Collection Rule for event with source OnlineResponderWebProxy and ID 19 Rule

  • ID:  Microsoft.Windows.CertificateServices.CARole.6.3.OCSPEvents.WebProxy.19
  • Description:  The Online Responder web proxy was stopped.
  • Target:  Certificate Service (2012 R2)
  • Enabled:  On Essential Monitoring

Run As Profiles

Name
Default

Rule Knowledgebase

Summary

The status and functioning of the Microsoft Online Responder service has dependencies on numerous features and components, including the ability to access timely certificate revocation data, the validity of the certification authority (CA) certificate and chain, and overall system response and availability.

Causes
This rule does not contain any causes.
Resolutions

Restart the Online Responder

To address and resolve this event log message:

  • Confirm that the Online Responder service was stopped for a valid reason, such as by an administrator who needed to preform diagnostics on the server, or that it has been restarted. If the Online Responder was stopped intentionally, then this message should be treated as informational. 

  • Otherwise, restart the Online Responder service and see whether the problem reoccurs.

  • If the problem reoccurs, enable CryptoAPI 2.0 diagnostics

To perform these procedures, you must have membership in local Administrators, or you must have been delegated the appropriate authority.

Restart the Online Responder service

To restart the Online Responder service:

  • On the computer hosting the Online Responder, click Start, point to Administrative Tools, and click Services.

  • Select the Online Responder Service.

  • Confirm that the Online Responder service is not running, and then click Restart.

  • If the service does not start, restart the computer, then try to restart the Online Responder service again.

  • If the problem is not resolved, you can use the procedure Enable CryptoAPI 2.0 Diagnostics to compile information that will be useful if you need to contact Microsoft Customer Service and Support.

Enable CryptoAPI 2.0 Diagnostics

To enable CryptoAPI 2.0 Diagnostics:

  • On the computer hosting the Online Responder, click Start, point to Administrative Tools, and click Event Viewer.

  • In the console tree, expand Event Viewer, Applications and Services Logs, Microsoft, Windows, and CAPI2.

  • Right-click Operational, and click Enable Log.

  • Click Start, point to Administrative Tools, and click Services.

  • Right-click Online Responder Service, and click Restart.

External References
This rule does not contain any external references.

See Also for Active Directory Certificate Services Management Pack


Downloads for Active Directory Certificate Services Management Pack

AZURE OPTIMIZATION ASSESSMENT GET STARTED
MIGRATION TO AZURE GET STARTED
SYSTEM CENTER MIGRATION TO AZURE GET STARTED
MIGRATION TO AZURE FOR SQL AND WINDOWS 2008 GET STARTED