IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Local Wincollect 10 - Access denied IIS and Security logs

    Posted Mon July 03, 2023 10:00 AM

    Hello my friends,

    Im getting this error messages on my Windows 10 or Windows server 2012 instances:

    Errors in my Windows 10 or Windows server 2012
    Im trying to get logs from my #IIS Server FTP or W3C and from #Security events. I tried a lot of things like give full privileges to users in order to surpass the problem but getting access denied error.
    Also do you know what user does wincollect uses to recollect the logs? Because not having any problems recollecting logs like Application and System.
    Qradar communication is working fine.
    Thanks in advance.
    Best Regards
    Henry.
     


    ------------------------------
    Henry Alonso Valdivia Barba
    ------------------------------


  • 2.  RE: Local Wincollect 10 - Access denied IIS and Security logs

    Posted Wed July 05, 2023 07:33 AM
    Edited by BrunoMarX Wed July 05, 2023 07:36 AM

    Hello! Yes. I have the same problem and think I will open a support case for this. 

    This is the link to the Wincollect( WinCollect 10.1.4) documentation:

    https://www.ibm.com/docs/en/qradar-common?topic=10-wincollect-virtual-accounts

    It says:

    During the installation I chose the first option:

    Error:

    Using the command line install also didn't work:

    msiexec.exe /qn /i WinCollect-10.X.X-X.x64.msi QUICK_INSTALL="yes" WC_DEST="<qrhostname.domain.lab>" ADMIN_GROUP="true"

    Anyone able to solve this problem?

    Thanks 



    ------------------------------
    BrunoMarX
    ------------------------------

    Original Message


  • 3.  RE: Local Wincollect 10 - Access denied IIS and Security logs

    Posted Wed July 05, 2023 11:11 AM

    I just checked that this problem only happens on domain controllers. The workaround is to fall back to running Wincollect as LocalSystem, which was the reason why IBM introduced virtual accounts in Wincollect in the first place

    https://www.ibm.com/support/pages/node/7004229



    ------------------------------
    BrunoMarX
    ------------------------------

    Original Message


  • 4.  RE: Local Wincollect 10 - Access denied IIS and Security logs

    Posted Wed July 05, 2023 05:44 PM
    Edited by Jonathan Pechta Wed July 05, 2023 05:52 PM

    @Henry Alonso Valdivia Barba

    I think this is related to an issue where non-English languages do not get their virtual accounts set correctly. The root cause here is that Groups do not get the Administrator or Event Log Reader set to allow NT Service\WinCollect as the group names are different, so they fail. This leads to Access Denied (Error Code 5) issues. 

    I just wrote a technical note on this issue today and there is an APAR pending that should be visible tomorrow as well: 

    @Bruno Marx As it appears that your agent is installed on a Windows host and is a DC, you need to set agent to use the Local System. You already found the correct link, but adding a clickable version in case anyone else comes across this discussion. For more info, see 
    WinCollect: 10.1.4 can experience an issue where security events do not forward to Domain Controllers (IJ47086)



    ------------------------------
    Jonathan Pechta
    QRadar Support Content Lead
    Support forums: ibm.biz/qradarforums
    jonathan.pechta1@ibm.com
    ------------------------------

    Original Message


  • 5.  RE: Local Wincollect 10 - Access denied IIS and Security logs

    Posted Thu July 06, 2023 03:39 AM

    Hi @Jonathan Pechta !

    Thank you!

    Thank you for your Technote: https://www.ibm.com/support/pages/node/7009769

    is it really necessary to add "NT Service\Wincollect" To the ADministrators group?

    Here in German:

    NT Service is part only of Event Log Readers (Ereignisprotokollleser). WinCollect can now process security events.

    In Addition to that, I think it is enough if we only add NT Service to Event Log Readers using cmd. It is not necessary to use compmgmt.msc.to add the account to the group. in other words. you either do one(compmgmt.msc.) or the other (CMD) to include the account. 

    Besides: 

    net localgroup "Event Log Readers" /add NT SERVICE\WinCollect

    does not work since you need to add " " to the account

    net localgroup "Event Log Readers" /add NT "SERVICE\WinCollect"

    should work.

    to sum up, on a non-domain controller I need to add the account to the Event Log Readers group manually. it does not need to be part of Administrators for me to process Security Events. So Why should NT Service\Wincollect a local administrator?

    Regards,

    Bruno



    ------------------------------
    BrunoMarX
    ------------------------------

    Original Message


  • 6.  RE: Local Wincollect 10 - Access denied IIS and Security logs

    Posted Thu July 06, 2023 02:14 PM
    Edited by Jonathan Pechta Thu July 06, 2023 02:15 PM

    @BrunoMarX 

    You are correct, I was missing some quotation marks in my procedure and I've updated the tech note. I also added a table of group names for core Windows languages that dev pulled for me to add to the TN. We added this in case some administrators are dealing with Windows OS in multiple languages.

    I talked to dev about the requirements to add NT Service\WinCollect to administrators and why that group permission is required and per dev, the answer is, "If the admin does not have any file-based events that require admin permissions, then they might not need to add WinCollect to the Administrators group. Event Log Readers might collect everything the user needs to collect, but these permission might vary based on collection requirements." 

    I added some text in the article to reflect this for users. The best option here is to start with the Event Log Readers group and add NT Service\WinCollect. If you get events and do not see Error Code 5: Access Denied, then you are likely OK with just Event Log Readers. If you have remote files or files that require additional permissions, then you might need to also add Administrators. 

    New section in tech note: https://www.ibm.com/support/pages/node/7009769 



    ------------------------------
    Jonathan Pechta
    QRadar Support Content Lead
    Support forums: ibm.biz/qradarforums
    jonathan.pechta1@ibm.com
    ------------------------------

    Original Message