Guarded Fabric Attestation Availability Monitor

Microsoft.Windows.GuardedFabric.10.0.GuardedHost.Attestation.Availability (UnitMonitor)

Event based unit monitor for checking if attestation fails due to being unable to reach the server.

Knowledge Base article:

Summary

A unit monitor for the Guarded Fabric, denoting if the Attestation service could be reached.

Causes

The IIS Service could be down, or this could be a configuration error. Use the cmdlet Get-HgsClientConfiguration on the Guarded Fabric, and Get-HgsServer to check if the URLs match.

Resolutions

Auto-resolves when the Guarded Fabric does a full attestation request.

Element properties:

Target

Microsoft.Windows.GuardedFabric.10.0.ComputerRole.GuardedHost

Parent Monitor

System.Health.AvailabilityState

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

MatchMonitorHealth

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.2SingleEventLog2StateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Guarded Host Attestation Availability Error

Guarded Fabric has failed attestation because the Host Guardian Service Server was unreachable.

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.Windows.GuardedFabric.10.0.GuardedHost.Attestation.Availability" Accessibility="Public" Enabled="true" Target="HGSDL!Microsoft.Windows.GuardedFabric.10.0.ComputerRole.GuardedHost" ParentMonitorID="Health!System.Health.AvailabilityState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="false">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.GuardedFabric.10.0.GuardedHost.Attestation.Availability.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="FirstEventRaised" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="SecondEventRaised" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</FirstComputerName>

    <FirstLogName>Microsoft-Windows-HostGuardianService-Client/Admin</FirstLogName>

    <FirstExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="UnsignedInteger">1019</Value>

        </ValueExpression>

      </SimpleExpression>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</SecondComputerName>

    <SecondLogName>Microsoft-Windows-HostGuardianService-Client/Operational</SecondLogName>

    <SecondExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="UnsignedInteger">1003</Value>

        </ValueExpression>

      </SimpleExpression>

    </SecondExpression>

  </Configuration>

</UnitMonitor>