User Identification Agent

scanlab.rgr — Thu, 03 Feb 2011 14:06:44 GMT

Hi,

I have a question concerning the User Identification Agent.
Yesterday we had a problem with wrong user identification. The problem is solved in the meanwhile but it would be nice for me to understand how the agent works.

To solve the wrong identification I enabled the following audit policies on our domain-controller:
Audit account logon events: Success, Failure
Audit logon events: Success, Failure

Are both policies (success and failure) necessary for the agent to work?
In the KnowledgePoint I found a hint that the following event ID’s (Windows Server 2008) are recognized by the agent is this correct?

LOGON_SUCCESS_W2008 = 4624,
AUTH_TICKET_GRANTED_W2008 = 4768,
TICKET_GRANTED_RENEW_W2008 = 4770,
ACCOUNT_USED_FOR_LOGON_W2008 = 4776

Thanks

Re: User Identification Agent

mharding — Thu, 03 Feb 2011 14:52:13 GMT

The short answer is yes.

Re: User Identification Agent

scanlab.rgr — Fri, 04 Feb 2011 08:29:38 GMT

Short but helpful.

Thanks.

topic Re: User Identification Agent in General Topics

User Identification Agent

Re: User Identification Agent

Re: User Identification Agent