Page 1 of 1

On-Demand Audit Fails

PostPosted: Tue Dec 07, 2004 8:10 am
by Judy Kirshner
Hi All,

I can't seem to get the On-Demand audit function to work. We have W2K and XP Pro clients and receive the following error message:

"Failed: Error starting audit. WMI replied 'Access Denied'. Make sure that the deployment share is included in the NullSessionShares list."

We are using Network Inventory Navigator v4.2. The Analyzer is installed on a W2K Advanced server platform (SP4). The Navigator viewer is installed on an XP Pro (SP1) machine. The NullSessionShare has been added (and anonymous access allowed) using the addnullshares.exe utility. Modifying the Local Security Policy for XP machines (i.e., to Classic from Guest) does not make a difference.

Of note, the On-Deman audit *does* work for the machine on which the Navigator viewer is installed.

Any ideas?
Judy

PostPosted: Fri Dec 17, 2004 9:33 am
by wjw
I have the same problem; have had since we installed on a W2K3 server. I'm still waiting for a solution to the problem.

PostPosted: Sat Mar 05, 2005 11:50 am
by dimout
The addnullshares.exe utility helps you with adding a Null Session Share only. To make On Demand Audit work you should also enable Anonymous Access to the share.

I stumbled upon it myself and want you to TRUST ME in that I looked THREE times in the registry and MISSED one of the necessary parameters EVERY TIME.

So TO MAKE IT WORK you need to run regedt32, navigate to

HKEY_LOCAL_MACHINESystemCurrentControlSetControlLsa

and MAKE SURE that

RestrictAnonymous = 0

and

EveryoneIncludesAnonymous = 1

PostPosted: Fri Apr 22, 2005 3:21 pm
by RyanWest
I tried that. The restrict anonymous was already at 0 and I changed the everyoneincludesanonymous to 1 but still can not run on-demand audits.

on-demand audit failed even if addnullshare was used to perm

PostPosted: Wed Oct 19, 2005 8:13 pm
by phoenixc
I have the same problem, my audit is on Windows 2003 standard member server of my windows 2003 domain, I have run addnullshare for my audit server for my share inventaire$, the registry of my server was modifyed, I rebbot my server to make sure parameter are updated, I set permission on share for everyeone group to "full control" and NTFS for everyone group and anonymous logon to full control on this folder and it is always the same thing. I check another time the registry for HKEY_LOCAL_MACHINESystemCurrentControlSetControlLsa
RestrictAnonymous = 0

and

EveryoneIncludesAnonymous = 1
and all is OK but when I aks on-demand audit for remote computer I received message acces is denied for Workstation and RPC server is not available but I know the correct IP was used I able to use the specified server but it is not possible to aks on-demand audit for this server ??


some can help me ??

PostPosted: Thu Oct 27, 2005 12:43 pm
by arcammis
I have a working setup, but not very secure.

If you right click on the folder there are two tabs(Sharing, and Sercurity) make sure that "Everyone" has full access to your Audit folder.

For "Sharing" give "Every One" full access. Then for "Security" also give "Every One" full access.

For my setup I don't care if people see these file, they can't make heads or tails about the files anyways.

PostPosted: Tue Jun 13, 2006 5:17 pm
by shudon
Originally posted by phoenixc
I have the same problem, my audit is on Windows 2003 standard member server of my windows 2003 domain, I have run addnullshare for my audit server for my share inventaire$, the registry of my server was modifyed, I rebbot my server to make sure parameter are updated, I set permission on share for everyeone group to "full control" and NTFS for everyone group and anonymous logon to full control on this folder and it is always the same thing. I check another time the registry for HKEY_LOCAL_MACHINESystemCurrentControlSetControlLsa
RestrictAnonymous = 0

and

EveryoneIncludesAnonymous = 1
and all is OK but when I aks on-demand audit for remote computer I received message acces is denied for Workstation and RPC server is not available but I know the correct IP was used I able to use the specified server but it is not possible to aks on-demand audit for this server ??


some can help me ??


I have this exact issue, was a solution ever found?