topic Re: Domain 'nt service' in alert mail in Firewall & Security Management

Domain 'nt service' in alert mail

Martijn — Wed, 24 Jul 2019 11:12:27 GMT

Hi All,

One of our customers is using the Terminal Server agent for Citrix and is seeing the following alerts in the logging (and mail).

HeaderDateHour: 22Jun2019 5:32:13; ContentVersion: 5; HighLevelLogKey: N/A; Uuid: {0x0,0x0,0x0,0x0}; SequenceNum: 32; Action: ctl; Origin: XXXXXXX_XXXXXXX; IfDir: >; InterfaceName: N/A;
Alert: mail; OriginSicName: CN=XXXXXXX_XXXXXXX,O=XXXXXXXX.fake.domain.grq7vi; OriginSicName: CN=XXXXXXX_XXXXXXX,O=XXXXXXX.fake.domain.grq7vi; HighLevelLogKey: 18446744073709551615;
status: Bad configuration; ctrl_category: Configuration Status; description: Failed to get users groups for the domain.(+)Verify that this domain name is configured in your LDAP Account Unit.(+)Domain: nt service;
severity: Critical; ProductName: Identity Awareness; ProductFamily: Network;

Identity Awareness is configured as described in the admin guide and seems to be working. But where does this alert coming from and why is Check Point seeing the 'nt service' domain? This is not configured in the Check Point configuration.

Regards,

Martijn

Re: Domain 'nt service' in alert mail

PhoneBoy — Sat, 27 Jul 2019 00:32:03 GMT

It looks like the agent is picking up a user called "NT Domain" for some reason and it can't be looked up via LDAP.
Might be worth adding that to the list of exclusions in Identity Awareness.

Re: Domain 'nt service' in alert mail

MvdGraaf — Mon, 29 Jul 2019 06:16:30 GMT

Hi,

We are not using AD Query. Just the Identity Awareness agent on computers and terminal servers.

Not sure how to exclude accounts with Identity Awareness agents.

Regards,

Martijn

Re: Domain 'nt service' in alert mail

Piet_vd_Maas_2 — Mon, 29 Jul 2019 06:28:37 GMT

With the AD Query you can exclude user, but not with the (Terminal Server) Identity Agent. Or is there still a way to exclude users?

Re: Domain 'nt service' in alert mail

PhoneBoy — Tue, 30 Jul 2019 15:34:07 GMT

@Royi_Priov shouldn't exclusions for identity agent work the same way as ADQuery?

Re: Domain 'nt service' in alert mail

Royi_Priov — Wed, 31 Jul 2019 07:16:50 GMT

Hi @Martijn

The TS agent is monitoring all users logged in on the Citrix machine and sends them (in UPN format - user@domain) to the PDP gateway.

My assumption is that a service account was logged into the Citrix machine and therefore was transferred to the gateway.

The fact that this domain was not configured on Check Point side (which is right!) cause this error, as the authorization phase for this user fails.

I suggest opening case with TAC, to verify this. You can also ask for fixed agent which allows excluding specific users to be sent to the PDP gateway.

Thanks,

Royi.

Re: Domain 'nt service' in alert mail

GrassF — Fri, 09 Apr 2021 10:53:21 GMT

Hi,

what was the solution? I'm having the same issue. Thanks

Grass

Re: Domain 'nt service' in alert mail

GrassF — Fri, 09 Apr 2021 10:55:07 GMT

Hi Martijin

What was the solution here? I'm having the same issue with R80.40. Thanks

Grass

Re: Domain 'nt service' in alert mail

Piet_vd_Maas_2 — Wed, 26 May 2021 13:45:18 GMT

We still get the same warnings. Also in R80.40.

HeaderDateHour: 26May2021 14:58:51
ContentVersion: 5
HighLevelLogKey: N/A
Uuid: {0x0,0x0,0x0,0x0}
SequenceNum: 122
Action: ctl
Origin: XXXXXXXXX
IfDir: >
InterfaceName: N/A
Alert: mail
OriginSicName: CN=XXXXXXXXX
status: Bad configuration
ctrl_category: Configuration Status
description: Failed to get users groups for the domain.(+)Verify that this domain name is configured in your LDAP Account Unit.(+)Domain: nt service
severity: Critical
ProductName: Identity Awareness
ProductFamily: Network

Re: Domain 'nt service' in alert mail

Royi_Priov — Wed, 26 May 2021 14:23:22 GMT

Hi @Piet_vd_Maas_2 ,

This issue was already resolved, on the client side.

Please download and install the latest client from sk134312 - "nt service" should be filtered out automatically.