Home
  •  

UserPinService: Found temporarily locked users

Microsoft.LS.2013.Monitoring.UnitMonitor.TimerResetEvent.Registrar.UPIN_FOUND_TEMPORARILY_LOCKED_USERS (UnitMonitor)

Knowledge Base article:

Summary

Found temporarily locked out users

Causes

The affected users' account might be target of denial of service or spoofing attacks.

Resolutions

Please get in touch with the affected users. Examine server logs to verify that this was not an intentional attack.

Element properties:

TargetMicrosoft.LS.2013.Component.Registrar
Parent MonitorSystem.Health.SecurityState
CategorySecurityHealth
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.LS.2013.MonitorType.TimerResetEvent.Simple
RemotableTrue
AccessibilityPublic
Alert Message
[LYNC] Found temporarily locked out users
{0}

Please see the 'Product Knowledge' and the 'Alert Context' tab on Alert Properties view for more information.
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.LS.2013.Monitoring.UnitMonitor.TimerResetEvent.Registrar.UPIN_FOUND_TEMPORARILY_LOCKED_USERS" Accessibility="Public" Enabled="true" Target="Microsoft.LS.2013.Component.Registrar" ParentMonitorID="Health!System.Health.SecurityState" Remotable="true" Priority="Normal" TypeID="Microsoft.LS.2013.MonitorType.TimerResetEvent.Simple" ConfirmDelivery="true">

  <Category>SecurityHealth</Category>

  <AlertSettings AlertMessage="Alert_Found_temporarily_locked_out_users">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Microsoft.LS.2013.Monitoring.UnitMonitor.TimerResetEvent.Registrar.UPIN_FOUND_TEMPORARILY_LOCKED_USERS.Timer" MonitorTypeStateID="TimerEventRaised" HealthState="Success"/>

    <OperationalState ID="Microsoft.LS.2013.Monitoring.UnitMonitor.TimerResetEvent.Registrar.UPIN_FOUND_TEMPORARILY_LOCKED_USERS.Error" MonitorTypeStateID="ErrorEventRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>Lync Server</LogName>

    <ErrorExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">47065</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">LS UserPin Service</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </ErrorExpression>

    <AutoResolveInterval>7200</AutoResolveInterval>

  </Configuration>

</UnitMonitor>