USER ID MAPPING

[almay]

What will give you better results, User-ID Agents installed on domain controllers, or Server Monitoring from the firewall (agentless)? 

[dieter_b]

Server monitoring is only one way of getting user id and it can be done with both agent on DC or on-device.

Combining different collection features (security logs, session monitoring, wmi probing...) would probably give best results. And if you have a large ip turnover, you better keep collection intervals low.

[rmonvon]

To add to dieterb comment, both agents will read the security logs of DCs to get userID-IP mappings.  Session Monitoring is optional and can be turn on/off on the agents.  Session Monitoring will pick up on users connecting to a file or print server.  Thanks.

[almay]

we have about 18,000 devices spread across 3 domains.  what would be a recommended collection interval/

[mbutt]

If you have a large user base which seems to be the case and you have multiple domains your best option i believe will be to go with User id agent since you will need to configure different profiles for LDAP to map the different domains.

Hope this helps

Numan

[dieter_b]

I'd start with the default intervals.

Then do some testing to get an acceptable correlation between users and ip's.

Situation as described here Re: User loses privileges...UserID is actually a good test. See how long it takes for the right user to be mapped back to your ip.

[lucaspassos]

Hello,

I guess that the better option is install a user-id agent. I had some problems with agentless and when I put the user-id agent the things gone out.

[panos]

installing user id agents will be better solution