If you are having issues performing User Discovery this article will go through some common troubleshooting steps to help resolve those issues.
Testing User Discovery Using the Command Line.
To test access for reading the event log on a remote computer needed for the user login discovery, you can try running the following command:
wevtutil qe Security /q:Event/System[EventID=4624] /c:10 /r:<ip-address> /u:<user-name>
Error Codes
After running the commands you may get one of the following common error codes:
Error Message | Likely Cause | Resolution Steps |
The RPC server is unavailable | The traffic to the server is being blocked - likely by a firewall rule | Check the required ports in the Firewall Rules section |
Access is denied
Error Code: 0x80070005 | Remote access permissions | Either an incorrect user name or password, or the user doesn't have remote access through DCOM. See Required Permissions section |
Access is denied
Error Code: 0x80041003 | WMI Permissions | The user managed to log in and access the server remotely, but does not have access to perform the WMI queries. See Required Permissions section |