Home
  •  

CWA - 01 - Authentication Module\CWA - 007 - IWA auth logon failures\_Total

CWA___01___Authentication_Module_CWA___007___IWA_auth_logon_failures__Total___CWA (Rule)

This counter shows the total number of failed logons that used IIS authentication since the Communicator Web Access virtual server was started. The IIS authentication types used are NTLM, Kerberos, or single sign on (SSO) authentication if the Communicat

Knowledge Base article:

Summary

This counter shows the total number of failed logons that used IIS authentication since the Communicator Web Access virtual server was started. The IIS authentication types used are NTLM, Kerberos, or single sign on (SSO) authentication if the Communicator Web Access server is in SSO mode.

Causes

Failures may be caused by Active Directory connectivity problems, incorrect information supplied by users, or users who are not authorized to use Communicator Web Access. A large number could indicate abnormal logon activity.

Resolutions

Ensure Active Directory connectivity. Enable logon failure auditing on the Communicator Web Access server if the reason for logon failures is unknown.

Element properties:

TargetMicrosoft_Office_Communications_Server_2007_R2_Communicator_Web_Access
CategoryPerformanceCollection
EnabledTrue
Instance NameCWA - 01 - Authentication Module
Counter NameCWA - 007 - IWA auth logon failures
Frequency900
Alert GenerateFalse
RemotableTrue

Member Modules:

ID Module Type TypeId RunAs 
CollectPerfCounter DataSource System.Performance.OptimizedDataProvider Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectPerformanceData Default
WriteToDW WriteAction Microsoft.SystemCenter.DataWarehouse.PublishPerformanceData Default

Source Code:

<Rule ID="CWA___01___Authentication_Module_CWA___007___IWA_auth_logon_failures__Total___CWA" Enabled="true" Target="Microsoft_Office_Communications_Server_2007_R2_Communicator_Web_Access" ConfirmDelivery="false" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>PerformanceCollection</Category>

  <DataSources>

    <DataSource ID="CollectPerfCounter" TypeID="SCPerformance!System.Performance.OptimizedDataProvider">

      <ComputerName>$Target/Host/Property[Type="SCWindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <CounterName>CWA - 007 - IWA auth logon failures</CounterName>

      <ObjectName>CWA - 01 - Authentication Module</ObjectName>

      <InstanceName>_Total</InstanceName>

      <AllInstances>false</AllInstances>

      <Frequency>900</Frequency>

      <Tolerance>5</Tolerance>

      <ToleranceType>Absolute</ToleranceType>

      <MaximumSampleSeparation>4</MaximumSampleSeparation>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SCSystemLibrary!Microsoft.SystemCenter.CollectPerformanceData"/>

    <WriteAction ID="WriteToDW" TypeID="SCDataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishPerformanceData"/>

  </WriteActions>

</Rule>