How to provide detailed QuarantineSystemHealthResult's for audit events

hi!

i've written shv , sha component based on sdk code.

everything working find, on server side no detailed error information included in audit events (e.g. event 6278).
in "quarantine information" resultcodes provided shv logged, no detailed text windows shv:

network policy server granted full access user because host met defined health policy.    ...........
quarantine information:  	result:				full access  	extended-result:			-  	session identifier:			{d8927b8a-43c4-4552-8de4-842b1017bdf7} - 2014-01-23 08:43:29.951z  	help url:			-  	system health validator result(s):	  health validator  	1  	patchlevel  	compliant  	no data  	none[]  	(0x0 - )  	(0x0 - )  	(0x0 - )  	(0x0 - )  	(0x0 - )  	(0x0 - )  health validator  	3  	my client healthy wlan  	noncompliant  	no data  	none[]  	(0x0 - )  	(0xc0ff0002 - )  	(0x0 - )  	(0x0 - )  	(0x0 - )  	(0x0 - )  windows security health validator  	2  	firewall  	compliant  	no data  	none[]  	(0x0 - )  	(0x0 - )  	(0x0 - )  	(0x0 - )  	(0x0 - )  	(0x0 - )  	(0x0 - )  	(0x0 - )  windows security health validator  	3  	snice client healthy wlan  	noncompliant  	no data  	none[]  	(0x0 - )  	(0xc0ff0047 - third-party system health component not enabled. ..)  	(0x0 - )  	(0xc0ff0001 - system health component not enabled. ..)  	(0xc0ff0004 - signatures particular system health component not date...)  	(0x0 - )  	(0x0 - )  	(0x0 - )  

i've implemented , registered inapcomponentinfo interface shv, can see calls getfriendlyname, getdescription, ... , getlocalizedstring while using nap mmc, converterrorcodetomessageid() never called!

what right way provide information logged !

thanks

franz

finally i've opened incident microsoft support.

here our findings:

based on secure implementation of ias service it's important specify less priviledged account module hosting inapcomponentinfo interface. (ias specifies the eoac_disable_aaa flag @ coinitializesecurity() in parameter dwcapabilities, see http://msdn.microsoft.com/en-us/library/cc226853.aspx )

in sdk sample there's implementation sha (client) side interface (see componentinfo.rgs).

to implement interface shv (server) side need add account during registration:

hkcr { ......  noremove appid  {      forceremove {<your appid>} = s 'componentinfo class'      {          val dllsurrogate = s ''          val runas = s 'nt authority\networkservice'      }   } }

-franz

Windows Server  >  Network Access Protection