topic Sourcefire User Agent Authentication error in Network Security

Sourcefire User Agent Authentication error

shubhamkulkarni39 — Tue, 12 Mar 2019 12:43:18 GMT

Hi All,

I am facing major issue in Sourcefire User agent, we want to integrate AD with Sourcefire,

We added Ldap Connection in Sourcefire, that successfully added,

we tried to install User agent on AD, but there was requirement for .net framework and sql, we installed and run User agent,

now User agent is installed, but when we try to connect with AD, fill all parameters Server IP, Domain, User name , Password, but there was continues error showing there was a error connecting to server, please check user name password and permission (1),

we have done DCOM, WMI, RPC seetings in AD, but still problem exists,

Exact error is: Authentication Error connecting to AD IP address
System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
at System.Management.ThreadDispatch.Start()
at System.Management.ManagementScope.Initialize()
at Tools.Troubleshooter.testADServerConnection()Unable to determine AD Server's OS. - 1

Can you help me for the same!

Thanks

What version of Windows is

Aaron O'Hare — Thu, 05 Nov 2015 18:43:48 GMT

What version of Windows is running on your DCs?

-AO

Hi shubhamkulkarni39,

wladimir.gruenemaier — Thu, 10 Dec 2015 10:50:13 GMT

Hi shubhamkulkarni39,

i have the same problem. How did you solve it?

Thanks

Hi,

Pujita Patni — Thu, 10 Dec 2015 13:36:26 GMT

Hi,

I hope everything mentioned here is taken care of:

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118637-configure-firesight-00.html

The username is a admin account ? Is it part of the domain ?

On Step 8, the doc suggests to enable "Allow" only to Remote Launch/Remote Activation. Can you also allow "Local Launch and Local Activation" as well and check.

Pujita

My similar issue was due to

john.cunningham — Thu, 10 Dec 2015 14:07:35 GMT

My similar issue was due to not being able to read the Security Events in Eventviewer. Nothing worked short of domain admin privs. A service account with elevated logging privs did not work. My less privileged but still very elevated account did not work. Our top AD guy custom made groups with specific logging rights. Still did not work. Still an issue. Perhaps the links in this thread will shed light.

https://tools.cisco.com

wladimir.gruenemaier — Mon, 08 Feb 2016 17:24:45 GMT

Stop derailing if cannot translate service account to SecurityIdentifier

CSCuw20184