topic Re: Bypassed users alert in Managing Users

Bypassed users alert

wujieleo — Tue, 01 Jun 2021 09:29:06 GMT

Hello.

Is there a native report in DUO that will display which users accounts are set to ‘Bypass’ and send this list through email on a regular basis?

Regards,

Leo

Re: Bypassed users alert

Amy2 — Tue, 01 Jun 2021 14:03:30 GMT

Hi @wujieleo,
You can get a list of all users who are currently set to Bypass status from the Duo Admin Panel. From the Users page, select Bypass Users, and you can then Export the list of user in Bypass status to CSV, JSON, or Print file types.

I’m sorry to say it is not currently possible to schedule reports to be automatically sent via email from the Duo Admin Panel. However, this is a popular request we hear from our users. I will add you to the feature request for this, so your interest is documented for the team.
You can set up email alerts for certain user events, though. Please see Kristina’s response here for more info: Schedule reports delivery via email - #5 by DuoKristina

Re: Bypassed users alert

ButlerKD — Tue, 08 Jun 2021 01:32:29 GMT

Leo,

We are in the process of implementing the Duo Log Sync in conjunction with our Qradar SIEM. Once configured, you should be able to have your SIEM of choice send out alerts based upon your criteria for your environment.

The instructions look to be based on a Linux-based install, but hopefully there will be a fully vetted step-by-step install for the Microsoft Windows ecosystem.

Re: Bypassed users alert

ButlerKD — Tue, 08 Jun 2021 22:45:52 GMT

Leo,

Here is a step-by-step set of instructions I’ve crafted with the assistance of our Duo Customer Solutions Engineer. It is for the Microsoft Windows environment, and is targeted towards sending logs to a Qradar SIEM, but with the necessary changes you may be able to engineer it for your environment.

Kevin

Duo Log Sync Install – Windows

Pre-Requisites:

Download the current version of the Duo Log Sync app from GitHub at “GitHub - duosecurity/duo_log_sync”.
Download the latest version of Python for Windows (currently v3.9.5 x64) from “Download Python | Python.org”.
An operational Duo Authentication Proxy Server running Windows Server 2012 R2/2016/2019

Duo Admin Portal Configuration:
4. Log into the Duo Admin portal. Click on the “Applications” link in the left-side Dashboard. Click on the “Protect an Application” button:

In the search field, locate the “Duo Admin API” application, click the “Protect” button to create the new Admin API application:
Once created, make note of the Integration key, Secret Key, and API hostname. Under “Settings/Permissions”, enable the check box for the following:
Grant read information
Grant read log
Grant read resource
Under “Settings/Networks for API access”, restrict access to the Admin API instance to the proper external network address(es) for the corporate network and click “Save Changes” to commit:

Duo Proxy Server Configuration:
8. On the Duo Proxy server to host the Duo Log Sync instance, extract the “duo_log_sync-master.zip” contents downloaded from “GitHub - duosecurity/duo_log_sync” into a folder named “C:\Program Files\DuoLogSync”:

Located and execute the downloaded installer for Python x64 with the following options configured:
Install launcher for all users (recommended)
Add Python 3.9 to the system PATH
Click “Customize Installation” and take the defaults. Click “Next”:
Under “Advanced Options”, select “Install for all users”. Click “Install”
(Optional) Once the install is complete, click the “Disable path length limit” option or the “Close” button to finish:
Create the following folders in the root of “C:\”:
“C:\tmp”
“C:\admin\logs”

Configure Duo Log Sync “config.yml”:
14. Extract the contents of the downloaded “duo_log_sync-master zip” to “C:\Program Files” as a folder called “DuoLogSync”:

Open an Administrator command prompt. Change directory to the newly created “C:\Program Files\DuoLogSync” folder. run the command “python setup.py install”
Once the installation completes, locate and copy the “template_config.yml” file to “config.yml”:
Modify the contents of the newly created config.yml as necessary for your environment:

Define Log Filepath name
Configure Log File format

Perform the following actions:

Enable “Checkpointing”
Change API calls offset information to “enabled: True”
Define SIEM ID name, FQDN, Port #, and Protocol sections

Input the “Integration key”, “Secret key”, and “API hostname” as configured for the “Admin API” application under “Duo Admin Panel\Applications”:

Starting Duo Log Sync:
20. After saving the modified “config.yml” file, start the Duo Log Sync script by executing the command “duologsync "C:\Program Files\DuoLogSync\config.yml””:

If successful, there should now be a “duologsync.log” file in the previously created “C:\admin\logs” folder:

Opening the “duologsync.log” file should now show any events that have occurred every 120 seconds (Notepad ++ works best for this):

Lastly, to automate the start of the script after a system reboot, save the following PowerShell code to a file named “DuoLogSyncStartup.ps1”.

Open an administrator PowerShell prompt, and execute as “.\DuoLogSyncStartup.ps1“:

##Script for Registering DuoLogSync as a Scheduled Task on Bootup
##Run this as Administrator via Powershell
##Jesse Yother – Customer Solutions Engineer - 4/7/2021

#Installation Variables. This is the only place that should need edited!
#Default Log Sync installation for Windows is:
##"
C:\Users\USERNAME\AppData\Local\Programs\Python\Python39\Scripts\duologsync.exe
$DuoLogSyncLocation = “C:\Program Files\Python39\Scripts\duologsync.exe”
$configLocation = “C:\Program Files\DuoLogSync\config.yml” #config.yml path
$description = “Task to re-enable Duo Log Sync after each reboot”
##"
#Defines the Action to initiate the Duo Log Sync executable
##"
$action = New-ScheduledTaskAction -Execute $DuoLogSyncLocation -Argument $configLocation
##"
#Adds the trigger to run the task at startup
##"
$trigger = New-ScheduledTaskTrigger -AtStartup
##"
#Defines the running user as “System” and sets to run regardless of logon at the highest privilege.
##"
$principal = New-ScheduledTaskPrincipal -UserID “NT AUTHORITY\SYSTEM” - LogonType ServiceAccount -RunLevel Highest
##"
#Registers the task variables as a new Scheduled Task in the Windows Task Scheduler and adds a description.
##"
Register-ScheduledTask -TaskName “DuoLogSync” -Action $action -Trigger $trigger -Principal $principal -Description $description

After a successful execution, the task is now scheduled to start after a system reboot:

This concludes the installation, configuration, and execution of the Duo Log Sync application. Special thanks to Duo Customer Solutions Engineer Jesse Yother for assistance in getting this operational.

Re: Bypassed users alert

Amy2 — Thu, 10 Jun 2021 15:37:50 GMT

@ButlerKevinD , wow thank you so much for taking the time to document this and share it with the community! These steps are thorough and easy to follow, and I love that you included screenshots as well.

Re: Bypassed users alert

ButlerKD — Thu, 10 Jun 2021 23:22:25 GMT

@Amy - Happy to help out, and wouldn’t be able to present it here without our CSE’s assistance.

@wujieleo - One thing to note on the scheduled task, you may wish to modify it to the following settings utilizing a domain account with administrative permissions on your Windows Duo Auth Proxy server. After a while, we have noticed the script will crash with a Winsock error.

Also make certain under the “Actions” tab created by the PowerShell script, you encapsulate the “Program/Script” and “Add arguments (optional)” settings with double-quotes ("C:\Program Files\Python39\Scripts\duologsync.exe" and “C:\Program Files\DuoLogSync\config.yml”).

Thus far with this scheduled task configuration, if it does crash, it is restarted:

General Tab

Triggers Tab

Actions Tab

Re: Bypassed users alert

strem — Thu, 14 Jul 2022 14:26:08 GMT

I would also like to +1 this request to be able to schedule a report of bypass users.

Re: Bypassed users alert

jjiam — Thu, 14 Jul 2022 18:56:08 GMT

Hi @strem, welcome to the Duo Community! Thanks for letting us know about your support for this feature request. I’ll pass this input along to our Product team. Let us know if you need any additional help!

Re: Bypassed users alert

mharia — Mon, 03 Apr 2023 22:04:27 GMT

I’d like to +1 this request as well.

Re: Bypassed users alert

mharia — Mon, 03 Apr 2023 22:05:52 GMT

In fact, not just a scheduled report, but ideally a real-time alert since it could be an extremely material security event.

Re: Bypassed users alert

rbill1967 — Mon, 02 Mar 2026 19:52:20 GMT

You have my vote!! It would be excellent if DUO would create the ability to get a daily or weekly report of users in bypass mode. It would be very helpful, because sometimes we have to set people in bypass mode because they leave their 2FA device at home, but they need to work.

Re: Bypassed users alert

DuoKristina — Thu, 05 Mar 2026 15:54:54 GMT

@rbill1967

You can contact your Cisco Duo account or customer success team to submit your feature request for bypass user status reporting. If you don't have a dedicated contact, you can submit feature requests via Duo Support.

Re: Bypassed users alert

rbill1967 — Thu, 05 Mar 2026 16:04:14 GMT

Sure, done that already and unless it becomes a global request from all users of the product, probably won't happen. Besides, I have submitted several things to them for improvement and updates to their product. No move on that yet or responses but thank you for responding to my response.