Home
  •  

Guarded Fabric KDS Performance Monitor

Microsoft.Windows.GuardedFabric.10.0.GuardedHost.KDS.Availability (UnitMonitor)

Event based unit monitor for checking if the Guarded Fabric has failed to unwrap a Key Protector

Knowledge Base article:

Summary

A unit monitor for the Guarded Fabric, denoting if the Fabric failed to unwrap a Key Protector.

Causes

This could be related to an attestation failure or a network connectivity issue. Check the event description for more details.

Resolutions

Auto-resolves when the Guarded Fabric succeeds in unwrapping a key protector.

Element properties:

TargetMicrosoft.Windows.GuardedFabric.10.0.ComputerRole.GuardedHost
Parent MonitorSystem.Health.PerformanceState
CategoryAvailabilityHealth
EnabledTrue
Alert GenerateTrue
Alert SeverityMatchMonitorHealth
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.Windows.2SingleEventLog2StateMonitorType
RemotableTrue
AccessibilityPublic
Alert Message
Guarded Host Key Protector Error
Guarded Fabric failed to unwrap a Key Protector for a Guardian.
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.Windows.GuardedFabric.10.0.GuardedHost.KDS.Availability" Accessibility="Public" Enabled="true" Target="HGSDL!Microsoft.Windows.GuardedFabric.10.0.ComputerRole.GuardedHost" ParentMonitorID="Health!System.Health.PerformanceState" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.2SingleEventLog2StateMonitorType" ConfirmDelivery="false">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.GuardedFabric.10.0.GuardedHost.KDS.Availability.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>MatchMonitorHealth</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="FirstEventRaised" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="SecondEventRaised" MonitorTypeStateID="SecondEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</FirstComputerName>

    <FirstLogName>Microsoft-Windows-HostGuardianService-Client/Operational</FirstLogName>

    <FirstExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="UnsignedInteger">2014</Value>

        </ValueExpression>

      </SimpleExpression>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</SecondComputerName>

    <SecondLogName>Microsoft-Windows-HostGuardianService-Client/Operational</SecondLogName>

    <SecondExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="UnsignedInteger">2015</Value>

        </ValueExpression>

      </SimpleExpression>

    </SecondExpression>

  </Configuration>

</UnitMonitor>