User ID agent going to non- AD servers

Daryl_Cruz — Thu, 01 Feb 2024 06:02:47 GMT

Hi,

We have a userid_agent installed on our server, our security team noticed the excessive session denies between the userid agent server going to other non-AD servers in our azure firewall, can anyone help me confirm if this traffic from our userid agent server going to non-AD servers are legit traffics?

Re: User ID agent going to non- AD servers

BPry — Sat, 03 Feb 2024 06:45:34 GMT

@Daryl_Cruz,

I'd recommend monitoring through Resource Monitor to see what is actually connecting to what on the host, that's the only way to verify what actual process is sending what traffic. Nothing is really shocking from a port aspect outside of it not hitting expected/configured endpoints, however if you weren't the one to configure this agent I'd verify that it's actually been configured properly. AD isn't the only monitorable server for user-ID, it's possible someone added additional nodes that you aren't planning to see.

Additionally I'd take some time to ensure that you have client probing all disabled; that would also account for a large amount of this traffic hitting unexpected nodes.

topic User ID agent going to non- AD servers in General Topics

User ID agent going to non- AD servers

Re: User ID agent going to non- AD servers