topic Re: Identity awareness collector changes user identity for same IP while connecting to RDP in General Topics

Identity awareness collector changes user identity for same IP while connecting to RDP

dehaasm — Wed, 29 Mar 2023 11:36:15 GMT

Hi All we have something strange with Identity Awareness collector installed on server, let me explain;

A client with IP 10.0.0.1 (example) connects to the gateway and the Idenitity awareness collector identifies the user as nick. When the same user/client IP established a RDP connection to external server 192.168.1.1 (example) and logs into that remote server as nick-admin the gateway receives an identity update from the identity awareness collector indicating that 10.0.0.1 is nick-admin which is obviously not correct. We would expect the external server IP 192.168.1.1 to be nick-admin and the 10.0.0.1 to remain nick.

How is this possible that the IA collector is identifying the user incorrectly on the laptop?

note: this issue is easy to reproduce and I wonder if we need to open TAC case and/or understand if there is somehing we need to adjust on the IA collector?

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

Chris_Atkinson — Wed, 29 Mar 2023 12:37:13 GMT

Within the Identity Collector Advanced configuration how is the following option currently set?

"Ignore RDP events"

Also which IDC version is installed?

Refer also:

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_IdentityAwareness_AdminGuide/Topics-IDAG/Configuring-Identity-Collector-Advanced-Configuration.htm?Highlight=Rdp%20events

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

dehaasm — Wed, 29 Mar 2023 12:45:28 GMT

Hi Chris,

Yes it is enabled see screenshot and we have build 81.0.40.0000, should we open TAC case as it is not behaving "as designed" correct?

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

Chris_Atkinson — Wed, 29 Mar 2023 12:54:16 GMT

Based on the limited info available I would say it warrants an SR with TAC for further investigation, yes.

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

dede79 — Fri, 13 Oct 2023 09:23:22 GMT

Hello,

I have excatly the same issue that the identity of the remotedesktop client is change with the user that is used for rdp.

I have the setting enabled but it says that it is only relevant for "RDP to Domain Controllers" - in my case we have RDP to clients and various servers.

Can this event be filtered in any other way?

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

Jimmy_Noel — Thu, 07 Mar 2024 06:56:31 GMT

Are there any updates in this case?
We have the same problem. RDP-Login triggers an Eventlog (Event ID 4769) for the local IP and remote User.
(We have IC Build 81.028.0000, with enabled option "Ignore events of RDP to Domain Controllers")
Is there any possibility to ignore this event id?

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

RK91 — Wed, 12 Jun 2024 16:22:19 GMT

Hi Any News? We have the same issue. RDP login to a remote Server triggers an Login Event on the RDP Client

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

Chris_Atkinson — Thu, 13 Jun 2024 00:58:34 GMT

Sorry I'm not aware of the outcome of the above.

If you are seeing issues with IDC R81.069.0000 please report the problem to TAC.

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

dehaasm — Thu, 13 Jun 2024 08:55:34 GMT

Hi Guys it was some time ago but we never resolved the issue, I didn't escalate it to TAC but I believe that is the right thing to do for this.

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

RK91 — Wed, 26 Jun 2024 11:45:08 GMT

Hi dehaasm, do you escaltet it ?

Thanks & regards

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

CheckPointerXL — Thu, 11 Jul 2024 20:44:23 GMT

are you running latest IDC version? i've just upgraded from a very old version and no more rdp events are triggered

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

RK91 — Thu, 11 Jul 2024 21:27:23 GMT

we are running Build: 81.069.0000

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

RK91 — Thu, 11 Jul 2024 21:46:41 GMT

Always when I log in from the Source "host A" (logged in with User A) to a Destination "host B" (with user B), it also triggers an login on "host A" with "user B". That is very annoying.

After some time or do some work or lock "host A" and unlock "host A" with "user A" it triggers the login agian back to "user A"

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

Chris_Atkinson — Fri, 12 Jul 2024 00:56:02 GMT

As above if you already have the "Ignore RDP events" option configured and are using IDC 81.069.0000 I would recommend engaging with TAC to troubleshoot the issue.

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

Daniel_Hainich — Thu, 14 Nov 2024 13:16:26 GMT

i have the same Problem. problem still exists in IDC 81.069.0000 and also R82.002.0000. Checkbox for ignoring RDP-Events is checked.

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

Chris_Atkinson — Thu, 14 Nov 2024 14:24:38 GMT

Is it for a terminal server or a standard PC ?

For non-DC machines you would typically explore either configuring an exclusion or use of the terminal server / MUH identity agent.

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

Daniel_Hainich — Thu, 14 Nov 2024 15:01:35 GMT

this is for all rdp-connections. either to an pc or an server. if i open the windows rdp-client and connect to an rdp-enabled windows-device, the identity of my local device is changed to the user which iam using for remote access.

event type 10 is logged within domain-controller, but not filtered from identity collector.

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

dehaasm — Thu, 14 Nov 2024 15:03:15 GMT

yes correct i had the same issue as you described it is probably a bug

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

Chris_Atkinson — Thu, 14 Nov 2024 15:27:27 GMT

Are you certain that the event type 10 is seen at the DC level and not just at the endpoint itself?

Re: Identity awareness collector changes user identity for same IP while connecting to RDP

Daniel_Hainich — Mon, 18 Nov 2024 06:51:57 GMT

hi, yes i can confirm that logontype 10 is generated on DC.