Event ID - 19

Event Id19
SourceMicrosoft-Windows-OnlineResponderWebProxy
DescriptionThe Online Responder ISAPI extension was stopped.
Event InformationAccording to Microsoft :
Cause :
This event is logged when the Online Responder ISAPI extension was stopped.
Resolution :
Restart the Online Responder
To address and resolve this event log message:
Confirm that the Online Responder service was stopped for a valid reason, such as by an administrator who needed to preform diagnostics on the server, or that it has been restarted. If the Online Responder was stopped intentionally, then this message should be treated as informational.
Otherwise, restart the Online Responder service and see whether the problem reoccurs.
If the problem reoccurs, enable CryptoAPI 2.0 diagnostics
To perform these procedures, you must have membership in local Administrators, or you must have been delegated the appropriate authority.
Restart the Online Responder service
To restart the Online Responder service:
1.On the computer hosting the Online Responder, click Start, point to Administrative Tools, and click Services.
2.Select the Online Responder Service.
3.Confirm that the Online Responder service is not running, and then click Restart.
4.If the service does not start, restart the computer, then try to restart the Online Responder service again.
5.If the problem is not resolved, you can use the procedure Enable CryptoAPI 2.0 Diagnostics to compile information that will be useful if you need to contact Microsoft Customer Service and Support.
Enable CryptoAPI 2.0 Diagnostics
To enable CryptoAPI 2.0 Diagnostics:
1.On the computer hosting the Online Responder, click Start, point to Administrative Tools, and click Event Viewer.
2.In the console tree, expand Event Viewer, Applications and Services Logs, Microsoft, Windows, and CAPI2.
3.Right-click Operational, and click Enable Log.
4.Click Start, point to Administrative Tools, and click Services.
5.Right-click Online Responder Service, and click Restart.
Verify
An Online Responder serves as an intermediary between clients that need to check certificate validity and a certification authority (CA) that issues certificates and certificate revocation lists (CRLs). To verify that the Online Responder service is functioning properly, you need to isolate the Online Responder and client from the CA and any CRL distribution points to confirm that revocation checking continues to take place and that revocation data is originating only from the Online Responder. The best way to confirm this scenario is to complete the following steps that involve the CA, the client, CRL distribution points, and the Online Responder:
Issue new certificates.
Revoke a certificate.
Publish a CRL.
Remove CRL distribution point extensions from the issuing CA.
Confirm that client computers can still obtain revocation data.
To perform these procedures, you must be a member of local Administrators on the computer hosting the Online Responder and on the client computer, and you must have Manage CA permissions on the computer hosting the CA, or you must have been delegated the appropriate authority.
Issue new certificates
To issue new certificates:
1.On the computer hosting the CA, click Start, point to Administrative Tools, and then click Certification Authority.
2.Configure several certificate templates to autoenroll certificates for a computer running Windows Vista or Windows XP Professional.
3.When information about the new certificates has been published to Active Directory domain controllers, open a command prompt window on the client computer and enter the following command to start certificate autoenrollment: certutil -pulse.
4.On the client computer, use the Certificates snap-in to confirm that the certificates have been issued to the user and to the computer, as appropriate. If they have not been issued, repeat step 2. You can also stop and restart the client computer to initiate certificate autoenrollment.
Revoke a certificate
To revoke a certificate:
1.On the computer hosting the CA, click Start, point to Administrative Tools, and then click Certification Authority.
2.In the console tree, click Issued Certificates, and then select the certificate you want to revoke.
3.On the Action menu, point to All Tasks, and then click Revoke Certificate.
4.Select the reason for revoking the certificate, and click Yes
Publish a CRL
To publish a CRL:
1.On the computer hosting the CA, click Start, point to Administrative Tools, and then click Certification Authority.
2.In the console tree, click Revoked Certificates.
3.On the Action menu, point to All Tasks, and then click Publish.
Remove all CRL distribution point extensions from the issuing CA
To remove all CRL distribution point extensions from the issuing CA:
1.On the computer hosting the CA, click Start, point to Administrative Tools, and then click Certification Authority.
2.Select the CA.
3.On the Action menu, click Properties.
4.On the Extensions tab, confirm that Select extension is set to CRL Distribution Point (CDP).
5.Click any CRL distribution points that are listed, click Remove, and click OK.
6.Stop and restart the CA.
7.Configure a new certificate template, and complete autoenrollment again.
Confirm that client computers can obtain revocation data
To confirm that client computers can obtain revocation data:
1.Click Startmmc, and then press ENTER.
2.If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
3.On the File menu, click Add/Remove Snap-in, click Certificates, and then click Add.
4.Select the user or computer account to whom the certificate was issued, click Finish, and then click OK.
5.Open the Personal Certificates store, right-click the most recently issued certificate, point to All Tasks, and then click Export to start the Certificate Export Wizard. Export the certificate to a .cer file.
6.Open a command prompt window.
7.Type certutil -url and press ENTER.
8.In the Verify and Retrieve dialog box that appears, click From CDP and From OCSP, and confirm that the revocation data is retrieved from the Online Responder and not from a CRL distribution point
Reference LinksEvent ID 19 from Source Microsoft-Windows-OnlineResponderWebProxy

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.