topic Re: USER ID MAPPING in General Topics

USER ID MAPPING

almay — Thu, 21 Nov 2013 03:22:21 GMT

What will give you better results, User-ID Agents installed on domain controllers, or Server Monitoring from the firewall (agentless)?

Re: USER ID MAPPING

dieter_b — Thu, 21 Nov 2013 14:27:20 GMT

Server monitoring is only one way of getting user id and it can be done with both agent on DC or on-device.

Combining different collection features (security logs, session monitoring, wmi probing...) would probably give best results. And if you have a large ip turnover, you better keep collection intervals low.

Re: USER ID MAPPING

rmonvon — Thu, 21 Nov 2013 15:41:26 GMT

To add to dieterb comment, both agents will read the security logs of DCs to get userID-IP mappings. Session Monitoring is optional and can be turn on/off on the agents. Session Monitoring will pick up on users connecting to a file or print server. Thanks.

Re: USER ID MAPPING

almay — Thu, 21 Nov 2013 16:15:37 GMT

we have about 18,000 devices spread across 3 domains. what would be a recommended collection interval/

Re: USER ID MAPPING

mbutt — Tue, 26 Nov 2013 00:30:40 GMT

If you have a large user base which seems to be the case and you have multiple domains your best option i believe will be to go with User id agent since you will need to configure different profiles for LDAP to map the different domains.

Hope this helps

Numan

Re: USER ID MAPPING

dieter_b — Tue, 26 Nov 2013 07:34:42 GMT

I'd start with the default intervals.

Then do some testing to get an acceptable correlation between users and ip's.

Situation as described here Re: User loses privileges...UserID is actually a good test. See how long it takes for the right user to be mapped back to your ip.

Re: USER ID MAPPING

lucaspassos — Tue, 26 Nov 2013 13:55:51 GMT

Hello,

I guess that the better option is install a user-id agent. I had some problems with agentless and when I put the user-id agent the things gone out.

Re: USER ID MAPPING

Retired Member — Tue, 26 Nov 2013 19:51:16 GMT

installing user id agents will be better solution