Could be permissions error.
ossec runs under the system account and "system" should have full
control and read.
use regedit to check permissions on the key.
On 12/03/2010 02:21 PM, dan (ddp) wrote:
On Thu, Dec 2, 2010 at 7:33 PM,<[email protected]> wrote:
Anyone see these errors, from WinXP clients. Just started getting these on a
few devices. Thank You
2010/11/09 12:54:39 ossec-agent(1758): ERROR: Unable to open registry key:
'Software\Microsoft\Windows\CurrentVersion\RunOnceEx'.
2010/11/09 12:56:51 ossec-agent: INFO: Ending syscheck scan.
2010/11/10 07:51:51 ossec-agent: INFO: Starting rootcheck scan.
2010/11/10 07:51:59 ossec-agent: INFO: Ending rootcheck scan.2010/11/10
08:56:59 ossec-agent: INFO: Starting syscheck scan.
2010/11/10 09:06:16 ossec-agent(1758): ERROR: Unable to open registry key:
'Software\Microsoft\Windows\CurrentVersion\RunOnceEx'.
2010/11/10 09:08:27 ossec-agent: INFO: Ending syscheck scan.
I haven't noticed any errors like that. Does the registry key that's
causing the error exist?
--
R. Loyd Darby, OSSIM-OCSE
Project Manager DOC/NOAA/NMFS
Infrastructure coordinator
Southeast Fisheries Science Center
305-361-4297
