Home
  •  

Ensure that the required permissions are granted to the Core registry key

Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.509.515.517 (Rule)

Knowledge Base article:

Resolutions

To resolve this issue, ensure that the required permissions are granted to the Core registry key.

To perform this procedure, you must have membership in the local Administrators group, or you must have been delegated the appropriate authority.

Caution:  Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.

To grant the required permissions to the Core registry key:

Element properties:

TargetMicrosoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway
CategoryEventCollection
EnabledTrue
Event SourceMicrosoft-Windows-TerminalServices-Gateway
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
RemotableTrue
Alert Message
Ensure that the required permissions are granted to the Core registry key
{0}
Event LogMicrosoft-Windows-TerminalServices-Gateway/Admin

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
Alert WriteAction System.Health.GenerateAlert Default

Source Code:

<Rule ID="Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.509.515.517" Enabled="onStandardMonitoring" Target="Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Microsoft-Windows-TerminalServices-Gateway/Admin</LogName>

      <Expression>

        <And>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>MatchesRegularExpression</Operator>

              <Pattern>^(509|515|517)$</Pattern>

            </RegExExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-Windows-TerminalServices-Gateway</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="Alert" TypeID="SystemHealth!System.Health.GenerateAlert">

      <Priority>1</Priority>

      <Severity>2</Severity>

      <AlertName/>

      <AlertDescription/>

      <AlertOwner/>

      <AlertMessageId>$MPElement[Name="Microsoft.Windows.Server.2008.TerminalServicesRole.Service.TSGateway.EventCollection.509.515.517.AlertMessage"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

      </Suppression>

      <Custom1/>

      <Custom2/>

      <Custom3/>

      <Custom4/>

      <Custom5/>

      <Custom6/>

      <Custom7/>

      <Custom8/>

      <Custom9/>

      <Custom10/>

    </WriteAction>

  </WriteActions>

</Rule>