Troubleshooting tips

    Last updated on:

    In this page

    Overview

    This page provides details troubleshooting during compliance and risk posture checks in ManageEngine Log360 and EventLog Analyzer. It specifically addresses the resolution of the “Unable to Verify” status for Active Directory and SQL Server, the “No SQL Server(s) Configured” issue in the Edit Compliance module, and provides guidance for ensuring proper configuration and access for accurate compliance reporting.

    Active Directory

    Active Directory is applicable only for Log360
    1. Status shows “Unable to Verify”
      2. Active Directory
      Figure 1: Unable to verify status in Active Directory

    Possible causes:

    Insufficient domain details

    This occurs when domain details or credentials are not synced properly during integration with child components.

    Troubleshooting steps:

    1. Navigate to Settings tab and under Integrations, select Log360 integration
      2. Active Directory
      Figure 2: Navigating to Log360 Integration
    2. Ensure at least one child component is integrated and at least one domain is configured.
    3. Click Sync Now in the top right corner.
      4. Active Directory
      Figure 3: Syncing changes
    4. Navigate to the Compliance tab and go to the respective compliance/risk posture.
      5. Active Directory
      Figure 4: Navigating to Compliance tab
    5. Click Run Now.
      6. Active Directory
      Figure 5: Running analysis

    Access denied for SYSVOL folder

    This occurs when the Log360 installed machine cannot access the SYSVOL folder (C:\Windows\SYSVOL\sysvol) of the domain controllers due to Microsoft restrictions introduced after 2015.

    Active Directory
    Figure 6: Access denied for SYSVOL folder

    Troubleshooting steps:

    Using Group Policy Object (GPO)

    NOTE Ensure that the GPO is applied in the domain where the product console is installed.
    1. On the domain controller, go to:

      Computer Configuration → Administrative Templates → Network → Network Provider

      Active Directory
      Figure 7: Navigating to Network Provider
    2. Enable Hardened UNC Paths.
      Active Directory
      Figure 8: Enabling Hardened UNC Paths
    3. In Options, click Show:
      • Value Name: \\*\SYSVOL
      • Value: RequireMutualAuthentication=0,RequireIntegrity=0,RequirePrivacy=0
      Active Directory
      Figure 9: Modifying value and value name
    4. For immediate results, open Command Prompt as administrator and run:gpupdate /force on the machine where the product console is installed.
    5. Click OK.

    Using Local Security Policy Editor

    1. Run gpedit.msc on the machine where the product is installed.
      Active Directory
      Figure 10: Running gpedit.msc command
    2. Navigate to Computer Configuration → Administrative Templates → Network → Network Provider
      Active Directory
      Figure 11: Navigating to Network Provider
    3. Enable Hardened UNC Paths.
      Active Directory
      Figure 12: Enabling Hardened UNC Paths
    4. In Options, click Show:
      • Value Name: \\*\SYSVOL
      • Value: RequireMutualAuthentication=0,RequireIntegrity=0,RequirePrivacy=0
      Active Directory
      Figure 13: Modifying value and value name
    5. Click OK.

    Using Command Prompt

    1. Run the following as Administrator on the machine where the product is installed:
      %COMSPEC% /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths /v "\\*\SYSVOL" /d "RequireMutualAuthentication=0" /t REG_SZ
    2. After applying for changes, go to the Compliance tab.
    3. Under Risk Posture, select Active Directory and click Run Now.

    SQL Server

    1. Status shows “Unable to Verify”
    Active Directory
    Figure 14: Unable to verify status in SQL server

    Possible causes:

    SQL Server down

    The analysis requires the SQL server to be up and running.

    Troubleshooting steps:

    • Verify that the selected SQL server(s) is online and accessible.

    Insufficient server details/user credentials

    SQL server configuration details and credentials must be valid. The configured user requires the sysadmin role for all rules to succeed.

    Troubleshooting steps:

    1. Update credentials and server details in the product console.
    2. Go to Settings tab and under Log Source Configuration, select Database Audit.
    3. Ensure correct credentials are provided.
    4. Refer to this help document for more details.

    Resolving "SQL Server(s) not Configured" in Edit Compliance

    Active Directory
    Figure 15: Resolving "SQL Server(s) not Configured" in Edit Compliance

    Possible causes:

    • SQL server(s) not configured
    • Advanced auditing not enabled for the SQL server

    SQL server(s) not configured

    To configure Microsoft SQL DB, refer to this help document.

    Advanced auditing not enabled

    To enable advanced auditing in SQL Server, refer to this help document.

    Read also:

    This page explained how to troubleshoot the “Unable to Verify” status for Active Directory and SQL Server, and how to resolve the “No SQL Server(s) Configured” issue in Edit Compliance.