This Rule generates alerts when The Malware Inspection Filter failed to load a progress notification template file.
One or more templates for progress notifications could not be loaded.
This failure may occur for one or more of the following reasons:
The Microsoft Firewall service does not have sufficient permissions to access the folder containing the templates for progress notifications.
A template is missing or corrupted.
To resolve this issue, do the following:
Verify that the Microsoft Firewall service has Read permission for the folder containing the templates.
If the Microsoft Firewall service has Read permission, restore the contents of the folder by copying the original templates from the installation DVD.
Target | Microsoft.Forefront.TMG.WebProxy.ServerComponent |
Category | EventCollection |
Enabled | True |
Alert Generate | False |
Remotable | True |
ID | Module Type | TypeId | RunAs |
---|---|---|---|
DS | DataSource | Microsoft.Forefront.TMG.Rule.AlertGenerate.DS | Default |
WA | WriteAction | Microsoft.Forefront.TMG.Rule.AlertGenerate.WA | Default |
<Rule ID="Microsoft.Forefront.TMG.The_Malware_Inspection_Filter_failed_to_load_a_progress_notification_template_file.Rule" Enabled="true" Target="Microsoft.Forefront.TMG.WebProxy.ServerComponent" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">
<Category>EventCollection</Category>
<DataSources>
<DataSource ID="DS" TypeID="Microsoft.Forefront.TMG.Rule.AlertGenerate.DS">
<ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>
<LogName>Application</LogName>
<EventsPattern>^(23464)$</EventsPattern>
<EventType>1</EventType>
<SourcePattern>Microsoft Forefront TMG Web Proxy</SourcePattern>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="WA" TypeID="Microsoft.Forefront.TMG.Rule.AlertGenerate.WA">
<AlertMessageId>$MPElement[Name="Microsoft.Forefront.TMG.The_Malware_Inspection_Filter_failed_to_load_a_progress_notification_template_file.AlertMessage"]$</AlertMessageId>
<DomainName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/DomainDnsName$</DomainName>
<Priority>2</Priority>
<Severity>2</Severity>
</WriteAction>
</WriteActions>
</Rule>