topic Re: Identity Awareness "domain name not configured" -> nt-autoritÄt in Firewall and Security Management

Identity Awareness "domain name not configured" -> nt-autoritÄt

SWBW_Florian — Mon, 08 Apr 2024 09:12:34 GMT

Hi there,

we receive several warnings a week regarding the identity awareness blade on our Checkpoint NGFW.

Were using the identity collector so identity awareness is active and working very fine so far. Those warnings are more "cosmetic" than a real problem.

Its about the windows system domain "nt-autoritÄt" (in englisch nt-authority)

Its not configured because its system internal.

The warning looks like this:

Failed to get users groups for the domain.
Verify that this domain name is configured in your LDAP Account Unit.
Domain: nt-autoritÄt
Source: ServerIP Adress
Action: Failed Login
Blade: I A
Session ID: XXXX
Authentication Method: Machine Identity Propagation

Is there any way to "hide" those warnings? or just to "fakeconfigure" this? Actually each Windows Server Domain should have these "issues". how to get rid of it?

We are using 2 nodes in the cluster. i noticed that those warnings only are thrown out through node2

Thanks in Advance

Florian

Re: Identity Awareness "domain name not configured" -> nt-autoritÄt

G_W_Albrecht — Mon, 08 Apr 2024 08:57:37 GMT

Is it impossible to delete the domain from Collector or from the Query Pool ?

Re: Identity Awareness "domain name not configured" -> nt-autoritÄt

SWBW_Florian — Mon, 08 Apr 2024 09:02:01 GMT

i cant find any way to do this. can you point me there?

At least for the query Pool: There is only our active domain configured. nothing else.

Re: Identity Awareness "domain name not configured" -> nt-autoritÄt

SWBW_Florian — Mon, 08 Apr 2024 09:35:53 GMT

i found and configured a "filter" at the identity collectors. i chosed "domain", "exclude" and pasted nt-autoritÄt in there

maybe thats it? I will observe this

Re: Identity Awareness "domain name not configured" -> nt-autoritÄt

G_W_Albrecht — Mon, 08 Apr 2024 11:41:57 GMT

That should work. I did not mention the filters...

Re: Identity Awareness "domain name not configured" -> nt-autoritÄt

SWBW_Florian — Mon, 08 Apr 2024 11:49:20 GMT

it doesnt. i still have errors since i activated that filter

Re: Identity Awareness "domain name not configured" -> nt-autoritÄt

G_W_Albrecht — Mon, 08 Apr 2024 12:39:56 GMT

Sorry, i can see nothing relevant in the screenshot - better contact CP TAC !

Re: Identity Awareness "domain name not configured" -> nt-autoritÄt

RayP — Wed, 19 Feb 2025 14:56:03 GMT

Hi Florian, how did you solve this problem?