What is this email alert: TUI-AD: All AD agents are down for realm Windows?

keithsauer507 · ‎03-24-2014

I added our IT group e-mail to the Ironport S160 to be alerted when product keys are about to expire. Our IronPort C160 e-mail filter does this but the S160 did not.

We periodically get this email:

Subject: Critical <System> webfilter.domain.com: TUI-AD: All AD agents are down for realm Windows

The Critical message is:

TUI-AD: All AD agents are down for realm Windows

Product: Cisco IronPort S160 Web Security Appliance

Model: S160

Version: 7.5.1-079

Serial Number: (removed for public posting)

Timestamp: 24 Mar 2014 07:20:27 -0400

Any idea what this means? Everything is working normally. How can I stop this message?

Lee Valentin · ‎03-24-2014

Transparent User Identification. This alert is normally generated when the WSA loses contact with the AD agent. Could be a flap on the network if across a WAN link or could be an issue on the machine where you have the AD agent installed.

The downside is that you will never get a success alert.

I believe worst case scenario is if your policies require user authentication, users may be prompted to authenticate when going to the web.