Troubleshooting Logon Analyzer Errors in ControlUp

A user was having issues with the Logon Analyzer script, receiving GPO errors and no valid output. Other users suggested checking if auditing was enabled and the number of GPO’s in the environment, while the code was also mentioned as a possible issue. The specific error message "WQL duration processing failed" was also discussed.

Read the entire ‘Troubleshooting Logon Analyzer Errors in ControlUp’ thread below:

Hey all, I’m running the latest version of the Logon Analyzer script but when I run it I get a back of GPO errors and I don’t get any valid output from it. Any ideas why?

You cannot call a method on a null-valued expression.

At C:\windows\system32\config\systemprofile\AppData\Roaming\ControlUp\Scripts\8fa205e1-2bde-483e-8a54-04815abb611c.ps1:4121 char:180

• … ystemTime
• ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  • CategoryInfo : InvalidOperation: (:) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

Thanks!

I this the Analyze Logon Duration script?

Have you enabled auditing as described in here https://support.controlup.com/docs/enable-auditing-for-analyze-logon-duration-script

Yes, this has been done by GPO. When I didn’t have this set, I got errors in the output about auditing not been enabled. I no longer get that since the GPO changes I’ve made based on that article.

@member @member any input

I’ve seen this in environments with over 1000 GPO’s with the query being limited. How many GPO’s are in your environment?

Not that many! I may go for around 50 off the top of my head.

Looking at the code, I’m guessing that it failed to find the end (id 5257) or start (id 4126) events for the GPO downloads from the Microsoft-Windows-GroupPolicy/Operational event log. I have taken an action to improve the error handling around this although it’s the first time I’ve seen this error.

So looking at those logs on my VDI, it has 18189 events in it. If I filter by those two event IDs I’m down to 296. Both IDs are present. I just ran the script against my own session with this and no errors this time. That’s unhelpful!

But I don’t get any logon data either. I see the path based import for DEM and a bunch of warnings (Horizon Profiler Data, async actions for DEM, AppX and SQL

Actually I do get a “WQL duration processing failed = unable to find any relevant events in the event log”. I guess that is why no errors this time!

Continue reading and comment on the thread ‘Troubleshooting Logon Analyzer Errors in ControlUp’.  Not a member? Join Here!