Windows 10: Multiple VMs using the same Endpoint Manager device record

Hi there, I've got a situation where 3 VMware VMs of Windows10 are using the same device record in Endpoint Manager. The 2nd and 3rd VMs were duplicates of the original so I'm assuming that's how it ended up this way. If I search for the devices using their computer names I can only find one listed in Endpoint Manager, and under the device compliance section for this device it shows user logins and configs that apply to users that have only ever logged into one of the other VMs and never this one. So somehow all the 3 VMs are reporting back to this one Endpoint device record. Does anyone have

:)

 

Account failed logon 4625 on VM guest when clicking the entry of VM guest on failover cluster Manager on VM Host

Issue:

We found a multiple failed logon events on VM guest (evert ID 4625) with account (the account you logon on VM host) when we clicking the entry of VM guest on failover cluster manager console on VM host with Integration servers (Data Exchange) is enabled.



How to reproduce:

1. Check the “Data Exchange” is enabled on a VM guest (Enabled by default, right?)
2. Open Failover Cluster Manager Console on VM host.
3. Click the VM guest entry
4. Then you may found multiple failed logon events on that VM guest.

Reference:

https://docs.microsoft.com/en-us/vi...on-services#hyper-v-data-exchange-service-kvp



Question:

1. Does the multiple failed logons are normal or necessary?
2. If the failed logons are normal and necessary to be happened and the “Data exchange” function is good to be enabled to gather data from VM guest, any recommendation for us to correct or avoid these failed logon?

Please advise.



Constrain:

We have no chance to use same account and password on VM hosts and VM guests (because all account are managed by password management) and the Audit Policy of Audit Credential Validation must be enabled.

 

Recording Devices

Hi,

Thank you for contacting Microsoft Community.

We regret the inconvenience caused to you.



A Code 10 error is generated in Device Manager in one of the following situations:

• Device Manager can't start the device.
• One of the drivers that the device needs does not start.
• Device Manager has insufficient information to recognize the error that is bubbled up by the device driver.

Let us try the following steps, and check if it helps.

Step 1: Hardware and Devices Troubleshooter.

I suggest you to run hardware and devices troubleshooter and check.

• • Type troubleshooting in the search box on taskbar.
    
  • Click on Troubleshooting in the search results.
  • Click on Hardware and Sound and select Hardware and Devices and click on
    Next to run the troubleshooter.

Step 2: Update the driver.

• Press Windows key + X, and select
  Device Manager.
• In Device Manager, click the Driver tab in the device's
  Properties dialog box.
• Click Update Driver to start the Hardware Update Wizard.
  
• Follow the instructions to update the driver.

Hope it helps.



Let us know the status, we are glad to assist you further.

 

SIEM Integration With Microsoft Endpoint Configuration Manager

Hi,



Thank you for writing to Microsoft Community Forums.



We understand the concern as you want to know whether
it’s possible to forward antivirus logs in Microsoft Endpoint Configuration Manager to a SIEM.



In this case we would suggest you to refer these articles:

Configure
Endpoint Protection

Microsoft Endpoint Configuration Manager documentation



However, for concern/queries related to Microsoft Endpoint Configuration, let me help to point you in the right direction. I would suggest you to post your query in
TechNet Forums where you will find professionals
with expertise on Microsoft Endpoint Configuration
and that would be the appropriate forum



Regards,



Aditya Roy

Microsoft Community – Moderator