Auditing CIFS Unity300

Question

Hi,

I'm not sure this is specifically a problem with the Unity300, but I'm hoping someone has had similar issues and can point me in the right direction.

I'm trying to get Netwrix working on a New install of server 2019.

I've followed the relevant processes to have an event log on \\ \events\security.evt

I can access these records via a windows 10 pc using computer management and can see the events.

I can do the same on a Server 2016 server.

when I try on the Server 2019 I get the following error:

Unable to complete the operation on Security. the authentication service is unknown

and there is a DCOM error :

DCOM was unable to communicate with the comuter using any of the configured protocols (event id: 10028)

I've looked at firewall settings on the server but cant see whats failing and why.

has anyone got this to work successfully? Is there some additional configuration required?

Netwrix can't/ won't help.

Let me know if you need any more information.

thanks,

LF

DELL-Sam L · Answer

Hello Longfella72,

I would check your settings using security & configuration guide to make sure everything is set correctly first. Here is a link to the Dell EMC Unity Family Security Configuration Guide.

https://dell.to/3gRmrGi

Longfella72 · Answer

Thanks, I'll have a look at that. Interestingly, I've been able to get everything working on a fresh install of Server 2016 LF

Esprinet · Answer

Hello,

I have the same issue: on a fresh install of windows server 2016 everything works but on a fresh install of windows server 2019 it doesn't.

there is a way to make the audit fileserver work between Unity and Netwrix on windows server 2019?

thanks

DELL-Sam L · Answer

Hello Esprinet, What is your current OE on your unity?

Esprinet · Answer

Hello, this is the current OE:  5.0.6.0.5.008.1609 thanks

DELL-Sam L · Answer

Hello Esprinet, It should work as long as you are configuring your unity using the security & config guide best practices.  I would check to see if Netwrix has any best practice configuration guides.

Rainer_EMC · Answer

netwrix should be able to figure out whats happening by looking at a network trace

Some general tips from the past:

enable evt file rotation / archive to keep the evt file at a decent size
relocate to an data fs (from the original vmd root)
I have heard issues accessing the currently being written to evt file - the guidance there was to enable rotation and access after its been closed

Esprinet · Answer

Thanks for reply

I've already follow all the Netwrix best practices for the fileserver configuration.

The strange is all others services work perfectly only fileserver service has this issue with windows server 2019 also the ova file downloaded from Netwrix official site have this problem.

Unity

Auditing CIFS Unity300

Was this post helpful?