Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 21026 Source: MicrosoftISAreportgenerator

Level
Description
The action to create the scheduled report, "<report job>", with the specified credentials, failed. The error code in the Data area of the event properties indicates the cause.
Data <data>
Comments
 
As per Veritas: "This problem occurs because the message screener is running in the Inetinfo process and is causing a handle leak in the LSAOpenPolicy handle table. The LSAOpenPolicy handle table is hosted by the Lsass.exe process". See the link to "Veritas Support Document ID: 279679" for details on solving this problem.
From Microsoft: "This problem occurs only if ISA Server and the ISA Server SMTP Message Screener (Fltrsnk1.dll) are installed and running on the same computer." For more information see ME816621.
I have had the ISA server running without a problem for several months when suddenly the weekly report started to fail. Daily and Monthly reports are still fine. Only change to system was the installation of GFI Mail Essentials. I removed this and the weekly report is working fine again.
The user id used in the "Credentials" tab of the Report Job Properties must have proper rights.
There have been reports that even when the proper user id and password are used, the reports still fail or the they started to fail after working for a period of time, without changes. From a newsgroup post: "The solution to this is creating the report without entering credentials, just create the report or clean the information about credentials. I do not know why, but it is a solution."
Another post suggested that in some ocasions, the password for the account used in the reporting was changed so the credential information was no longer accurate.


Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net.

Read more...

 

Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.

Read more...