topic Both AD Query and Identity Collector in Firewall and Security Management

Both AD Query and Identity Collector

Padre__ — Mon, 11 Nov 2024 09:00:38 GMT

Hi, all!

Does it is normal to get user/IP associations using both AD Query and Identity Collector simultaneously, or better choice is to choose one?

Re: Both AD Query and Identity Collector

AkosBakos — Mon, 11 Nov 2024 14:04:17 GMT

Hi @Padre__

In short: Use Identity Collector. It is much more safe, an this is the preferred method.

In the October 2022 Windows update (KB5018411/ KB5018419), Microsoft made changes to read privileges that affect AD Query from an Identity Awareness Gateway to a DC. If AD Query is configured for a DC user who is not an admin (see sk93938), AD Query cannot access the DC. For customers with such a configuration, Check Point recommends to use Identity Collector as the Identity Source instead of AD Query. For more information and workaround procedures, see sk180232.

https://support.checkpoint.com/results/sk/sk60301

Akos

Re: Both AD Query and Identity Collector

Chris_Atkinson — Mon, 11 Nov 2024 14:27:57 GMT

Identity Collector is preferred and is better performing than Adquery.

Re: Both AD Query and Identity Collector

CheckPointerXL — Thu, 14 Nov 2024 10:53:27 GMT

AD Query and Identity Collector conflict and should not be used as the identity connector for the same gateway. Events may arrive out of sync and the same event may be observed multiple times, leading to unpredictable results

https://www.checkpoint.com/downloads/products/cp-identity-awareness-reference-architecture-best-practices.pdf