Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
dehaasm
Collaborator

Identity awareness collector changes user identity for same IP while connecting to RDP

Hi All we have something strange with Identity Awareness collector installed on server, let me explain;

A client with IP 10.0.0.1 (example) connects to the gateway and the Idenitity awareness collector identifies the user as nick. When the same user/client IP established a RDP connection to external server 192.168.1.1 (example) and logs into that remote server as nick-admin the gateway receives an identity update from the identity awareness collector indicating that 10.0.0.1 is nick-admin which is obviously not correct. We would expect the external server IP 192.168.1.1 to be nick-admin and the 10.0.0.1 to remain nick.

How is this possible that the IA collector is identifying the user incorrectly on the laptop?

note: this issue is easy to reproduce and I wonder if we need to open TAC case and/or understand if there is somehing we need to adjust on the IA collector?

0 Kudos
(1)
13 Replies
Chris_Atkinson
Employee Employee
Employee

Within the Identity Collector Advanced configuration how is the following option currently set?

"Ignore RDP events"

Also which IDC version is installed?

 

Refer also:

https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_IdentityAwareness_AdminGuide...

CCSM R77/R80/ELITE
0 Kudos
dehaasm
Collaborator

Hi Chris,

Yes it is enabled see screenshot and we have build 81.0.40.0000, should we open TAC case as it is not behaving "as designed" correct?

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Based on the limited info available I would say it warrants an SR with TAC for further investigation, yes.

CCSM R77/R80/ELITE
0 Kudos
dede79
Contributor

Hello,

I have excatly the same issue that the identity of the remotedesktop client is change with the user that is used for rdp.

I have the setting enabled but it says that it is only relevant for "RDP to Domain Controllers" - in my case we have RDP to clients and various servers.

Can this event be filtered in any other way?

0 Kudos
Jimmy_Noel
Participant

Are there any updates in this case?
We have the same problem. RDP-Login triggers an Eventlog (Event ID 4769) for the local IP and remote User.
(We have IC Build 81.028.0000, with enabled option "Ignore events of RDP to Domain Controllers")
Is there any possibility to ignore this event id?

0 Kudos
RK91
Explorer

Hi Any News? We have the same issue.  RDP login to a remote Server triggers an Login Event on the RDP Client

0 Kudos
Chris_Atkinson
Employee Employee
Employee

Sorry I'm not aware of the outcome of the above.

If you are seeing issues with IDC R81.069.0000 please report the problem to TAC.

CCSM R77/R80/ELITE
0 Kudos
dehaasm
Collaborator

Hi Guys it was some time ago but we never resolved the issue, I didn't escalate it to TAC but I believe that is the right thing to do for this.

0 Kudos
RK91
Explorer

Hi dehaasm, do you escaltet it ? 

Thanks & regards

0 Kudos
CheckPointerXL
Advisor
Advisor

are you running latest IDC version? i've just upgraded from a very old version and no more rdp events are triggered

0 Kudos
RK91
Explorer

we are running Build: 81.069.0000 

0 Kudos
RK91
Explorer

Always when I log in from the Source "host A" (logged in with User A)  to a Destination "host B" (with user B), it also triggers an login on "host A" with "user B". That is very annoying.

After some time or do some work or lock "host A" and unlock "host A" with "user A" it triggers the login agian back to "user A"

 

0 Kudos
Chris_Atkinson
Employee Employee
Employee

As above if you already have the "Ignore RDP events" option configured and are using IDC 81.069.0000 I would recommend engaging with TAC to troubleshoot the issue.

CCSM R77/R80/ELITE
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events