01-31-2024 10:02 PM
Hi,
We have a userid_agent installed on our server, our security team noticed the excessive session denies between the userid agent server going to other non-AD servers in our azure firewall, can anyone help me confirm if this traffic from our userid agent server going to non-AD servers are legit traffics?
02-02-2024 10:45 PM
I'd recommend monitoring through Resource Monitor to see what is actually connecting to what on the host, that's the only way to verify what actual process is sending what traffic. Nothing is really shocking from a port aspect outside of it not hitting expected/configured endpoints, however if you weren't the one to configure this agent I'd verify that it's actually been configured properly. AD isn't the only monitorable server for user-ID, it's possible someone added additional nodes that you aren't planning to see.
Additionally I'd take some time to ensure that you have client probing all disabled; that would also account for a large amount of this traffic hitting unexpected nodes.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
