topic Problem Agent SourceFire in Network Security

Problem Agent SourceFire

crusier2015 — Tue, 12 Mar 2019 12:46:22 GMT

Hi,

i'm trying to configure AD agent, but always return the following error appears:

I checked LOGs of agent, the follow message appears:

"26/09/2015 20:48:23","debug","[0001] - Error connecting to 192.168.0.15: System.Management.ManagementException: User credentials cannot be used for local connections
at System.Management.ThreadDispatch.Start()
at System.Management.ManagementScope.Initialize()
at SFCo ..."

I followed the tutorial bellow:

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118637-configure-firesight-00.html

You need to install the User

Marvin Rhoads — Mon, 28 Sep 2015 17:03:18 GMT

You need to install the User Agent on a computer other than the AD server that you are pointing it to. This is a limitation of WMI as it cannot use domain credentials when running WMI scripts on the locahost.

You are correct, when i

crusier2015 — Mon, 28 Sep 2015 19:05:27 GMT

You are correct, when i installed the agent on another server, worked!

Tks

Just to add to the suggested

Binyam Demissie — Fri, 10 Jun 2016 22:11:44 GMT

Just to add to the suggested solution:

+ Installing the user Agent on a remote computer for remote access is NOT required. Its an option, but not required. You have two options:

Option #1

Install locally and add the AD server as below for the user agent to be able to report user activities in *real-time*. Real time events are not available when installed on another computer and then remotely accessed.

Server Name/IP Address : localhost

Domain: [ Blank ]

Authorized User: [ Blank ]

Password: [ Blank ]

Local Login IP Address: [ select the IP address]

Option #2 -

Install on another computer and add the up to 5 AD DC to the user agent.

- here you will need to user Server IP, domain, username, password for this to work.

- Additionally you will need the following configuration on the AD DCs to allow the user to read Security Logs *REMOTELY*. This is NOT required for local install on the AD DC itself.

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118637-configure-firesight-00.html

Thanks,

~ Binyam (TAC)

Good info Binyam - thanks.

Marvin Rhoads — Sat, 11 Jun 2016 02:19:17 GMT

Good info Binyam - thanks.

I'd suggest updating the Technote on SFUA to reflect this valuable addition.

I went with Binyam Demissie

nsadmin01 — Wed, 28 Sep 2016 18:08:59 GMT

I went with Binyam Demissie Option #1 and no issues.

Thx Binyam!

Re: Just to add to the suggested

Terence.Jh — Fri, 31 Jan 2020 15:48:38 GMT

Thank you so much for solving the problem that I did not solve in 30 minutes

Re: Problem Agent SourceFire

a ali — Wed, 16 Nov 2022 05:31:51 GMT

i have the same issue , as we added two active directory on agent one of them working fine and another one status is not available and after check agent log see this error ,

[0002] - Error connecting to 172.16.1.57: System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
at System.Management.ThreadDispatch.Start()
at System.Management.ManagementScope.Initialize( ...