Dears,
i need help related to cisco bug: CSCux82436.
Cisco Firepower management Center pulls user activity from the DC's event viewer and binds an Active Directory user to an ip-adress. However, in this case when no event-ID is generated, the FMC still believe it's user 2 that is logged in. This creates access lists-problems and surf privileges if you use AD-group based access list control.
Event ID 4778 and 4779 is by default generated when the user switch accounts, this called Fast User Switching (FUS), this is not supported in FPR agent as i have understood, but i am wondering if there are any Cisco agents that do support reading these events, EX: ISE-PIC or TS agent?
Or there are any workarounds to solve the FUS issue with FMC?
Looking forward to hearing from you.
Regards,
Muhannad
