AD Query vs Identity Collector

[shauls]

Hello guys

AD Query has this limitation:

• Many user accounts connected from the same IP address - AD Query cannot detect when a user logs out. Therefore, more than one user can have open sessions from the same IP address. When this occurs, the permissions for each account stay active until their User/IP association timeout occurs. In this scenario, there is a risk that currently connected users can get access to network resources, for which they do not have permissions.

Does Identity Collector share this limitation? If not, how does it solve this?

[emmap]

IDC also has the same limitation, stemming from the same place - there's no 'log out' event in AD for us to read. To know when a session has ended, we need to be reading from an agent on the machine, either the multi-user host agent on terminal servers or the regular agent on PCs.

This can be mitigated on single-user PCs by enabling the 'assume one user per host' option that will end the user association to an IP address when a new user is associated with it. 

[shauls]

I see this option.

I have this option on both Security Gateway and Security Management Server, what are the differences?

[emmap]

Not sure if you meant to add a screenshot or something there, which option are you referring to?

[the_rock]

See if below discussion helps, lots of things were discussed here.

Andy

https://community.checkpoint.com/t5/Security-Gateways/New-IA-Implementation/m-p/185851#M34184

[Chris_Atkinson]

In general there are certain scenarios that can only be solved entirely with the Identity Agent, with that said Identity Collector is preferred over the legacy ADquery method for several reasons.

[Lesley]

To add, here are the pro's of the IDC:

• Reduced load on the Security Gateway - Identity Collector does the queries instead of the Security Gateway

• Reduced load on the Domain Controller (DC) - the native Windows API consumes fewer resources

• Lower permissions required - Identity Collector requires read-only access to the domain security logs

• No changes are required in the Active Directory (AD) schema.

• One Identity Collector can serve multiple Security Gateways, even from a different Domain Management Servers on a Multi-Domain Server

• Identity Collector can communicate with a maximum of up to 35 Active Directory (AD) servers.

• Identity Collector can process a maximum of 1900 Active Directory (AD) events per second.