Error in Window integration

[AtulChavan]

Hi Friends,

I am trying to integrate window servers with RSA SA. While trying to do so am receiving error like "01/Unauthorized. Please verify the credentials provided".

I have checked the winrm setting on server. Need your expert advise on this issue.

Many thanks in advance.

[DeepanshuSood1]

This is means the user id you are using is having incorrect credentials..

just rest the password of yur user on windows machine and then add the same again at SA end.

[AtulChavan]

There are n number of servers. Out of these servers only few number of servers giving me this error.

[DeepanshuSood1]

Just try to change and apply the new password, and before that check the port connectivity.

[DavidWaugh1]

You can get the 401 error for a variety of reasons.

Please find attached a zip file.

When you extract this zip file then it will contain three files:

- SetupWinrm.bat - batch file to setup WinRM. This calls the two other files

- Useradd.vbs - Adds a user to the required places needed for WinRM

-RSA_enVision_winevent_config.vbs - script to configure http or https for winrm.

To use:

-Change the username from winrm@WAUGH.LOCAL to your domain user you are using for winrm collection.

This needs to be done in useradd.vbs and also in the setupwinrm.bat files

- Change the domain in the useradd.vbs script to your domain (Replace WAUGH.LOCAL with the name of your domain)

In the useradd.vbs this means modifying these lines:

compname = "WAUGH"

Set oUser = GetObject("winmgmts:{impersonationLevel=impersonate}!\\"&compname&"\root\cimv2:Win32_UserAccount.Domain='"&compname&"',Name='winrm'")

-Run the batch file setupwinrm.bat and everything should then work!

(Note I didnt write the original useradd.vbs or RSA_enVision_winevent_config.vbs so I cant take any credit for them!)

[DavidWaugh1]

Other tips are:

-On a logcollector you can only collect form one domain. For multiple domains then you will need multiple log collectors

- Make sure that you have defined the windows event sources by the FQDN not by their IP address

- Make sure that you can resolve the FQDN of the event sources on the logcollector.

From 10.4.0 onwards we introduced a test connection feature too. Check that this succeeds or paste the output on this thread if after following all my suggestions it does not work.

[AtulChavan]

Hi David,

Thanks for the info. I have done the configuration on both end. And we have only one domain in our environment.

There are around 200 servers and only 3 to 4 servers are giving this error.

Is there any other possibility?

[pranavsankar1]

Try with credentials change for those servers which are not get to integrate.