PC not able to be audited and not found in Active Directory

 
1
0
-1

After upgrading from ver 2.3.1 to 3.0.2 windows audits fail. We do not have access to AD, most windows systems are in local workgroup. Any way to disable AD lookups?

 

Attempting Active Directory data retrieval.
No default LDAP provided, using local settings.
LDAP domain: LDAP://yyyyy.com
PC not able to be audited and not found in Active Directory.
Active Directory used for search was: LDAP://yyyy.com
No audit recorded.

    CommentAdd your comment...

    3 answers

    1.  
      2
      1
      0

      Hello Phil,

      It sounds like you created an Active Directory discovery, rather than a Subnet Discovery. You should also set your log_level to 7 in the Configuration, then audit a single Windows machine. The output will be very granular and should point you to where any additional issues are.

        CommentAdd your comment...
      1.  
        1
        0
        -1

        Update: the reason I was getting error -2147217405 is because I was running my tests from a regular command prompt. As long as I right click on command prompt and run as administrator, everything works as expected. Thanks!

          CommentAdd your comment...
        1.  
          1
          0
          -1

          Thanks, just noticed the Active Directory setting was set to Y I changed to N now 1 step closer to getting ver 3.0.2 working. Here is next error, ver 2.3.1 audit_windows script works fine on this one, here is the error for ver 3

          Target: .
          No Match: Auditing remote host.
          Disregarding ping_target because we're auditing localhost.
          Problem authenticating (10) to .
          Error Number:-2147217405
          Error Description:
          Cannot connect to .

           

          I changed the . to the actual hostname:

          Target: L31712WUS
          Match: Auditing localhost.
          Changed strcomputer from L31712WUS to . because we're auditing this local machine.
          Disregarding ping_target because we're auditing localhost.
          Problem authenticating (10) to .
          Error Number:-2147217405
          Error Description:
          Cannot connect to .

          will keep chipping away...

            CommentAdd your comment...