Return
-
Title
Audit Agent Install error "Critical Error: Test failed for agent service account on domain controller "DCNAME" Failed to open the security log Cannot open log Security on machine "DCNAME"." -
Description
The following error is shown when installing the Audit Agent
Critical Error: Test failed for agent service account on domain controller "DCNAME"
Failed to open the security log Cannot open log Security on machine "DCNAME".
Windows has not provided an error code. Please check that you have a valid Active Directory username and
password and the account has administrator rights and has access to the Active Administrator database.
Administrator rights required to read the security log on the domain controller.
-
Cause
If the Domain Controller, Agent Computer or the Active Administrator Machines are on different Operating System \ patch levels can cause this error.This is expected due to security hardening changes relating to Event Tracing for Windows (ETW) for CVE-2021-31958.After installing this or later updates, apps accessing event logs on remote devices might be unable to connect. This issue might occur if the local or remote has not yet installed updates released June 8, 2021 or later. Affected apps are using certain legacy Event Logging APIs. You might receive an error when attempting to connect, for example:- error 5: access is denied
- error 1764: The requested operation is not supported.
- System.InvalidOperationException,
Microsoft.PowerShell.Commands.GetEventLogCommand
- Windows has not provided an error code.
-
Resolution
This issue is resolved if the local and remote devices all have installed updates as per MITRE CVE-2021-31958
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31958
-
Defect ID
VSTS000346741