topic User-ID Agent & Desktop PowerManagment in General Topics

User-ID Agent & Desktop PowerManagment

michaelsitler — Mon, 05 Aug 2013 19:24:55 GMT

We have User-ID agent setup and running, Where it polls the machines every 20 minutes, to track the users.

Since we are now trying to implement Power management on the Desktop. It appears that the USER-ID agent system is waking the machines up. Has anyone else run into this problem? And if so what solutions have you found?

So far these are the solutions we've come up with.

Stop using the User-ID Agent system at least the clientless one we are using now, and I think there's an agent version?
Is there a way to throttle/limit it's use to say between only 9am-5pm?
We could also increase the polling to every hour or more, but it'd still wake the machines up, and it'd loose the usefulness of probing at all much past an hour.
We could also configure the machines only to wake on MagicPacket, but since a good deal of the end users RDP to their desktops, that won't work without additional software on their home machines as well as configuring, etc.. (it's not practical)

Any ideas?

Re: User-ID Agent & Desktop PowerManagment

Retired Member — Tue, 06 Aug 2013 06:51:34 GMT

Try to start with first solution.

you use agentless system ?

Re: User-ID Agent & Desktop PowerManagment

VinceM — Tue, 06 Aug 2013 10:07:17 GMT

Hi,

The issue should come from wmi probing. Maybe move to Netbios probing ?

Re: User-ID Agent & Desktop PowerManagment

michaelsitler — Tue, 06 Aug 2013 14:41:23 GMT

I tried just using netbios probing, still wakes the machines up.

So at the moment I've turned off the netbios probing as well as we haven't fully implemented the palo alto yet.

So if I understand this correctly the user-id agent will still sort through the AD logs and figure out who's logging in, but I'm guessing it won't be as good as probing?

Is there an agent we could install on the desktops? ( I heard there used to be one)

Re: User-ID Agent & Desktop PowerManagment

Chatri — Tue, 06 Aug 2013 15:00:55 GMT

Have you tried disabling all sorts of probes and enable 'server session read' ?

That way the PCs will directly not be probed but the DC's server logs will be checked for open socket sessions any domain PCs has ( log on and log off will be seen).

So . essentially we should still be able to dynamically monitor the user to IP enumeration without probing the PCs directly.