cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

show Event-ID 34857: Client interface logon audit in ePO (Audit, automatic Response)

Jump to solution

HI There,

How is it possible to show the Event-ID 34857: Client interface logon audit in ePO. I can't find it.

in the local logfile

C:\ProgramData\McAfee\Endpoint Security\Logs\EndpointSecurityPlatform_Activity.log

is the entry: MFEConsole |MFEConsole | 26940| 22148|PW |mfeux_extension.cpp(391) | Successful login attempt

but i can't see an Event in ePO

We would like to audit this event.

Thx and regards, Falk

1 Solution

Accepted Solutions
andrep1
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 6 of 6

Re: show Event-ID 34857: Client interface logon audit in ePO (Audit, automatic Response)

Jump to solution

That sounds like the definition of a bug. I would submit an SR to get a fix, as opposed to submitting an idea that might get fixed in the future.

View solution in original post

5 Replies
andrep1
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 6

Re: show Event-ID 34857: Client interface logon audit in ePO (Audit, automatic Response)

Jump to solution

Hello.

Under server settings, even filtering, click edit and verify that agent forwarding of the event if enabled for that event number

Re: show Event-ID 34857: Client interface logon audit in ePO (Audit, automatic Response)

Jump to solution

Hi,

yes, there is no Event Filtering. So, thats not the problem.

I know, it's an Informational Event. So I set in the ENS Common - Option Policy to log all Events for all products, but there is no field for the common product itself.

I tested it with false passwords to, but theres is no event too and in the Query: 

Endpoint Security: Client Interface Logon Audit Log

there is no result

andrep1
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 6

Re: show Event-ID 34857: Client interface logon audit in ePO (Audit, automatic Response)

Jump to solution

So then it looks like that is a bug and you would have to open up a SR with McAfee

Re: show Event-ID 34857: Client interface logon audit in ePO (Audit, automatic Response)

Jump to solution

Ok, i found it, but...

...you have to enable the checkbox for "Enable client interface lockout" in the common option policy.

The Event 34857 is then in the ePO, but it is only triggert if you take a false password. The right password dont trigger the event.

So it is no audit 🙂 

I think its time for an Idea 😞

andrep1
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 6 of 6

Re: show Event-ID 34857: Client interface logon audit in ePO (Audit, automatic Response)

Jump to solution

That sounds like the definition of a bug. I would submit an SR to get a fix, as opposed to submitting an idea that might get fixed in the future.

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community