topic Re: AD Query vs Identity Collector in Firewall and Security Management

AD Query vs Identity Collector

shauls — Thu, 03 Apr 2025 07:32:54 GMT

Hello guys

AD Query has this limitation:

Many user accounts connected from the same IP address - AD Query cannot detect when a user logs out. Therefore, more than one user can have open sessions from the same IP address. When this occurs, the permissions for each account stay active until their User/IP association timeout occurs. In this scenario, there is a risk that currently connected users can get access to network resources, for which they do not have permissions.

Does Identity Collector share this limitation? If not, how does it solve this?

Re: AD Query vs Identity Collector

emmap — Thu, 03 Apr 2025 11:07:05 GMT

IDC also has the same limitation, stemming from the same place - there's no 'log out' event in AD for us to read. To know when a session has ended, we need to be reading from an agent on the machine, either the multi-user host agent on terminal servers or the regular agent on PCs.

This can be mitigated on single-user PCs by enabling the 'assume one user per host' option that will end the user association to an IP address when a new user is associated with it.

Re: AD Query vs Identity Collector

the_rock — Thu, 03 Apr 2025 11:09:32 GMT

See if below discussion helps, lots of things were discussed here.

Andy

https://community.checkpoint.com/t5/Security-Gateways/New-IA-Implementation/m-p/185851#M34184

Re: AD Query vs Identity Collector

Chris_Atkinson — Thu, 03 Apr 2025 11:11:43 GMT

In general there are certain scenarios that can only be solved entirely with the Identity Agent, with that said Identity Collector is preferred over the legacy ADquery method for several reasons.

Re: AD Query vs Identity Collector

shauls — Thu, 03 Apr 2025 11:47:44 GMT

I see this option.

I have this option on both Security Gateway and Security Management Server, what are the differences?

Re: AD Query vs Identity Collector

Lesley — Thu, 03 Apr 2025 21:09:09 GMT

To add, here are the pro's of the IDC:

Reduced load on the Security Gateway - Identity Collector does the queries instead of the Security Gateway
Reduced load on the Domain Controller (DC) - the native Windows API consumes fewer resources
Lower permissions required - Identity Collector requires read-only access to the domain security logs
No changes are required in the Active Directory (AD) schema.
One Identity Collector can serve multiple Security Gateways, even from a different Domain Management Servers on a Multi-Domain Server
Identity Collector can communicate with a maximum of up to 35 Active Directory (AD) servers.
Identity Collector can process a maximum of 1900 Active Directory (AD) events per second.

Re: AD Query vs Identity Collector

emmap — Fri, 04 Apr 2025 03:34:34 GMT

Not sure if you meant to add a screenshot or something there, which option are you referring to?