The RDP check's conversation is defined in the "protocols.cfg" file. If you do a packet trace on a "normal" RDP connection to a NLA-enabled server, then you can extract the relevant strings and replace the ones in protocols.cfg. Although, probably better to define a new protocol, perhaps called "rdpnla".

On 6 February 2013 10:24, David Hay-Currie <dhaycurrie at leisurefitness.com>wrote:

I had to rebuild my xymon server. I had it running well for years, but it needed a nice upgrade and I did this a couple of months ago. However a lot of the custom configuration I don’t remember and I can’t find in google.** **

A lot of my rdp checks are getting Unexpected service response. I think most likely is because they have NLA (Network Level Authentication) selected.****

Is there a way to check without changing that setting? Most of my servers do not require access to other users so I don’t want to lower the setting. Maybe the setting needs to be updated?****

---

*David Hay-Currie*****

*IT Manager*****

*Leisure Fitness Equipment LLC*****

*231 Executive Dr. Suite 15*****

*Newark, DE 19702*****

*Phone: (302) 224-5018*****

[image: Leisure Fitness Logo]<http://www.leisurefitness.com/?referrer=dhaycurrie>

---

---

---

---

Xymon mailing list Xymon at xymon.com http://lists.xymon.com/mailman/listinfo/xymon