Home
  •  

UserPinService: Found users who are already or about to be permanently locked

Microsoft.LS.2015.Monitoring.UnitMonitor.TimerResetEvent.Registrar.UPIN_FOUND_PERMANENTLY_LOCKED_USERS (UnitMonitor)

Knowledge Base article:

Summary

Found users who are already or about to be permanently locked

Causes

The affected users might be using very old pin, or they are under denial of service and spoofing attacks.

Resolutions

Please get in touch with the affected users and ask them to change their pins. Examine server logs to verify that this was not an intentional attack.

Element properties:

TargetMicrosoft.LS.2015.Component.Registrar
Parent MonitorSystem.Health.SecurityState
CategorySecurityHealth
EnabledTrue
Alert GenerateTrue
Alert SeverityError
Alert PriorityNormal
Alert Auto ResolveTrue
Monitor TypeMicrosoft.LS.2015.MonitorType.TimerResetEvent.Simple
RemotableTrue
AccessibilityPublic
Alert Message
[Skype] Found users who are already or about to be permanently locked
{0}

Please see the 'Product Knowledge' and the 'Alert Context' tab on Alert Properties view for more information.
RunAsDefault

Source Code:

<UnitMonitor ID="Microsoft.LS.2015.Monitoring.UnitMonitor.TimerResetEvent.Registrar.UPIN_FOUND_PERMANENTLY_LOCKED_USERS" Accessibility="Public" Enabled="true" Target="Microsoft.LS.2015.Component.Registrar" ParentMonitorID="Health!System.Health.SecurityState" Remotable="true" Priority="Normal" TypeID="Microsoft.LS.2015.MonitorType.TimerResetEvent.Simple" ConfirmDelivery="true">

  <Category>SecurityHealth</Category>

  <AlertSettings AlertMessage="Alert_Found_users_who_are_already_or_about_to_be_permanently_locked">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

    <AlertParameters>

      <AlertParameter1>$Data/Context/EventDescription$</AlertParameter1>

    </AlertParameters>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Microsoft.LS.2015.Monitoring.UnitMonitor.TimerResetEvent.Registrar.UPIN_FOUND_PERMANENTLY_LOCKED_USERS.Timer" MonitorTypeStateID="TimerEventRaised" HealthState="Success"/>

    <OperationalState ID="Microsoft.LS.2015.Monitoring.UnitMonitor.TimerResetEvent.Registrar.UPIN_FOUND_PERMANENTLY_LOCKED_USERS.Error" MonitorTypeStateID="ErrorEventRaised" HealthState="Error"/>

  </OperationalStates>

  <Configuration>

    <ComputerName>$Target/Host/Host/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

    <LogName>Lync Server</LogName>

    <ErrorExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="UnsignedInteger">47066</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery Type="String">PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value Type="String">LS UserPin Service</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </ErrorExpression>

    <AutoResolveInterval>7200</AutoResolveInterval>

  </Configuration>

</UnitMonitor>