cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
MikW
Engaged Sweeper II
Hi,

I have problems seeing EventID 12294 from Security-SPP.
It's for KMS publishing itself to DNS.

It is not from unsupported Applications and Services logs, it's not even there.
It is located in Windows logs > Application.

Log Name: Application
Source:Security-SPP
Event ID: 12294
Level: Information

Is it possible to filter that out in a report?

Select Distinct Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.IPAddress,
tblNtlogSource.Sourcename,
Max(tblNtlog.TimeGenerated) As LastOccurrence,
tblADusers.Displayname,
tblAssets.OScode,
tblNtlogMessage.Message,
tblNtlog.Eventcode
From tblAssets
Inner Join tblNtlog On tblAssets.AssetID = tblNtlog.AssetID
Inner Join tblNtlogSource On tblNtlogSource.SourcenameID =
tblNtlog.SourcenameID
Inner Join tblNtlogMessage On tblNtlogMessage.MessageID = tblNtlog.MessageID
Left Join tblADusers On tblADusers.Username = tblAssets.Username And
tblADusers.Userdomain = tblAssets.Userdomain
Group By tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.IPAddress,
tblNtlogSource.Sourcename,
tblADusers.Displayname,
tblAssets.OScode,
tblNtlogMessage.Message,
tblNtlog.Eventcode
Having tblNtlog.Eventcode In (12294)
Order By LastOccurrence Desc


1 REPLY 1
Esben_D
Lansweeper Employee
Lansweeper Employee
The report itself looks fine. Have you enabled non-error event scanning within Lansweeper? Instructions can be found here: https://www.lansweeper.com/kb/128/scanning-non-error-events.html