Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

CSA - Winlogon.exe causes rule 699 to fire

I am seeing the following message: "The process 'C:\Windows\system32\winlogon.exe (as user NT Authority\System) attempted to modify a Cisco Service Agent resource Cisco process c:\Program Files\Cisco Systems\CSAgent\bin\leventmgr.exe. The Operation was denied." This firing rule was 699. I have also attached a screenshot of the firing rule details. Has anyone seen this before or have any ideas?

The alert is comming from the agent running on the MC, which appears to have been disabled.

1 REPLY
Blue

Re: CSA - Winlogon.exe causes rule 699 to fire

My 5.2.210 MC had 4 of these messages.

They appeared to occur when I was connected via a terminal session and generated rules.

I haven't had any since I upgraded to 5.2.225.

Tom

221
Views
0
Helpful
1
Replies
CreatePlease login to create content