Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.
[11408:11008] len=208 B64BlobReq=<string>; status=87:0x57: The parameter is incorrect.
|English: Request a translation of the event description in plain English.|
The 1306 is a known issue with the IE browser, which may cause an unexpected re-authentication pop-up request on the client when configured for NTLM proxy auth. If you have this problem, you might see error codes 1304, 1305, or 1306. The issue and a possible workaround for IE is described in the Microsoft article ME312176.
Event ID 1306 is sometimes an indicator that a user supplied a bad username, bad password, combination of the two, or even just no username or password. We see this a lot when automated programs (virus updaters, toolbars, spyware programs, etc.) do not support authentication.
There are 2 ways to address this:
1) Find the offending programs and either bypass authentication for them or disable/upgrade them so the authentication does not pose a problem.
2) Turn down authentication failures in the BCAAA ini file.
If number 2 above sounds like something you want to do, browse to the BCAAA folder on the domain controller/member server where it is installed. Typically, it is located at "C:\Program Files\Blue Coat Systems\BCAAA". There, search for a file called “bcaaa.ini”. Look for the EventLogMask section. The default value is 1, but you can change it to 0 so only errors are recorded and not authentication failures.
For additional information read “BlueCoat SGOS 2.1 Release Notes”.
|Private comment: Subscribers only. See example of private comment|
|Links: ME312176, BlueCoat SGOS 2.1 Release Notes|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated