Identity Awareness "domain name not configured" -> nt-autoritÄt

[SWBW_Florian]

Hi there,

we receive several warnings a week regarding the identity awareness blade on our Checkpoint NGFW.

Were using the identity collector so identity awareness is active and working very fine so far. Those warnings are more "cosmetic" than a real problem.

Its about the windows system domain "nt-autoritÄt" (in englisch nt-authority)

Its not configured because its system internal. 

The warning looks like this:

• Failed to get users groups for the domain.
  Verify that this domain name is configured in your LDAP Account Unit.
  Domain: nt-autoritÄt
• Source: ServerIP Adress
  Action: Failed Login
  Blade: I A
  Session ID: XXXX
  Authentication Method: Machine Identity Propagation

Is there any way to "hide" those warnings? or just to "fakeconfigure" this? Actually each Windows Server Domain should have these "issues". how to get rid of it?

We are using 2 nodes in the cluster. i noticed that those warnings only are thrown out through node2

Thanks in Advance

Florian

[G_W_Albrecht]

Is it impossible to delete the domain from Collector or from the Query Pool ?

[SWBW_Florian]

i cant find any way to do this. can you point me there?

At least for the query Pool: There is only our active domain configured. nothing else.

[SWBW_Florian]

i found and configured a "filter" at the identity collectors. i chosed "domain", "exclude" and pasted nt-autoritÄt in there

maybe thats it? I will observe this

[G_W_Albrecht]

That should work. I did not mention the filters...

[SWBW_Florian]

it doesnt. i still have errors since i activated that filter

[G_W_Albrecht]

Sorry, i can see nothing relevant in the screenshot - better contact CP TAC !