Home
  •  

Excel Calculation Services Unauthorized Attempt To Access A Session

Microsoft.SharePoint.Server.2010.Excel_Unauthorized_attempt_to_access_a_session (Rule)

This Rule collects data when a user attempts to access another user's session, Excel Calculation Services denies requests made by the user who does not own the session and logs an event in the Windows Event log.

Knowledge Base article:

Summary

To get the most current Knowledge Article from the Microsoft TechNet site, visit:

http://go.microsoft.com/fwlink/?LinkId=142739

Causes

View all current alerts from this object using this link:

View Alerts

Element properties:

TargetMicrosoft.SharePoint.Server.2010.SPServiceInstance.Excel
CategoryEventCollection
EnabledTrue
Event_ID2011
Event SourceMicrosoft-SharePoint Products-Excel Services Application
Alert GenerateFalse
RemotableTrue
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectEvent Default
WriteToDW WriteAction Microsoft.SystemCenter.DataWarehouse.PublishEventData Default

Source Code:

<Rule ID="Microsoft.SharePoint.Server.2010.Excel_Unauthorized_attempt_to_access_a_session" Enabled="true" Target="Microsoft.SharePoint.Server.2010.SPServiceInstance.Excel" ConfirmDelivery="false" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">2011</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-SharePoint Products-Excel Services Application</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToDW" TypeID="SCDW!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>