Unable to collect events from non-domain controllers

[RSAAdmin]

Off-late we are experiencing a strange issue, we are unable to pull logs from non-domain controllers. However with the same event source able to pull events from Domain controllers.

While investigating we found the below error message.

[windows:WrkUnit[1]:3549] [doWork:165] [NawrasAd.10_x_x_x] [processing] [NawrasAd.10_x_x_x] Unable to subscribe for events with Windows event source 10.x.x.x: 401/Unauthorized.

Possible causes:

- Event source (10.x.x.x) not a FQDN. DNS resolution failed or does not map to a Kerberos Realm.

Recently we upgraded SA to 10.3 after the suggestion from technical support, yet issue persists.

Thanks in advance.

[RSAAdmin]

I have different timezones: one timezone on log collector, legacy log collector and another on domain controllers, non-domain controllers and non-domain servers. And all of the collection works. So it isn't the issue.

I suggest using a script and not setting up winrm manually. It's here:

Also Collector log contains useful info

Try it and ping us back

[Anonymous]

Different time zone - no problem, problem if time between Kerberos server and client more then 5 minutes...

[RSAAdmin]

Issue is still not resolved. Any other comments or thoughts?

[RSAAdmin]

Did you try enabling winrm with a script that I was referring to? Can you resolve ip/name from collector?

[RSAAdmin]

Yes, I tired the winrm set script yet no luck. Also I am able to resolve IP to DNS name from collector...

[RSAAdmin]

Then can you show Kerberos config, event source config, they may be misconfigured.

[huanzhou1]

can you try winrs command from another machine to confirm the winrm is working fine?

for example i tested in my lab:

winrs -r:https://srv6.exchange.local:5986 -u:administrator -p:Passw0rd2 dir

If you using https, you need add the certificate.

[Anonymous]

Sorry, I wasn't able to reply sooner. Thx you all for the tips.

In my case, Kerberos wasn't set correctly. Now it is working as a charm.

[huanzhou1]

glad you resolved your problem. 🙂

[Anonymous]

What was the issue with Kerberos ? What exactly you did to resolve it?