topic Re: Identity Agent - disable exiting for existing agents in AI Network Firewall

Identity Agent - disable exiting for existing agents

NorthernNetGuy — Wed, 20 Feb 2019 15:16:55 GMT

I've configured the global properties such that nac_agent_disable_quit has been enabled, however agents that are already deployed are able to exit the agent still. New deploys are correctly receiving this setting.

What have people done to ensure this setting is changed for agents that are already deployed?

Thanks

Re: Identity Agent - disable exiting for existing agents

Mark_Mitchell — Wed, 20 Feb 2019 22:35:58 GMT

Hi David,

You've got a good one there. I am thinking that this may be a bug. As I can't find official documentation that suggests that is normal behaviour.

I'd get a TAC case raised to investigate further.

Just out of interest are the existing clients running the latest version of the identity agent? Or an older one?

Regards

Mark

Re: Identity Agent - disable exiting for existing agents

G_W_Albrecht — Thu, 21 Feb 2019 09:28:57 GMT

This sounds like "as-it-is" as explained in the IA Admin Guide:

You can change settings for Endpoint Identity Agent parameters to control Endpoint Identity Agent behavior. You can change some of the settings in SmartConsole and others using the Endpoint Identity Agent Configuration tool.

In SmartConsole you can comfigure e.g. "Allow user to save password", but for nac_agent_disable_quit you have to use the Endpoint Identity Agent Configuration tool. To configure these settings from Dashboard and deploy it to the users would be a RFE.

Re: Identity Agent - disable exiting for existing agents

NorthernNetGuy — Thu, 21 Feb 2019 16:22:58 GMT

Hi Mark,

I'll get one open and see what their recommendation is.

we have our clients running on the latest version, R80.174

Re: Identity Agent - disable exiting for existing agents

NorthernNetGuy — Thu, 21 Feb 2019 16:27:23 GMT

I'm seeing the opposite of what you're saying here.

We can configure the nac_agent_disable_quit in smartconsole dashboard, it's under global properties->advanced->identity awareness->agent. These settings just don't seem to push out to the agents during their authenticated sessions.

I don't see changing this setting as an option in the Endpoint Identity Agent Configuration Tool, and I don't see it stating that it can in the IA admin guide. Could you clarify where this can be done in the tool?

Re: Identity Agent - disable exiting for existing agents

G_W_Albrecht — Fri, 22 Feb 2019 09:22:20 GMT

Sorry, i did mix things up a bit - you are absolutely right in that this global property should be enforced for all users, so we certainly have a bug here. A workaround may be available by tweaking the Win Registry (see sk88520: Best Practices - Identity Awareness Large Scale Deployment for a complete List of Windows Registry Tweaks on Identity Agent Client), but TAC is the right place to report that.