Forum Discussion

imtiyazali73's avatar
imtiyazali73
Copper Contributor
Jul 30, 2020

Microsoft Advanced Threat Analytics Gateway Error

We are getting below highlighted errors in ATA log file "Microsoft.Tri.Gateway". Can someone please help me to understand this?   2020-07-30 04:37:32.4176 7112 49 Error [EventLogException] System....
EliOfek's avatar
EliOfek
Icon for Microsoft rankMicrosoft
Jul 30, 2020

imtiyazali73 
During deployment the Gateway service account sid is registered to get read access to the local security log. most likely the permissions were revoked either by GPO or CustomSD reg key.

  • imtiyazali73's avatar
    imtiyazali73
    Copper Contributor
    Aug 03, 2020
    We don't have such type of GPO.
    How can I fix this
    • EliOfek's avatar
      EliOfek
      Icon for Microsoft rankMicrosoft
      Aug 04, 2020

      imtiyazali73 , you can try to uninstall and reinstall which will set the permissions again.

      Also check for the CustomSD registry key.

      if the issue returns, open a support call, as it can be tricky finding out what causes the permissions to revert.. Many times the customers has GPOs they are not even aware of...