As part of a security Analysis, I have a report that pulls from an analysis that checks for Active RDP sessions on a port that is set in the Windows registry…
The part of the analysis used this
if exists (sockets of network) whose ((local port of it = Value “PortNumber” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” of registry) and (tcp state of it as string = “ESTABLISHED”)) Then “Active” else “Not in use”
I have a Web report that pulls this section from the Analysis
I have a Scheduled event that Generates report on every refresh (currently every 15 seconds) and
Send email/store archive only when report has changed is checked…
So… every so often, I get an email that the report has failed with a class NoSuchActionID and the scheduled event is disabled. I have to re-enable it each time…
Any thoughts?