Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 8233 Source: Microsoft-Windows-Security-SPP

The rules engine reported a failed VL activation attempt.
AppId = 0ff1ce15-a989-479d-af46-f275c6370663 SkuId = b322da9c-a2e2-4058-9e4e-f59a6970bd69
We have seen this event recorded when a product that requires volume activation has been installed in an environment (i.e. at home) where there is no management for activation (a central Key Management Service or KMS). The SkuId bit should help in identifying the culprit (i.e. SkuId e13ac10e-75d0-4aff-a0cd-764982cf541c belongs to Microsoft Visio 2013 which we identified in that particular case).
Reason: 0x8007232B AppId = 0ff1ce15-a989-479d-af46-f275c6370663, Trigger=TimerEvent - According to ME929826, error 0x8007232B may occur if the computer is unable to locate a KMS server, in many cases due to a DNS failure.
We are a MS shop with volume licensing. This problem arose due to installing MS Office 2013 using the KMS key when there is no Key Server. No idea why it took the KMS key originally. Loaded MAK key seems to have worked.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.