To resolve any issues that occur while auditing ensure the following checkpoints are set up right:
Resolving the RPC Server Unavailable error for Real Time or Schedule modes of event collection
- Ping the print server using the flat name and the fully qualified domain name from the ADAudit Plus-installed server. If the ping is unsuccessful, add DNS suffix entries in the ADAudit Plus server.
- Ensure that all ports required for Windows log collection specified in the port guide are open for ADAudit Plus to run.
- From the ADAudit Plus-installed server, connect to the printer server's Event Viewer using the credentials in the Domain Settings page. Then go to Application and Services Logs > Microsoft > Windows > PrintService > Operational. Ensure that the Operational log is accessible.
Resolving the RPC Server Unavailable error for Print Listener mode
- Ensure that the Print Spooler Service is running on both the print server and the ADAudit Plus-installed server.
- Ensure that print jobs are generated in the print queue. Generate a test print task for a configured server. Then, in the ADAudit Plus-installed server, go to Settings > Printers and Scanners. Select the name of a configured printer and click Open queue. The print job must be visible here. Then check if an event log (Event ID 307) has been generated for this test print job. Open the Event Viewer of the print server and go to Application and Services Logs > Microsoft > Windows > PrintService > Operational.
- Ensure that all ports required for Windows logs collection are open for ADAudit Plus to run.
Resolving the Access Denied error
Resolve the Access Denied error by adding the ADAudit Plus service or user account to the Event Log Readers group of the print server.
