Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

Identity Collector - not getting any events

Hi,

we want to establish the Identity Awareness in our Check Point Firewall. We want to test all possibilities and of course also the Identity Collector.

We activated the function and installed the Collector on one machine. The setup was fairly easy and the connection tests were successful.

Unfortunately the Identity Collector doesn't show any received events even if we use a domain administrator as the account:

ic_cp.PNG

Do you have any idea how to troubleshoot that? I would assume that the connection test tells me if there is anything wrong. The firewall on the domain controller allows the access from the Identity Collector.

0 Kudos
3 Replies
Highlighted

Maybe your DC doesn't log the right events.

Have a look at sk99006 and check your DC security event log for event IDs 4624, 4768, 4769, 4770.

0 Kudos
Highlighted

Thanks for that SK. I will check that today with our admin and report if we were successful.

0 Kudos
Highlighted

We have looked at the events and they are collected correctly. Maybe we will look at this some time later but it seems that the Identity Agent is the best solution for us anyway (changing networks etc.). 

0 Kudos