locked
MIM SSPR and Service Event Logs RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Dear Friends

    I have implemented MIM 2016 SP1 at our office and we do not have azure. 

    Please can anyone guide me with how to find events which can answer the query i have from our security team to monitor below points

    • Which user reset or unlock password?
    • Which user failed with wrong answers?
    • Which IP tried to access SSPR Portal ?

    It is ok if we can get even this logs from multiple servers and correlate it

    Thank You

    Wednesday, November 27, 2019 6:54 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    • Which user reset or unlock password?    You can get this from the Search Request Log.
    • Which user failed with wrong answers?   You can get this from the Search Request Log (Status "Failed" or "Denied")
    • Which IP tried to access SSPR Portal ?  For the Portal you can get this from the SSPR Portal iis logs. For the SSPR Client you'll need a Custom Windows Diagnostics Filter to capture the WCF event from the FIMService. We have written a custom filter here to do this (unfortunately I cannot share it).

    Br,

    Leo

    Did my post help? Please use "Mark as answer" or "Propose as answer". Thank you!

    Thursday, November 28, 2019 8:41 AM