none
MIM SSPR and Service Event Logs RRS feed

  • Question

  • Dear Friends

    I have implemented MIM 2016 SP1 at our office and we do not have azure. 

    Please can anyone guide me with how to find events which can answer the query i have from our security team to monitor below points

    • Which user reset or unlock password?
    • Which user failed with wrong answers?
    • Which IP tried to access SSPR Portal ?

    It is ok if we can get even this logs from multiple servers and correlate it

    Thank You

    Wednesday, November 27, 2019 6:54 PM

All replies

  • Hi,

    • Which user reset or unlock password?    You can get this from the Search Request Log.
    • Which user failed with wrong answers?   You can get this from the Search Request Log (Status "Failed" or "Denied")
    • Which IP tried to access SSPR Portal ?  For the Portal you can get this from the SSPR Portal iis logs. For the SSPR Client you'll need a Custom Windows Diagnostics Filter to capture the WCF event from the FIMService. We have written a custom filter here to do this (unfortunately I cannot share it).

    Br,

    Leo


    Did my post help? Please use "Mark as answer" or "Propose as answer". Thank you!

    Thursday, November 28, 2019 8:41 AM