Firepower user agent not working

[andy_4578]

Hi All,

We've had an on going problem with the user agent for firepower since day 1, at the moment it just keeps saying "error processing event record - No domain information" (see screen shot).

The Active directory server has checked in and shows green, the Firepower is showing green.  We can download users/groups from within firepower on the ASA but none of the user information is being recognised. I cant find anything relating to this error on google.

Thanks

[Puneesh Chhabra]

Hi,

Could you please confirm the minimum permissions for user-agent on AD as per following article:
https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118637-configure-firesight-00.html

And then restart following two services on server:
Windows event Collector
Windows Event Log Services

Regards,
Puneesh

Please rate helpful posts

[andy_4578]

Hi,
I managed to fix it by uninstalling user agent 4.0 and installing the older 3.10 version, I also deleted the .sdf database file on the C:\ drive of the server where the user agent is installed before re-installing 3.10.

Thanks