- RPC server unavailable
- Access Denied
- Remote Procedure Call Failed
- Network Access Denied
- A network adapter hardware error occurred
- The network path was not found
- The parameter is incorrect
- The handle is invalid
- Not enough memory resources are available to process this command
1. RPC server unavailable
Cause:
This error occurs when the RPC ports (static port no.135 and dynamic port no. 49152- 65535) are not opened in the firewall.
Solution:
Ensure that the RPC ports (static port no.135 and dynamic port no. 49152- 65535*) are open so that ADAudit Plus can collect Windows logs from the monitored computers.
Follow this port guide to open the RPC ports required for Windows log collection.
* Note: If you are using Windows Firewall you can open dynamic ports (49152-65535) on the monitored computers by enabling the inbound rules listed below.
- Remote Event Log Management (NP-In)
- Remote Event Log Management (RPC)
- Remote Event Log Management (RPC-EPMAP)
To enable the above rules: Open Windows Firewall > Advanced settings > Inbound Rules > Right click on respective rule > Enable Rule.
Troubleshooting:
- Ping the target server by name from the ADAudit Plus server.
- Login to your ADAudit Plus web console.
- Identify the server showing the RPC error from the Available Domain Controllers under Domain Settings or under Configured Server(s) in the File Audit tab or under Configured server(s) in the Server Audit tab.
- Note the flat name of the server as found in ADAudit Plus console as well as its DNS name.
- Open Command Prompt in the ADAudit Plus server and ping the target server by its name as noted from ADAudit Plus console to verify that the name resolves to the correct IP address.
- If the ping to the server is successful, name resolution is not likely to be the cause of the issue.
- If the ping to the server fails, try pinging the server by its DNS name; if successful, append the DNS suffix in the Advanced TCP/IP settings, or add a host record in the DNS server, mapping this name to the server's IP address.
- Try to connect to the target server's Event Viewer from the ADAudit Plus server.
- Open Start on the ADAudit Plus server and search for Event Viewer.
- Right click on Event Viewer and click Run as Administrator. Enter your admin credentials and click OK.
- In the Event Viewer window, right click on Event Viewer (Local) on the top left and select Connect to Another Computer.
- Enter the target server name or IP address in the Another Computer field and click OK.
- If you can connect to the target server, check if you are able to access the shares on the target server, next.
- Try to connect to shares on the target server from the ADAudit Plus server.
- Open File Explorer in the ADAudit Plus server and select Network from the left tree.
- In the Network window, double click on the target computer which contains the shared folder.
- Open the shared folder and double click on the share you want to access.
- Alternatively, you can run the UNC path to the shared folder and access the shares.
2. Access Denied
Cause:
This error occurs when the user account that runs ADAudit Plus does not have sufficient privileges to access the event logs.
Solutions:
- Provide Domain Admin privilege:
ADAudit Plus requires Domain Admin credentials to instantly audit activities in your Active Directory (AD). Ensure that you login to ADAudit Plus with Domain Admin credentials.
- Set up a service account with minimum privileges:
If you do not want to provide Domain Admin credentials, you need to set up a service account with the least privileges required to audit your AD environment.
- Grant the ADAudit Plus user special privileges to read security logs:
If you have given non-administrators the permission to read event logs, grant the same permissions to the user account that runs ADAudit Plus to access the security logs.
Troubleshooting:
Try to connect to the target server's Event Viewer from the ADAudit Plus server.
- Open Start in the ADAudit Plus server and search for Event Viewer.
- Right click on Event Viewer and click Run as Administrator. Enter credentials of the user account that runs ADAudit Plus.
- In the Event Viewer window, right click on Event Viewer (Local) on the top left and select Connect to Another Computer.
- Enter the target computer name or IP address in the Another Computer field and click OK.
- If you are unable to connect to the target computer, the user account that runs ADAudit Plus does not have sufficient privileges.
3. Remote Procedure Call Failed
Cause:
This error occurs when the RPC ports (static port no.135 and dynamic port no. 49152- 65535*) are not opened in the firewall or when packets are lost due to unstable Wide Area Network (WAN) link.
Solution:
Ensure that the RPC ports (static port no.135 and dynamic port no. 49152- 65535*) are open so that ADAudit Plus can collect Windows logs from the monitored computers.
Follow this port guide to open the RPC ports required for Windows log collection.
* Note: If you are using Windows Firewall you can open dynamic ports (49152-65535) on the monitored computers by enabling the inbound rules listed below.
- Remote Event Log Management (NP-In)
- Remote Event Log Management (RPC)
- Remote Event Log Management (RPC-EPMAP)
To enable the above rules: Open Windows Firewall > Advanced settings > Inbound Rules > Right click on respective rule > Enable Rule..
Troubleshooting:
- Ping the target server by name from the ADAudit Plus server.
- Login to your ADAudit Plus web console.
- Identify the server showing the RPC error from the Available Domain Controllers under Domain Settings or under Configured Server(s) in the File Audit tab or under Configured server(s) in the Server Audit tab.
- Note the flat name of the target server as found in ADAudit Plus console as well as its DNS name.
- Open Command Prompt in the ADAudit Plus server and ping the target server by its flat name as noted from ADAudit Plus console to verify that the name resolves to the correct IP address.
- If the ping to the server is successful, name resolution is not likely to be the cause of the issue.
- If the ping to the server fails, try pinging the server by its DNS name; if successful, append the DNS suffix in the Advanced TCP/IP settings or add a host record in the DNS server, mapping this name to the server's IP address.
- Try to connect to the target server's Event Viewer from the ADAudit Plus server.
- Open Start in the ADAudit Plus server and search for Event Viewer.
- Right click on Event Viewer and click Run as Administrator. Enter credentials with local admin rights on the remote computer you want to access.
- In the Event Viewer window, right click on Event Viewer (Local) on the top left and select Connect to Another Computer.
- Enter the target computer name or IP address in the Another Computer field and click OK.
- If you can connect to the target server, check if you are able to access the shares on the target server, next.
- Try to connect to shares on the target server from the ADAudit Plus server.
- Open File Explorer in the ADAudit Plus server and select Network from the left tree.
- In the Network window, double click on the target server which contains the shared folder.
- Open the shared folder and double click on the share you want to access.
- Alternatively, you can run the UNC path to the shared folder and access the shares.
Note: If the target server and the ADAP server are connected across a WAN connection, we suggest that you install an agent for smoother data collection.
4. Network Access Denied
Cause:
This error occurs when the user account that runs ADAudit Plus does not have sufficient privileges to access the event logs.
Solutions:
- Provide Domain Admin privilege:
ADAudit Plus requires Domain Admin credentials to instantly audit activities in your Active Directory (AD). So, ensure that you login to ADAudit Plus with Domain Admin credentials or set up a service account with minimum privileges.
- Set up a service account with minimum privileges:
If you do not want to provide Domain Admin credentials, you need to set up a service account with only the least privileges required to audit your AD environment.
- Follow this service account configuration guide to set-up the service account with minimum privileges required for:
5. A network adapter hardware error occurred
Cause:
This error occurs when there are any connectivity issues between the ADAudit Plus server and the target computer.
Troubleshooting:
- Try to connect to the target computer's Event Viewer from the ADAudit Plus server.
- Open Start in the ADAudit Plus server and search for Event Viewer.
- Right click on Event Viewer and click Run as Administrator. Enter credentials with local admin rights on the remote computer you want to access.
- In the Event Viewer window, right click on Event Viewer (Local) on the top left and select Connect to Another Computer.
- Enter the target computer name or IP address in the Another Computer field and click OK.
- If you can connect to the target server, check if you are able to access the shares on the target server, next.
- Try to connect to shares on the target computer from the ADAudit Plus server.
- Open File Explorer in the ADAudit Plus server and select Network from the left tree.
- In the Network window, double click on the target computer which contains the shared folder.
- Open the shared folder and double click on the share you want to access.
- Alternatively, you can run the UNC path to the shared folder and access the shares.
6. The network path was not found
Cause:
This error occurs when the ADAudit Plus server is unable to contact the target computer.
Solution:
Ensure that there are no connectivity issues between the ADAudit Plus server and the target computer.
Troubleshooting:
- Connect to the target computer's Event Viewer from the ADAudit Plus server.
- Open Start in the ADAudit Plus server and search for Event Viewer.
- Right click on Event Viewer and click Run as Administrator. Enter admin credentials and click OK.
- In the Event Viewer window, right click on Event Viewer (Local) on the top left and select Connect to Another Computer.
- Enter the remote computer name or IP address in the Another Computer field and click OK.
- If you are able to connect to the target computer, try connecting to the shares.
- Connect to shares on the target computer by following the steps below:
- Click the File Explorer in the ADAudit Plus server and select Network from the left tree.
- In the Network window, double click on the target computer which contains the shared folder.
- Open the shared folder and double click on the share you want to access. Alternatively, you can run the UNC path to the shared folder and try to access the shares.
7. The parameter is incorrect
Cause:
This error occurs as a result of events getting overwritten before ADAudit Plus could read them due to insufficient log size. Reading the event logs across Wide Area Network (WAN) connections can also lead to this error.
Solutions:
- Verify whether event log size and retention settings are defined to prevent audit data loss due to events getting overwritten.
- In case you have a large network that operates across WAN connections, deploy a client-side agent for smoother data collection and lower bandwidth utilization.
8. The handle is invalid
Cause:
This error occurs as a result of events getting overwritten before ADAudit Plus could read them due to insufficient log size. Reading the event logs across Wide Area Network (WAN) connections can also lead to this error.
Solutions:
- Verify whether event log size and retention settings are defined to prevent audit data loss due to events getting overwritten.
- In case you have a large network that operates across WAN connections, deploy a client-side agent for smoother data collection and lower bandwidth utilization.
9. Not enough memory resources are available to process this command
Cause:
This error occurs if the RAM size is low on the target computer.
Solution:
Ensure that the RAM size on the target computer is sufficient for smooth operation. Also, check the RAM usage.