Description
The following is a full list of various defined and non-defined Windows Event Logs EventIDs that can be found in the Quickpass Events log. They can be used as a reference point for a specific error code or to create monitoring within your RMM tool.
If a particular EventID error has an associated KB (Knowledge Base) article, it will have a link out to that KB to assist with troubleshooting.
Steps to Open Windows Event Logs on a Windows Machine
- Click on the "Start" button in the bottom-left corner of the screen.
- Type "Event Viewer" in the search bar.
- Click on the "Event Viewer" application from the search results.
- Open Application and Services Logs
- Open the Quickpass Events log
Account Management
| Name | EventID | Associated KB |
| ACCOUNT_ENABLE_SUCCESS | = 1503 | |
| ACCOUNT_ENABLE_FAILED | = 1504 | |
| ACCOUNT_UNLOCK_SUCCESS | = 1505 | |
| ACCOUNT_UNLOCK_FAILED | = 1506 | |
| ACCOUNT_DELETED_NOTIFICATION | = 1507 | |
| ACCOUNT_LOCKED_NOTIFICATION | = 1508 | |
| PASSWORD_RESET_SUCCESS | = 1501 | |
| PASSWORD_RESET_FAILED | = 1502 | |
| PASSWORD_EXPIRATION_NOTIFICATION | = 1509 | |
| PASSWORD_CHANGE_ERROR | = 10010 | |
| UPDATE_SERVICE_ACCOUNT_PASSWORD | = 9997 | |
| INVALID_SERVICE_ACCOUNT | = 9994 | |
| RESTART_SERVICE_ACCOUNT | = 4002 | |
| GET_USERS_FAILED | = 1517 |
Agent Communication
| Name | EventID | Associated KB |
| RESTART_SERVICE | = 1517 | |
| WebSocketOpening | = 6000 | |
| WebSocketSending | = 6001 | |
| WebSocketReading | = 6002 | |
| WebSocketDisconnecting | = 6003 | |
| WebSocketError | = 6010 | |
| Normal | = 789 | |
| SocketIn | = 110 | |
| SocketOut | = 111 | |
| SocketConnection | = 117 | |
| SocketFunction | = 116 | |
| ServiceError | = 1000 | |
| ServiceInfo | = 1022 | |
| DEFAULT_MESSAGING_WAIT_RECONNECT | = 5000 | |
| AGENT_CONNECTION | = 10001 | |
| AGENT_START_UP | = 12000 | |
| SOCKET_SERVER_ERROR | = 11000 | |
| MESSAGE_NOTIFICATION_ERROR | = 5002 |
Agent Updates
| Name | EventID | Associated KB |
| UPDATE_AGENT_CHECK | =5000 | |
| UPDATE_AGENTS | = 9999 | |
| UPDATE_PROCESS | = 5001 | |
| UPDATE_PROCESS_ERROR | = 5002 |
AD or Local Account Communication
| Name | EventID | Associated KB |
| WINDOWS_LOGIN_NOTIFICATION | = 1515 | |
| AD_CONNECT_LAUNCH | = 60001 | |
| AD_CONNECT_LAUNCH_ERROR | = 60002 | |
| POLICIES_UPDATED_NOTIFICATION | = 1510 | |
| PASSWORD_POLICIES_ENFORCED | = 1511 | |
| PASSWORD_POLICIES_ENFORCE_FAILED | = 1512 | |
| PRIVILEGED_GROUP_CHANGED | = 1513 | |
| PASSWORD_CHANGE_DETECTED | = 1514 | |
| PASSWORD_POLICIES_FAILED | = 1516 | |
| DELETE_ACCOUNT_ERROR | = 1112 | |
| SECURITY_GROUP_CHANGE | = 4005 | |
| SAVE_USERS_ERROR | = 1518 | |
| UPDATE_DOMAIN_POLICY_ERROR | = 40092 | |
| WMIError | = 10030 | Link to KB |
Agent Installation/Configuration
| Name | EventID | Associated KB |
| SETUP_QP_UNIQUE_AGENT_ID | = 4005 | |
| READ_CONFIGURATION_FILES_ERROR | = 10020 | |
| LOAD_CONFIGURATION_VALUES_ERROR | = 10021 | |
| PROFILING_ERROR | = 60002 |
JIT (Just-in-time)
| Name | EventID | Associated KB |
| ACCOUNT_CREATE_FAILED | = 1519 |
PLEASE NOTE: There is no EventID for a failed password rotation due to the QP Server Agent's requirement to be ONLINE for it to acknowledge a failed rotation. A failed rotation would be shown in the Events page of the QP dashboard -> View Recent Events and Export All Events – CyberQP (getquickpass.com)
Comments
0 comments
Please sign in to leave a comment.