Home
  •  

Error Reporting Settings Tampered

Microsoft.Dynamics.CRM.Error_Reporting_Settings_Tampered (Rule)

Knowledge Base article:

Summary

This event is recorded when CRM Platform Service identifies that for the received error report, the user's preference for error reporting on the server is different then what is communicated by the client that is reporting the error.

Causes

If this event happens frequently, the configuration of the Error Reporting settings on the client have been tampered with by scripts on the page that is generating the script error. The page might have been infected with malicious scripts.

Resolutions

Verify client settings and scripts running on page generating the error.

Element properties:

TargetMicrosoft.Dynamics.CRM.Web_App_Servers
CategoryEventCollection
EnabledFalse
Alert GenerateTrue
Alert SeverityWarning
Alert PriorityNormal
RemotableTrue
Alert Message
Error Reporting Settings Tampered
EventId: {0} Event Publisher: {1} Event Description: {2}
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
GenerateAlert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Dynamics.CRM.Error_Reporting_Settings_Tampered" Enabled="false" Target="Microsoft.Dynamics.CRM.Web_App_Servers" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">20481</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">CRM Application Infrastructure</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventLevel</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="Integer">2</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>1</Severity>

      <AlertMessageId>$MPElement[Name="AlertMessageIDde51021ed3ff4273a7f56acd0a4aa23d"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDisplayNumber$</AlertParameter1>

        <AlertParameter2>$Data/PublisherName$</AlertParameter2>

        <AlertParameter3>$Data/EventDescription$</AlertParameter3>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>