Windows Audit Failures on OpsMgr W2K8 system

[korns]

The attached screen shot of event viewer is from a W2k8 server running OpsMgr, Prot/ProvMgr. I see these security audit message coming in every 15 seconds referencing dfmmonitor.exe. They sem to come in pairs (two at about he same time) and about 15 seconds apart. Also, if I click on each and look at the details It appears the "Port ID:" increments with each occurance. The recent ones were port ID: 56609, 56610, then 50745, 50746, then 50747, 50748.

Does anyone know what these events are indicating and if they should be of concern?

[korns]

Just meant to add that this is running OpsMgr v4.0

[sanjyoth]

Hi Korns,

>> Does anyone know what these events are indicating and if they should be  of concern?

     I guess these events are not from Operations manager instead from Microsoft windows server 2K8 itself. You might want to give a visit to this link: <http://msdn.microsoft.com/en-us/library/bb309058(VS.85).aspx> to get to know more about windows filtering platform.

Also you can go through this link to trouble shoot the current 5159 event you are hitting with -> http://support.microsoft.com/kb/969257

Regards

Sanjyoth

[korns]

Thanks Sanjyoth. I think that explains what we're seeing.

Dave