setup section of the Windows Logs in the Event Viewer.

Event ID 10075: OTP authentication cannot be enabled.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be enabled. SSL settings cannot be applied on the OTP site in IIS.

Message #

OTP authentication cannot be enabled. SSL settings cannot be applied on the OTP site in IIS.

Event ID 10075

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be enabled. SSL settings cannot be applied on the OTP site in IIS.

Event ID 10076: OTP authentication cannot be disabled.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be disabled. SSL settings cannot be applied on the OTP site in IIS.

Message #

OTP authentication cannot be disabled. SSL settings cannot be applied on the OTP site in IIS.

Event ID 10076

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be disabled. SSL settings cannot be applied on the OTP site in IIS.

Event ID 10077: OTP authentication cannot be enabled.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be enabled. An IIS web site required for OTP cannot be created.

Message #

OTP authentication cannot be enabled. An IIS web site required for OTP cannot be created

Event ID 10077

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be enabled. An IIS web site required for OTP cannot be created.

Event ID 10078: OTP authentication cannot be disabled.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be disabled. An IIS web site required for OTP cannot be deleted.

Message #

OTP authentication cannot be disabled. An IIS web site required for OTP cannot be deleted

Event ID 10078

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be disabled. An IIS web site required for OTP cannot be deleted.

Event ID 10079: OTP authentication cannot be enabled on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10079

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be enabled on the Remote Access server.

Event ID 10080: OTP authentication cannot be disabled on the Remote Access server.

#
Channel
Admin
Task
RemoteAccessserverconfigurationtask

Event ID 10080

#
Channel
Operational
Task
RemoteAccessserverconfigurationtask

Description

OTP authentication cannot be disabled on the Remote Access server.

Provenance

ETW provider GUID 214609e4-72cc-4e0e-95f8-1d503fc4ad7f

Defined in ramgmtsvc.dll, which carries the event manifest.

  • WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB