RRAS Audits

Applies To: Windows Server 2008

The Routing and Remote Access service has determined that RRAS audits generated an audit entry when a system event was executed successfully. These events confirm successful Routing and Remote Access operations.

Events

Event ID	Source	Message
20015	RemoteAccess	The user: %1 has connected and has been successfully authenticated on port: %2.
20048	RemoteAccess	The user: %1 connected on port: %2 on: %3 at: %4 and disconnected on: %5 at: %6. The user was active for: %7 minutes, %8 seconds. %9 bytes were sent and %10 bytes were received. The port speed was: %11. The reason for disconnecting was: %12.
20064	RemoteAccess	The user: %1 on port: %2 was called back at the number: %3.
20088	RemoteAccess	The remote access server acquired IP address: %1
20139	RemoteAccess	The port: %1 has been disconnected due to inactivity.
20140	RemoteAccess	The port: %1 has been disconnected because the user reached the maximum connect time allowed by the administrator.
20141	RemoteAccess	The user: %1 has connected and has been successfully authenticated on port: %2. Data sent and received over this link is encrypted.
20142	RemoteAccess	The user: %1 has connected and has been successfully authenticated on port: %2. Data sent and received over this link is strongly encrypted.
20158	RemoteAccess	The user: %1 has successfully established a connection to: %2 using the device: %3.
20159	RemoteAccess	The connection to: %1 made by user: %2 using device: %3 was disconnected.
20161	RemoteAccess	The user: %1 successfully established a connection to: %2 using the device: %3. This connection happened automatically because the bandwidth utilization was high.
20162	RemoteAccess	The remote access server established a connection to: %1 for the user: %2 using the device: %3. This connection happened automatically because the bandwidth utilization was high.
20163	RemoteAccess	The connection to: %1 made by user: %2 using device: %3 was disconnected. This disconnection happened automatically because the bandwidth utilization was low.
20164	RemoteAccess	A link in the connection to: %1 made by user: %2 should be disconnected. The bandwidth utilization is too low.
20186	RemoteAccess	Interface: %1 is now reachable.
20190	RemoteAccess	Because no certificate has been configured for clients dialing in with EAP-TLS, a default certificate is being sent to user: %1. Go to the user's remote access policy and configure the Extensible Authentication Protocol (EAP).
20194	RemoteAccess	The user: %1 connected on port: %2 on: %3 at: %4 and disconnected on: %5 at: %6. The user was active for: %7 minutes %8 seconds. %9 bytes were sent and %10 bytes were received. The reason for disconnecting was: %11.
20200	RemoteAccess	The user: %1 connected on port: %2 has been assigned address: %3
20201	RemoteAccess	The user with IP address: %1 has disconnected.
20250	RemoteAccess	The user: %1 has connected and has been successfully authenticated on port: %2.
20251	RemoteAccess	The user: %1 connected on port: %2 on: %3 at: %4 and disconnected on: %5 at: %6. The user was active for: %7 minutes, %8 seconds. %9 bytes were sent and %10 bytes were received. The port speed was: %11. The reason for disconnecting was: %12.
20254	RemoteAccess	The user: %1 on port: %2 was called back at the number: %3.
20263	RemoteAccess	The port: %1 has been disconnected due to inactivity.
20264	RemoteAccess	The port: %1 has been disconnected because the user reached the maximum connect time allowed by the administrator.
20265	RemoteAccess	The user: %1 has connected and has been successfully authenticated on port: %2. Data sent and received over this link is encrypted.
20266	RemoteAccess	The user: %1 has connected and has been successfully authenticated on port: %2. Data sent and received over this link is strongly encrypted.
20267	RemoteAccess	The user: %1 has successfully established a connection to: %2 using the device: %3.
20268	RemoteAccess	The connection to: %1 made by user: %2 using device: %3 was disconnected.
20272	RemoteAccess	The user: %1 connected on port: %2 on: %3 at: %4 and disconnected on: %5 at: %6. The user was active for: %7 minutes %8 seconds. %9 bytes were sent and %10 bytes were received. The reason for disconnecting was: %11.
20274	RemoteAccess	The user: %1 connected on port: %2 has been assigned address: %3
20275	RemoteAccess	The user with IP address: %1 has disconnected.

Related Management Information

RRAS Server

Routing and Remote Access Service Infrastructure