Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Martijn
Advisor
Advisor
Jump to solution

Domain 'nt service' in alert mail

Hi All,

 

One of our customers is using the Terminal Server agent for Citrix and is seeing the following alerts in the logging (and mail).

HeaderDateHour: 22Jun2019 5:32:13; ContentVersion: 5; HighLevelLogKey: N/A; Uuid: {0x0,0x0,0x0,0x0}; SequenceNum: 32; Action: ctl; Origin: XXXXXXX_XXXXXXX; IfDir: >; InterfaceName: N/A;
Alert: mail; OriginSicName: CN=XXXXXXX_XXXXXXX,O=XXXXXXXX.fake.domain.grq7vi; OriginSicName: CN=XXXXXXX_XXXXXXX,O=XXXXXXX.fake.domain.grq7vi; HighLevelLogKey: 18446744073709551615;
status: Bad configuration; ctrl_category: Configuration Status; description: Failed to get users groups for the domain.(+)Verify that this domain name is configured in your LDAP Account Unit.(+)Domain: nt service;
severity: Critical; ProductName: Identity Awareness; ProductFamily: Network;

Identity Awareness is configured as described in the admin guide and seems to be working. But where does this alert coming from and why is Check Point seeing the 'nt service' domain? This is not configured in the Check Point configuration.

Regards,

Martijn

1 Solution

Accepted Solutions
Royi_Priov
Employee
Employee

Hi @Piet_vd_Maas_2 ,

This issue was already resolved, on the client side.

Please download and install the latest client from sk134312 - "nt service" should be filtered out automatically.

Thanks,
Royi Priov
Group manager, Identity Awareness R&D

View solution in original post

0 Kudos
9 Replies
PhoneBoy
Admin
Admin
It looks like the agent is picking up a user called "NT Domain" for some reason and it can't be looked up via LDAP.
Might be worth adding that to the list of exclusions in Identity Awareness.
0 Kudos
MvdGraaf
Explorer

Hi,

We are not using AD Query. Just the Identity Awareness agent on computers and terminal servers.

Not sure how to exclude accounts with Identity Awareness agents.

Regards,

Martijn

0 Kudos
Piet_vd_Maas_2
Participant

With the AD Query you can exclude user, but not with the (Terminal Server) Identity Agent. Or is there still a way to exclude users?

PhoneBoy
Admin
Admin

@Royi_Priov shouldn't exclusions for identity agent work the same way as ADQuery?

Royi_Priov
Employee
Employee

Hi @Martijn 

The TS agent is monitoring all users logged in on the Citrix machine and sends them (in UPN format - user@domain) to the PDP gateway.

My assumption is that a service account was logged into the Citrix machine and therefore was transferred to the gateway.

The fact that this domain was not configured on Check Point side (which is right!) cause this error, as the authorization phase for this user fails.

I suggest opening case with TAC, to verify this. You can also ask for fixed agent which allows excluding specific users to be sent to the PDP gateway.

 

Thanks,

Royi.

Thanks,
Royi Priov
Group manager, Identity Awareness R&D
GrassF
Participant

Hi,

what was the solution? I'm having the same issue. Thanks

Grass

0 Kudos
GrassF
Participant

Hi Martijin

What was the solution here? I'm having the same issue with R80.40. Thanks

Grass

0 Kudos
Piet_vd_Maas_2
Participant

We still get the same warnings. Also in R80.40.

 

HeaderDateHour: 26May2021 14:58:51
ContentVersion: 5
HighLevelLogKey: N/A
Uuid: {0x0,0x0,0x0,0x0}
SequenceNum: 122
Action: ctl
Origin: XXXXXXXXX
IfDir: >
InterfaceName: N/A
Alert: mail
OriginSicName: CN=XXXXXXXXX
status: Bad configuration
ctrl_category: Configuration Status
description: Failed to get users groups for the domain.(+)Verify that this domain name is configured in your LDAP Account Unit.(+)Domain: nt service
severity: Critical
ProductName: Identity Awareness
ProductFamily: Network

0 Kudos
Royi_Priov
Employee
Employee

Hi @Piet_vd_Maas_2 ,

This issue was already resolved, on the client side.

Please download and install the latest client from sk134312 - "nt service" should be filtered out automatically.

Thanks,
Royi Priov
Group manager, Identity Awareness R&D
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events