Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 20227 Source: RasClient

CoID={9EFFB84E-D03E-46B8-9064-9A9891F045E1}: The user <domain name>\<user name> dialed a connection <connection name> which has failed. The error code returned on failure is <error code>.
This event may be recorded if the authentication service of the VPN provider is not functioning properly. During the dialup process, the account fails to authenticate and this event is shown.
In Windows Vista, when you put the computer into standby while it is using a dial-up connection, the computer goes into standby before the dial-up connection can be completely disconnected. Therefore, the disconnection process is complete only after the computer resumes from standby. See ME956502 for additional information about this event.
In my case, this event occurred while trying to establish a VPN connection to a RAS server. I was getting this event twice, the first one with Error code 800 (unable to find the server) and the second with Error code 0 (connection successful - weird, as it was not). The problem was due to my firewall not allowing the correct ports. I had to open TCP 1723, UDP 500, and UDP 4500. This did the trick. Also, the same problem on another computer, I had to disable Filter IDENT (Port 113) on the firewall config in my Linksys router running the Sveasoft firmware.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.