Home
  •  

轉送的 AS 要求無效

Invalid_Forwarded_AS_Request_5_Rule (Rule)

Knowledge Base article:

摘要

此網域控制站從主要網域控制站 (PDC) 收到無效的驗證服務 (AS) 要求。可能有人嘗試欺騙此網域的 PDC。

解決方式

檢閱 AD Op Master Response 指令碼建立的警示，確認此網域控制站能與 PDC 通訊。

確認沒有防火牆封鎖 Kerberos 連接埠。

重設 PDC 機器帳戶的密碼。

使用 Adsiedit.msc 確認 PDC 機器帳戶沒有已定義的使用者主要名稱 (UPN)。

外部

如需詳細資訊，請參閱：

Element properties:

TargetMicrosoft.Windows.Server.2008.AD.DomainControllerRole
CategoryEventCollection
EnabledTrue
Event_ID15
Event SourceMicrosoft-Windows-Kerberos-Key-Distribution-Center
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
轉送的 AS 要求無效
{0}
Event LogSystem
CommentMom2005ID='{D4C4FF8B-7908-4506-B36B-952B824E6533}';MOM2005GroupID=

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
CollectEventData WriteAction Microsoft.SystemCenter.CollectEvent Default
CollectEventDataWarehouse WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Invalid_Forwarded_AS_Request_5_Rule" Comment="Mom2005ID='{D4C4FF8B-7908-4506-B36B-952B824E6533}';MOM2005GroupID=" Enabled="onEssentialMonitoring" Target="AD2008Core!Microsoft.Windows.Server.2008.AD.DomainControllerRole" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>15</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery>PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Microsoft-Windows-Kerberos-Key-Distribution-Center</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Invalid_Forwarded_AS_Request_5_Rule.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue/>

      </Suppression>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>