Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Collaborator

Domain 'nt service' in alert mail

Hi All,

 

One of our customers is using the Terminal Server agent for Citrix and is seeing the following alerts in the logging (and mail).

HeaderDateHour: 22Jun2019 5:32:13; ContentVersion: 5; HighLevelLogKey: N/A; Uuid: {0x0,0x0,0x0,0x0}; SequenceNum: 32; Action: ctl; Origin: XXXXXXX_XXXXXXX; IfDir: >; InterfaceName: N/A;
Alert: mail; OriginSicName: CN=XXXXXXX_XXXXXXX,O=XXXXXXXX.fake.domain.grq7vi; OriginSicName: CN=XXXXXXX_XXXXXXX,O=XXXXXXX.fake.domain.grq7vi; HighLevelLogKey: 18446744073709551615;
status: Bad configuration; ctrl_category: Configuration Status; description: Failed to get users groups for the domain.(+)Verify that this domain name is configured in your LDAP Account Unit.(+)Domain: nt service;
severity: Critical; ProductName: Identity Awareness; ProductFamily: Network;

Identity Awareness is configured as described in the admin guide and seems to be working. But where does this alert coming from and why is Check Point seeing the 'nt service' domain? This is not configured in the Check Point configuration.

Regards,

Martijn

5 Replies
Highlighted
Admin
Admin

It looks like the agent is picking up a user called "NT Domain" for some reason and it can't be looked up via LDAP.
Might be worth adding that to the list of exclusions in Identity Awareness.
0 Kudos
Highlighted
Explorer

Hi,

We are not using AD Query. Just the Identity Awareness agent on computers and terminal servers.

Not sure how to exclude accounts with Identity Awareness agents.

Regards,

Martijn

0 Kudos
Highlighted

With the AD Query you can exclude user, but not with the (Terminal Server) Identity Agent. Or is there still a way to exclude users?

Highlighted
Admin
Admin

@Royi_Priov shouldn't exclusions for identity agent work the same way as ADQuery?

Highlighted
Employee+
Employee+

Hi @Martijn 

The TS agent is monitoring all users logged in on the Citrix machine and sends them (in UPN format - user@domain) to the PDP gateway.

My assumption is that a service account was logged into the Citrix machine and therefore was transferred to the gateway.

The fact that this domain was not configured on Check Point side (which is right!) cause this error, as the authorization phase for this user fails.

I suggest opening case with TAC, to verify this. You can also ask for fixed agent which allows excluding specific users to be sent to the PDP gateway.

 

Thanks,

Royi.

Thanks,
Royi Priov
Group manager, Identity Awareness R&D