https://community.cisco.com/t5/network-security/firepower-user-agent-gives-stale-data/m-p/3075180#M988437 <P>Hi all,</P> <P>Im trying to look at where accounts are been used but some results been returned are stale - ie shows&nbsp;traffic against my user when I know it was another user who has been logged onto the same device for longer than I have.</P> <P>Can the agent be tweaked to show the correct user in this instance? And/or can it be tweaked to remove the AD-IP link once a user logs off a device?</P> <P>Thankyou</P> <P>Paul</P> <P></P> Tue, 12 Mar 2019 13:27:33 GMT pbarber 2019-03-12T13:27:33Z https://community.cisco.com/t5/network-security/firepower-user-agent-gives-stale-data/m-p/3075180#M988437 <P>Hi all,</P> <P>Im trying to look at where accounts are been used but some results been returned are stale - ie shows&nbsp;traffic against my user when I know it was another user who has been logged onto the same device for longer than I have.</P> <P>Can the agent be tweaked to show the correct user in this instance? And/or can it be tweaked to remove the AD-IP link once a user logs off a device?</P> <P>Thankyou</P> <P>Paul</P> <P></P> Tue, 12 Mar 2019 13:27:33 GMT https://community.cisco.com/t5/network-security/firepower-user-agent-gives-stale-data/m-p/3075180#M988437 pbarber 2019-03-12T13:27:33Z https://community.cisco.com/t5/network-security/firepower-user-agent-gives-stale-data/m-p/3075181#M988448 <P>Is there only a single DC in the domain? You need to have a user agent polling each DC that processes logon/logoff events.</P> <P>If that's setup then the user logon data should be updated every few minutes.</P> <P>Logoff events are hard to use definitively since many users don't actually logoff - they just lock the computer or let it sleep/hibernate.</P> <P>As far as I know, you can't manually override the data reported by User Agent.</P> Tue, 11 Jul 2017 09:00:44 GMT https://community.cisco.com/t5/network-security/firepower-user-agent-gives-stale-data/m-p/3075181#M988448 Marvin Rhoads 2017-07-11T09:00:44Z