Event ID :28005 error filling up Windows Event Logs in RSA NetWitness Endpoint

Issue

Event viewer and SQL error log both show errors indicating 28005 error code. Sample error is below:

Cause

http://www.rebeladmin.com/2016/01/how-to-fix-error-no-mapping-between-account-names-and-security-ids-in-active-directory/

This explains the possible situations this is seen in, such as when the relevant account is used in the GPO policy is removed from Active Directory, or the account name is incorrect within the relevant GPO.

Resolution

This is not an issue with ECAT itself but rather an Active Directory and how it handles errors with account names and security ID's. The article http://www.rebeladmin.com/2016/01/how-to-fix-error-no-mapping-between-account-names-and-security-ids-in-active-directory/ can be used to troubleshoot this issue.

Product Details

RSA Product Set: NetWitness Endpoint
RSA Product/Service Type: NetWitness Endpoint
RSA Version/Condition: 4.4.x
Platform: Windows

Approval Reviewer Queue

KCS Approval queue