Trend Micro TippingPoint
TM

Identity Agent Deployment Guide

TMTrend Micro Incorporated reserves the right to make changes to thisdocument and to the product described herein without notice. Before
installing and using the product, review the readme files, release notes,
and/or the latest version of the applicable documentation, which areavailable from the Trend Micro website at:https://docs.trendmicro.com/en-us/tippingpoint/security-managementsystem.aspx
Trend Micro, the Trend Micro t-ball logo, TippingPoint, and Digital Vaccine
are trademarks or registered trademarks of Trend Micro Incorporated. Allother product or company names may be trademarks or registeredtrademarks of their owners.
Copyright © 2023. Trend Micro Incorporated. All rights reserved.
Document Part No.: TPEM19840/230927
Release Date: December 2023
Protected by U.S. Patent No.: PendingThis documentation introduces the main features of the product and/or
provides installation instructions for a production environment. Readthrough the documentation before installing or using the product.
Detailed information about how to use specific features within the productmay be available at the Trend Micro Online Help Center and/or the Trend
Micro Knowledge Base.
Trend Micro always seeks to improve its documentation. If you havequestions, comments, or suggestions about this or any Trend Microdocument, please contact us at docs@trendmicro.com.
Evaluate this documentation on the following site:
https://www.trendmicro.com/download/documentation/rating.asp

Privacy and Personal Data Collection Disclosure
Certain features available in Trend Micro products collect and send feedback
regarding product usage and detection information to Trend Micro. Some ofthis data is considered personal in certain jurisdictions and under certain
regulations. If you do not want Trend Micro to collect personal data, youmust ensure that you disable the related features.
The following link outlines the types of data that TippingPoint Security
Management System collects and provides detailed instructions on how todisable the specific features that feedback the information.
https://success.trendmicro.com/data-collection-disclosure
Data collected by Trend Micro is subject to the conditions stated in the Trend
Micro Privacy Notice:https://www.trendmicro.com/privacy

Table of Contents
Chapter 1: Identity Agent User Guide
Chapter 2: System requirements
Chapter 3: Installation summary
Chapter 4: Pre-installation steps
Create a new Active Directory user ...................................... 4-2
Add the user to the Domain Administrators group ................ 4-3
Assign permissions for the Active Directory user .................. 4-4
Windows Firewall ............................................................... 4-5
Enable predefined Windows Firewall rules .................... 4-5
Create a new Inbound Windows Firewall rule ................. 4-6
Specify the amount of Identity Agent data to retain in the SMS.......................................................................................... 4-7

Chapter 5: Install Identity Agent
Add logon credentials for the Identity Agent service ............. 5-3
Provide full access for the Identity Agent service account ..... 5-4
Allow port access for Identity Agent user ....................... 5-5

Chapter 6: Identity Agent
Identity Agent configuration ............................................... 6-2
Create the initial Identity Agent configuration ................ 6-3
Manage domain controllers ..................................... 6-4
Add an IP address to the Mapped IPs list .................. 6-5
Remove an IP address from the Mapped IPs list .. 6-5iIdentity Agent User Guide

Add an IP address to the Excluded IPs list ................. 6-5
Remove an IP address from the Excluded IPs list ....
6-6
Manage custom schemas ......................................... 6-6

Chapter 7: Uninstall Identity Agent
Chapter 8: Where to go next
Chapter 9: Identity Agent issues and resolutions
Agent service not able to query domain controller security log
events ................................................................................ 9-2
Agent service not able to query domain controller OS
information ........................................................................ 9-3
OS information resolution ............................................. 9-4
Agent service is not able to communicate to domain controller.......................................................................................... 9-9
To enable Windows Firewall rules ................................. 9-9
Agent service cannot connect with SMS when TLS is enabled ....
9-13
Agent service running but not querying domain controllers forsecurity event logs ............................................................ 9-13
To modify the account ................................................. 9-14
Agent service is not creating db and logs folders ................. 9-15
To provide full access .................................................. 9-15
Agent APIs are not listening in agent port ........................... 9-17
Agent APIs are not accessible outside agent server .............. 9-19
Groups API call response with no data ................................ 9-19
Configuration changes are not reflected in the agent service 9-20
SMS is not able to establish connectivity with the Identity Agent......................................................................................... 9-21
Agent not able to establish LDAP connectivity ..................... 9-22
ii

Table of Contents

Agent not able to establish secure LDAPS connectivity ........ 9-23
To test domain controller connectivity ......................... 9-23
To test agent machine connectivity .............................. 9-25

iii

iv

Chapter 1

Overview
This guide provides information for installing and configuring the Trend
Micro™ TippingPoint™ Identity Agent in a Windows environment (Windows
Server 2008, 2008 R2, 2012, 2012 R2, 2016, and 2019).
Once configured, the Identity Agent will poll the Active Directory domain
controller to collect user account and user group information. The Identity
Agent will also poll the domain controller for security login events.
Once the SMS is configured to poll the Identity Agent, the SMS will display
the User ID to User IP correlation and security login events.
You can configure the Identity Agent to:• Connect to one or more domain controllers to poll user login
information.
• Change the default user/group and security log connection settings.
• Enable secure LDAP.
• Map or exclude IP addresses.
• If you customized your Active Directory schema, you can match thesame schema in the Identity Agent.

1-1

Chapter 2

System requirements
The tables in this topic provide the hardware, operating system, and software
requirements for the Identity Agent.
Hardware requirements
RAM

4 GB

Disk space

40 GB

Supported server operating system
Note the following requirements for the Identity Agent and the Active
Directory Server.
Supported editions

Operating system
Windows Server 201964-bitWindows Server 201664-bitWindows Server 2012 R2

64-bitWindows Server 2012 (64-bit edition)

64-bitWindows Server 2008 R2

64-bitWindows Server 2008

64-bit2-1

Identity Agent User Guide

Microsoft Kerberos
Microsoft Kerberos is an integral part of an Active Directory implementation.
Kerberos provides secure user authentication that permits interoperability.
The Active Directory domain controller maintains user account and log-in
information to support the Kerberos service.
The Identity Agent depends on Kerberos protocol being used in the Active
Directory authentication process. To make use of Kerberos, you must add
Kerberos to your Active Directory Server.

2-2Chapter 3

Installation summary
These checklists include cross-reference links to important concepts andtasks about deploying the Identity Agent. Complete the tasks in thischecklists in order.
When a reference link takes you to a topic, return to this topic after you
complete the tasks so that you can proceed with the remaining tasks in thischecklist.
If the Identity Agent Service account will have Administrative permissions
Follow the steps below if the Identity Agent Service account will haveadministrative permissions.
Step 1

Enable predefined Windows Firewall rules on page 4-5

Step 2Create a new Inbound Windows Firewall rule on page 4-6

Step 3

Add logon credentials for the Identity Agent service on page 5-3

Step 4

Provide full access for the Identity Agent service account on page 5-4

Step 5Specify the amount of Identity Agent data to retain in the SMS on page 4-7

Step 6

Install Identity Agent on page 5-1

Step 7Create the initial Identity Agent configuration on page 6-3

3-1

Identity Agent User Guide

If the Identity Agent Service account will not have Administrative
permissions
Follow the steps below if the Identity Agent Service account will not haveadministrative permissions.

3-2

Step 1Create a new Active Directory user on page 4-2

Step 2

Add the user to the Domain Users group on page 5-3

Step 3

Assign permissions for the Active Directory user on page 4-4

Step 4

Enable predefined Windows Firewall rules on page 4-5

Step 5Create a new Inbound Windows Firewall rule on page 4-6

Step 6

Add logon credentials for the Identity Agent service on page 5-3

Step 7

Provide full access for the Identity Agent service account on page 5-4

Step 8Specify the amount of Identity Agent data to retain in the SMS on page 4-7

Step 9Allow port access for Identity Agent user on page 5-5

Step 10Install Identity Agent on page 5-1

Step 11Create the initial Identity Agent configuration on page 6-3

Chapter 4

Pre-installation steps
This section describes the items that must be done before installing the
Identity Agent. Instructions are included in each topic.
Before you begin, see the Installation Summary on page 3-1 and thelatestTippingPoint SMS Release Notes available on the TMC.
Important
To secure your environment against POODLE, disable SSLv3 in the Windows
OS where the Agent will be installed. For assistance, contact Microsoft.

4-1

Identity Agent User Guide

Create a new Active Directory user
Use Active Directory Users and computers to create a new user account. This
user account will be used for running the agent service and connecting to thedomain controllers.
Before you begin
As a security best practice, consider using Run as Administrator to perform
this procedure. This procedure must be preformed on the domain controller.
Procedure
1.

Open Active Directory Users and Computers (Start > Control Panel >Administrative Tools > Active Directory User and Computers).
Alternatively, you can click Start, and then type dsa.msc.

2.

In the console tree, right-click the folder in which you want to add a user
account.

3.

Point to New, and then click User.

4.

Enter the following information, and then click Next.
Description

Field

5.

First name

Type the user's first name.

Last name

Type the user's last name.

Full name

Modify the user's full name to add initials or reverse the order ofthe first and last names.

User logon name

Type the user logon name, and then click the user principal name
(UPN) suffix in the drop-down list.

Enter the following information, and then click Next.
Description

Field/check box
Password

4-2

Type the user's password.

Pre-installation steps

Field/check box

6.

Description

Confirm password

Type the user's last name.

User cannot change
password

Select this check box to prevent the user from changing his or her
password and to maintain control over the user account.

Password never
expires

Select this checkbox to prevent the user password from expiring.
We recommend that service accounts have this option enabled
and use strong passwords.

Review the user account settings, and then click Finish.

Add the user to the Domain Administrators group
If you are going to provide administrative permissions to the Identity Agent
service account, you must add the Identity Agent service account to theDomain Administrators group.
Before you begin
As a security best practice, consider using Run as Administrator to perform
this procedure. This procedure must be preformed on the domain controller.

Procedure
1.

Open Active Directory Users and Computers (Start > Control Panel >Administrative Tools > Active Directory User and Computers).
Alternatively, you can click Start, and then type dsa.msc.

2.

In the console tree, click Users.

3.

Right-click on the user account, and then click Properties.

4.

On the Member Of tab, click the Domain Admins group to set as theuser's primary group.

5.

Click Set Primary Group.

4-3

Identity Agent User Guide

Assign permissions for the Active Directory user
If you do not have administrative credentials, you must assign certain
permissions to allow the Active Directory user to perform specific actions,such as connecting to the Identity Agent.
Before you begin
If you have administrative credentials, skip this procedure, as the user
already has these permissions assigned by default.
As a security best practice, consider using Run as Administrator to perform
this procedure. This procedure must be preformed on the domain controller.
Procedure
1.

Open Computer Management (Start > Control Panel > System andSecurity > Administrative Tools > Computer Management).

2.

In the navigation pane, expand Services and Applications, right-click
WMI Control, and then click Properties.

3.

Expand Root, select CIMV2, and then click Security.

4.

Click the Security tab.

5.

Click Add.

6.

On the Select Users, Computers, Service Accounts, or Groups dialog box,
select the following items, and then click OK.
• (Optional) Click Locations to define the root location from which tobegin your search for the Identity Agent user.
• Type the name of the Identity Agent user in the Enter the object
names to select field.
• (Optional) Click Check Names to locate all matching or similar
object names listed in the Enter the object names to select field.

7.

4-4

Select the Identity Agent user from the Group or user names list, andthen select the following check boxes to Allow permissions:Pre-installation steps• Enable Account• Remote Enable• Read Security
8.

Click Apply.

9.

Repeat this procedure in all domain controllers that are configured in
the Identity Agent.

Windows Firewall
Windows Firewall with Advanced Security allows you to require thatcomputers authenticate before communicating with the Identity Agent.
From here, you must:• Enable predefined firewall rules to activate the rule and allow the user toconnect to the Identity Agent through Windows Firewall.
• Create a new rule to allow a connection based on the TCP port number
over which the computer is trying to connect to the Identity Agent. You
can specify more than one port number. The port numbers will display
in the Agent Port field in the Identity Agent.

Enable predefined Windows Firewall rules
Use Windows Firewall with Advanced Security to enable predefined rules.
Before you begin
This procedure must be preformed on the domain controller.
Procedure
1.

Open Windows Firewall (Start > Control Panel > System and Security >Windows Firewall).

2.

In the Control Panel Home navigation pane, click Advanced Settings.

3.

In the navigation pane, click Inbound Rules.
4-5

Identity Agent User Guide

4.

Search for the following rules, right-click on the rule, and then click
Enable Rule.
For this
Windowsversion:Windows Server
2008

Enable the following rules ...
• Remote Administration (RPC)• Windows Management Instrumentation (DCOM-In)• Remote Event Log Management (RPC)

Windows Servers
2012, 2016, 2019

• Remote Service Management (RPC)• Windows Management Instrumentation (DCOM-In)• Remote Event Log Management (RPC)

Create a new Inbound Windows Firewall rule
Before you begin
To perform this procedure, you must be a member of the Domain
Administrators group. This procedure must be preformed on the Identity
Agent server.
Procedure
1.

Open Windows Firewall (Start > Control Panel > System and Security >Windows Firewall).

2.

In the Control Panel Home navigation pane, click Advanced Settings.

3.

In the navigation pane, click Inbound Rules.

4.

In the Actions navigation pane, click New Rule.
The New Inbound Rule Wizard opens.

5.

4-6

Use the wizard to create a rule to explicitly allow a connection to the
Identity Agent through Windows Firewall. Click Next to go through eachwizard page.

Pre-installation steps

On this wizard
step (page):
Rule Type
Protocol and Ports

Select the following ...
Port.
• TCP
• Specific local ports, and then type the port number (8443).
Only the port number listed in this field will be able tocommunicate with the Identity Agent.
You can specify multiple port numbers, separated by commas.
You can also include a range of port numbers by separating the
low and high values with a hyphen.

ActionProfileAllow the connection.
• Domain• Private• Public

Name

6.

Type a name for the rule in the Name field.

Click Finish. The rule appears in the Inbound Rules list, and the port for
the Identity Agent in the Windows Firewall is open.

Specify the amount of Identity Agent data to retainin the SMS
Use the Database Maintenance table in the SMS (Admin > Database) to
manage the following maintenance settings for the Identity Agent:• User ID IP Correlation• IP User Mapping• Historical IP User Mapping
By default, the each maintenance settings is set to a default of a maximum of
10 million rows, and the SMS polls the Identity Agent for security login
events at a rate of up to 7000 per minute.
4-7

Identity Agent User Guide

When you reach the maximum number of entries, the SMS automaticallydeletes a percentage of the oldest events and a cleanup is requested/scheduled by the SMS.
You can manage the User ID IP Correlation data maintained by the SMS
when you perform Database Maintenance and specify retention parameters
for the data. For more information about managing TippingPoint systems,
see the TippingPoint SMS User Guide or the SMS online Help.
Kerberos events
Use the following Kerberos event IDs in the Identity Agent security logs as a
guide for adjusting the maximum number of rows in the Database
Maintenance tables:• 4768• 4769• 47704-8Chapter 5

Install Identity Agent
Procedure1.

Log in to the TMC.

2.

Download the TippingPoint Identity Agent zip file.

3.

Log in with the administrator account in the Identity Agent service
account and copy the zip file.

4.

Unzip the file, right-click on setup, and then click Run as administrator.
The Identity Agent - InstallShield Wizard opens.

5.

Use the wizard to accept the terms of the license agreement, create auser name, and to select or change the location where the application
will be installed. Click Next to go through each wizard page.
On this wizard step
(page):Do the following ...

License Agreement

Read and accept the terms in the license agreement. You canalso print a copy of the agreement.

Customer Information

Type a user name and organization.

Destination Folder

Review and confirm the location or browse to and select a newlocation to install the Identity Agent.

5-1

Identity Agent User Guide

6.

Click Install, and then click Finish.
The Identity Agent installs the service and configuration tool and createsa desktop icon.

5-2Install Identity Agent

Add logon credentials for the Identity Agent
serviceUse Services to configure the user account for the Identity Agent. This user
account is used for running the agent service to connect to the domain
controllers.
Before you begin
As a security best practice, consider using Run as Administrator to perform
this procedure.
Procedure
1.

Open Services (Start > Control Panel > Administrative Tools >Services).

2.

In the details pane, right-click the Identity Agent service, and then click
Properties.

3.

Click the Log On tab.

4.

Select This account, and then click Browse.

5.

On the Select User dialog box, select the following items, and then click
OK.
• Verify that the location listed in the From this location field is thename of the machine hosting the agent.
Note
If the location listed is not the domain in which the agent will connect,
click the Locations button, and then browse to and select the appropriate
domain.

• Type the name of the Identity Agent user in the Enter the object
names to select field.
• (Optional) Click Check Names to locate all matching or similar
object names listed in the Enter the object names to select field.
5-3

Identity Agent User Guide

The Identity Agent user displays in the This account field.

6.

Enter and confirm the password, and then click OK.

Provide full access for the Identity Agent service
account
After you install the Identity Agent, update the security properties.
5-4

Install Identity Agent

Procedure
1.

Navigate to the folder in which you installed the Identity Agent.
If you used the default settings, the Identity Agent is located in the
Program Files.

2.

Right-click TippingPoint, and then click Properties.

3.

Click the Security tab.

4.

Click Edit.

5.

On the Permissions for Identity Agent dialog box, click Add.

6.

On the Select Users, Computers, Service Accounts, or Groups dialog box,
select the following items, and then click OK.
• (Optional) Click Locations to define the root location from which tobegin your search for the Identity Agent user.
• Type the name of the Identity Agent user in the Enter the object
names to select field.
• (Optional) Click Check Names to locate all matching or similar
object names listed in the Enter the object names to select field.

7.

Select the Identity Agent user from the Group or user names list, andthen select the Full control check box under Allow permissions.

8.

Click Apply.

Allow port access for Identity Agent user
If the Identity Agent user does not have administrative rights, use thecommand-line to allow port access to the Identity Agent.
netsh http add urlacl url=https://*:8443/
user=USERIDAGENT1\TP_IdentityAgentIn the example above:• 8443 is the Identity Agent port number
5-5Identity Agent User Guide• USERIDAGENT is the Identity Agent domain• TP_IdentityAgent is the Identity Agent service account

5-6

Chapter 6

Identity AgentThe Identity Agent keeps track of specific groups based on IP address withthe goal of maintaining Identity Management and efficiently enforcing user
policies.
The Identity Agent adds another layer of network policy refinement by using
Active Directory (AD) of users and user groups. Through its interaction withan AD domain controller, the Identity Agent enables SMS administrators tokeep track of specific users and groups based on IP address. The Agent
constantly polls the security logs of the AD domain controller--at a rate of
every four to five seconds for security login events and every 15 minutes for
metadata and diagnostics--and communicates this information to the SMS.
With this degree of visibility for the SMS, administrators can target policies
according to, for example, an engineering group vs a marketing group. The
service is most useful in environments where control and visibility are ahigher priority than filter management.
This enables the SMS to determine the IP address of any user/group.

6-1

Identity Agent User Guide

Identity Agent configuration
Identity Agent configuration is the Identity Agent component where the you
configure the agent, manage domain controllers, set connection settings,
and maintain a list of mapped or excluded IP addresses.
The following table describes the main areas of the Identity Agent interface
is divided into four main areas.
Field

Description

Agent Host IP

Displays all available IP addresses. Once you select an IP addressand click save, this field will be unavailable. If you want to select a
different IP address, you must uninstall and reinstall the Identity
Agent.

Agent Port

The port in which the Identity Agent will communicate with the
SMS. Remember that this port must also be the port that is open in
the Windows Firewall.

Domain Name

The domain name that the Identity Agent is connected to.

Base DN

The distinguished name of the node in the active directory underwhich all users and groups are located.

Domain Controller
IP Address

The IP address of the domain controller. You can have up to 30
domain controllers, but remember that the first one entered will be
the primary domain. If you want to set a different primary domain
controller, you must remove all IP addresses from the list, and thenreenter the IP address or hostname.

Connection Settings

6-2

User/Group Poll

The amount of time that the Identity Agent will poll the user andgroup information. The default frequency of is every 15 minutes.

Security Log Poll

The amount of time that the Identity Agent will poll the login
security events. The default frequency is every four to five seconds.

Secure LDAP

Determines whether the LDAP is secure.

Identity Agent

Field

Description

Mapped IPs

Displays a list of correlated, or permitted, IP addresses. You can add
an individual IP address, a range, or a CIDR. If the list is blank, theIdentity Agent will correlate all IP addresses.

Excluded IPs

Displays a list of values that you do not want to correlate from the
Identity Agent.

Custom Schema

If you customized your Active Directory schema, you can match thesame schema in the Identity Agent.

Create the initial Identity Agent configuration
Procedure1.

Double-click the Identity Agent desktop icon.

2.

Select an IP address from the Agent Host IP drop-down list.
Important
The Agent Host IP is only entered one time. The next time you access theconfiguration, this field will appear unavailable. After you save the initialconfiguration, you must reinstall the Identity Agent if you want to update
the host IP address.

3.

Type the Identity Agent domain name in the Domain Name field.
Important
The domain name must be the same name listed in the Permissions for
Identity Agent dialog box on page 5-4.

4.

Type the distinguished name of the node in the Active Directory underwhich all the users and groups are located in the Base DN field.

6-3

Identity Agent User Guide

Important
Separate the CN, OU, and DC with commas.

5.

Type an individual IP address, range or CIDR in the IP Address field, andthen click the + icon.

6.

Enter the user/group mapping polling frequency in the User/Group Pollfield.

7.

Enter the security log polling frequency in the Secuirty Log Poll field.

8.

(Optional) Select the check box to enable secure LDAP.

9.

Click Save.

10. Click Yes to restart the Identity Agent service and to apply theconfiguration.

Manage domain controllers
Up to 30 domain controllers are supported for each Identity Agent.
Multi-domain users: Each domain (or subdomain) must have an Identity
Agent configured on a server located within that domain (or subdomain).
Load balancing: If your network uses multiple domain controllers for a
subdomain, connect each domain controller to the same Identity Agent. The
Identity Agent can communicate with up to 30 domain controllers.
Important
Each subdomain must have its own Identity Agent.

Procedure

6-4

1.

Double-click the Identity Agent desktop icon.

2.

Select an IP address from the Domain Controller list.

3.

Click the - icon.

Identity Agent

4.

Click Save.

5.

Click Yes to overwrite the existing configuration.

Add an IP address to the Mapped IPs list
You can have up to 64 IP addresses listed for each Identity Agent.
Procedure1.

Double-click the Identity Agent desktop icon.

2.

Click the Mapped IPs tab.

3.

Enter an individual IP address, range or CIDR in the IP Address field.

4.

Click the + icon.

5.

Click Save.

6.

Click Yes to overwrite the existing configuration.

Remove an IP address from the Mapped IPs list
Procedure1.

Double-click the Identity Agent desktop icon.

2.

Click the Mapped IPs tab.

3.

Select an individual IP address, range or CIDR from the IP Address field.

4.

Click the - icon.

5.

Click Save.

6.

Click Yes to overwrite the existing configuration.

Add an IP address to the Excluded IPs list
You can have up to 64 IP addresses listed for each Identity Agent.
6-5

Identity Agent User Guide

Procedure1.

Double-click the Identity Agent desktop icon.

2.

Click the Excluded IPs tab.

3.

Enter an individual IP address, range or CIDR in the IP Address field.

4.

Click the + icon.

5.

Click Save.

6.

Click Yes to overwrite the existing configuration.

Remove an IP address from the Excluded IPs list
Procedure1.

Double-click the Identity Agent desktop icon.

2.

Click the Excluded IPs tab.

3.

Select an individual IP address, range or CIDR from the IP Address field.

4.

Click the- icon.

5.

Click Save.

6.

Click Yes to overwrite the existing configuration.

Manage custom schemas
If you customize your Active Directory schema, you can match the same
schema in the Identity Agent.
Procedure

6-6

1.

Double-click the Identity Agent desktop icon.

2.

Click the Custom Schemas tab.

3.

Enter a value in the User Object Class field.

Identity Agent

4.

Enter a value in the Unique Identifier field.

5.

Enter a value in the Member Of field.

6.

Enter a value in the Groups Object Class field.

7.

Enter a value in the Distinguished Name field.

8.

Click Save.

9.

Click Yes to overwrite the existing configuration.

6-7

Chapter 7

Uninstall Identity Agent
Follow these steps to uninstall the Identity Agent. Alternatively, you can also
uninstall the agent from the Windows Control Panel.

Procedure
1.

Navigate to the folder in which you installed the Identity Agent.
If you used the default settings, the Identity Agent is located in the
Program Files.

2.

Right-click on setup, and then click Run as administrator.
The Identity Agent - Install Shield Wizard opens.

3.

Use the wizard to remove the Identity Agent from your computer. Click
Next to go through each wizard page.
On this wizard
step (page):

Do the following ...

License Agreement

Read and accept the terms in the license agreement. You can also
print a copy of the agreement.

Customer
Information

Type a user name and organization.

7-1

Identity Agent User Guide

On this wizard
step (page):
Destination Folder

4.

Do the following ...
Review and confirm the location or browse to and select a newlocation to install the Identity Agent.

Click Remove, and then click Finish.
The Identity Agent removes all installed files except for the logs and theConfig file.

7-2

Chapter 8

Where to go next
The SMS is a central console where you can manage multiple TippingPoint
devices, products, and services. After the initial setup, you can begin
monitoring and managing your TippingPoint systems.
Connect the Identity Agent in the SMS from the Admin workspace (Admin >User Id IP correlation).
Once the SMS is configured to poll the Identity Agent, the SMS will display
the User ID to User IP correlation and security login events. When you firstconnect the Identity Agent in the SMS, the SMS will automatically poll the
domain controller for the last 15 minutes of historical information.
For complete information about managing TippingPoint systems, see the
TippingPoint SMS User Guide or the SMS online Help.

8-1

Chapter 9

Identity Agent issues and resolutions
This document covers the agent issues found during pre-installation,
installation, and post installation as well as the steps required to resolvethese issues.

9-1

Identity Agent User Guide

Agent service not able to query domain controller
security log eventsIssue
The agent service is not able to query domain controller security log events.
Root cause
The Identity Agent service logon user does not have sufficient privileges in
the active directory (AD) to access security log events.
Resolution
To resolve this problem, verify in the AD that the Identity Agent service logon
user account has the following group membership:• Domain Users(OR)• Distributed COM Users• Event Log Readers• Performance Monitor Users
If it doesn't have the correct membership, then it should be added.
The image below shows an example of adding a group membership to a user
account.

9-2

Identity Agent issues and resolutions

Note
If you are using the Domain Admins approach, only that group will be
displayed in the membership tab.

Agent service not able to query domain controller
OS information
Issue
The agent service is not able to query domain controller OS information forthe meta-data.

9-3

Identity Agent User Guide

Additional info in agent logs
[DIAGNOSTICS] WARN ADAgentService.Diagnostics.DiagnosticWorker Encountered unexpected exception trying to obtain directory controller
meta-data:
System.Management.ManagementException: Access denied

Root cause
The Identity Agent service logon user does not have sufficient WMI
privileges in the domain controller to access OS information.

OS information resolution
Follow these steps to allow the Identity Agent Service account to have access
to WMI in the domain controller. These steps need to be executed in all
domain controllers, which will be configured in the agent.
Procedure

9-4

1.

In the domain controller, click Start, click Administrative Tools, andthen click Computer Management.

2.

Within the management console, navigate to Services and Applications> WMI Control.

3.

Right-click WMI Control, and select Properties.

Identity Agent issues and resolutions

4.

Navigate to Security.

5.

Add your Identity Agent service logon user account, and modify thedomain controller permissions so that the agent will be able to connect.

6.

Expand the namespace to Root > CIMV2, and select the Security button
as shown in the image below.

9-5

Identity Agent User Guide

7.

9-6

Select Add, and choose your service account, as described above, to thelist of users that will have the specified permissions.

Identity Agent issues and resolutions

8.

Enter the name of the account that you will operate the service under,
verifying that the value for Location is appropriate.
In the example below, it points to the AD domain.

Note
Select Check Names if you are uncertain of the correct location, and theuser account will be validated.

9.

After adding the user successfully, select the appropriate permissions
for the CIMV2 Namespace for the user account as shown below.

9-7

Identity Agent User Guide

The specified permissions that are required are:• Enable account• Remote Enable• Read Security
No other permissions should be necessary.

9-8

Identity Agent issues and resolutions

Agent service is not able to communicate todomain controller
Issue
The agent service is not able to communicate with the domain controller.
Root cause
The domain controllers are protected by a firewall.
Resolution
If your domain controllers are protected by the built-in Windows Firewallwith Advanced Security, you will need to enable the following rules on eachdomain controller to be monitored by the Identity Agent.
In Windows 2008
• Remote Administration (RPC)• Windows Management Instrumentation (DCOM-In)• Remote Event Log Management (RPC)
In Windows 2012
• Remote Service Management (RPC)• Windows Management Instrumentation (DCOM-In)• Remote Event Log Management (RPC)

To enable Windows Firewall rules
Procedure
1.

Go to Start > Control Panel.

2.

Click the System and Security link, and then click Windows Firewall.

9-9

Identity Agent User Guide

3.

9-10

In the main Windows Firewall control window, click the Advanced
Settings link on the left.

Identity Agent issues and resolutions

You will see the Windows Firewall and Advanced Security window asshown below.

9-11

Identity Agent User Guide

9-12

4.

On the left, click Inbound Rules.

5.

Within the list of Inbound Rules, search for the correct rule, right click
it, and then click Enable Rule.

6.

Verify that the firewall rule is enabled after completing the above steps.

Identity Agent issues and resolutions

Agent service cannot connect with SMS when TLS
is enabled
Issue
When TLS v1.2 is enabled on an SMS that has a 1K key, the Identity Agent willshow a status of Agent cert invalid and the SMS will not populate theserver details or gather data. The SMS returns a warning of Identity
Agents may not function properly without a SMS 2k Certificate
Key while TLS v1.2 is enabled.

Root cause
TLS v1.2 requires a 2K key, and the SMS has only a 1K key.
Resolution
To continue with a 1K key, disable TLS. To continue with TLS enabled,
upgrade the SMS to a 2K key.

Agent service running but not querying domain
controllers for security event logs
Issue
The agent service is running, but it is not querying domain controllers forthe security event logs.
Root cause
A valid domain logon user account is not specified in the Identity Agent
service.
Resolution
Follow the steps in To modify the account on page 9-14 to resolve this issue.

9-13

Identity Agent User Guide

To modify the accountTo modify the account under which the agent will operate, perform thefollowing steps.
Procedure

9-14

1.

Open Control Panel > Administrative Tools > Services.

2.

Navigate to the entry for the Identity Agent Service, right click theentry, and select Properties.

3.

Navigate to the Log On tab within the service properties.

4.

Select the icon next to This account, and click Browse as shown in theimage below.

5.

Search for the correct domain account, click OK, and then restart the
Identity Agent service.

6.

Restart the Identity Agent service after completing the above steps.

Identity Agent issues and resolutions

Agent service is not creating db and logs folders
Issue
The agent service is not creating the db and logs folders and files that areneeded for agent functioning.
Root cause
The Identity Agent service logon user does not have sufficient permission tocreate or modify folders and files in the agent installed folder.
Resolution
Provide full access for the service account to the Identity Agent installedfolders. Follow the steps in To provide full access on page 9-15 to resolve thisissue.

To provide full access
Procedure
1.

Right click the TippingPoint folder in which the agent has been
installed, and select the Properties action at the bottom of the context
menu.

9-15

Identity Agent User Guide

2.

Navigate to the Security tab, and select the Edit button.

3.

Click Add to add the appropriate user. Make sure to add the domain user
account with which you intend to execute the agent.

4.

After adding that account to the list, select the Allow check box on the
Full Control entry with the correct user highlighted.
Ensure that the appropriate check boxes are all selected.

9-16

Identity Agent issues and resolutions

5.

Click OK.

Agent APIs are not listening in agent port
Issue
The agent APIs are not listening in the agent port. There is no response to
API calls.
Additional information in event logs
Description:
The process was terminated due to an unhandled exception.
Exception Info:
9-17

Identity Agent User Guide

System.Net.HttpListenerException
Stack: at System.Net.HttpListener.Start() at
ADAgentService.Http.HttpServer..ctor(System.Collections.Generic.List`1<ADAgentService.Http.PortConfiguration>)

Root cause
The following are possible causes:• The Identity Agent service logon user does not have sufficientpermission to register HTTP Listeners.
• The agent port might already be reserved for other services.
Resolution• Add the Identity Agent service logon user to the local administratorgroup, and restart the Identity Agent service.
OR• Verify that any URL reservation is already present for that port. If it is,delete the URL reservation, add the new URL ACL, and restart the
Identity Agent service.
Commands
Command to show URL ACL:
netsh http show urlacl

Command to delete URL ACL:
netsh http delete urlacl url=https://*:agentport/

Example:netsh http delete urlacl url=https://*:8445/

Command to add URL ACL:
netsh http add urlacl url=https://*:Agent Port/ user=Domain\agent service account

9-18

Identity Agent issues and resolutions

Example:netsh http add urlacl url=https://*:8445/
user=USERIDAGENT1\TP_IdentityAgent

Agent APIs are not accessible outside agent server
Issue
The agent APIs are not accessible outside of the agent server.
Root cause
The agent server firewall is restricting access to the agent port.
Resolution
Open the port for the Identity Agent in the Windows Firewall in an agentinstalled machine.

Groups API call response with no data
Issue
The groups API call (GET/groups) has a response with no data.
Root cause
The following are possible causes:• The Identity Agent service logon user does not have sufficient privilegesin the AD to query group and user objects.
• An invalid Base DN value is specified in the configuration tool.
• There are invalid user and group object attributes specified in theconfiguration tool.
Resolution
There are several possible solutions to resolve this problem:
9-19

Identity Agent User Guide• Verify that the Identity Agent service logon user has sufficient privilegesin AD to query group and user objects. If not, add the necessaryprivileges to the service logon domain user account. Add the user
account to the Domain Users group.
• Verify that a valid Base DN value is specified in the configuration tool.
There is a high probability of a typo error occurrence. Validate that theBase DN value specified in the configuration tool is present in theconfigured AD.
• Verify that there are valid user and group object attributes specified in
the configuration tool. There is a high probability of a typo error
occurrence. Validate that the user and group object attributes value
specified in the configuration tool is present in the configured AD.
Make sure to restart the service after any changes are made in theconfiguration tool.

Configuration changes are not reflected in theagent service
Issue
Configuration changes made in the configuration tool are not reflected in theagent service.
Root cause
The agent service is running with stale configuration data, and it was notrestarted after configuration changes were made.
Resolution
Restart the Identity Agent service to reflect the latest configuration changes.

9-20

Identity Agent issues and resolutions

SMS is not able to establish connectivity with the
Identity Agent
Issue
The SMS is not able to establish connectivity with the Identity Agent.
Root cause
The following are possible causes:• The agent service is not running.
• The SMS does not connect using the agent configured IP.
• The SMS mandatory certificates are not properly installed in the agent
server.
• The agent self-signed certificate was not properly created and installedin the agent server.
• The agent port is not open in the firewall.
Resolution
There are several possible solutions to resolve this problem:• Verify that the agent service is running in the agent server. If not, restart
the Identity Agent service.
• Verify that the SMS is trying to connect using the agent IP, which ispresent in the agent configuration tool. To validate the agent IP, log in to
the agent server and open the configuration tool.
• Verify that the SMS root certificates are properly installed in the agent
server.
To do this, go to run > mmc > File > Add/Remove snap-in > Certificates> Add > Computer account > Finish > OK.
Verify that the SMS root certificate is present in Trusted Root
Certification Authorities/Certificates.

9-21

Identity Agent User Guide• Verify that the self-signed certificates are properly created and installedin the agent server.
To do this, go to run > mmc > File > Add/Remove snap-in > Certificates> Add > Computer account > Finish > OK.
Verify that the SMS root certificate is present in Personal/Certificates.
If the correct certificate is not present, uninstall the Identity Agent andreinstall it. After you reinstall the agent, the correct certificate is
automatically generated and installed.
• Verify that the IP address is the same on the Identity Agent (on theserver) and the SMS. If you receive an error message that the Identity
Agent certificate is invalid, uninstall the Identity Agent and then installit again on the server.

Agent not able to establish LDAP connectivity
Issue
The agent is not able to establish LDAP connectivity for user group mapping.
Root cause• The AD is not configured to listen on LDAP port (389).
• The firewall is blocking the connection that uses the LDAP port (389).
Resolution
Verify that the LDAP port is blocked by the firewall. If the firewall is blocking
the LDAP port connectivity between the domain controller and the agent
server, then open the port.

9-22

Identity Agent issues and resolutions

Agent not able to establish secure LDAPS
connectivity
Issue
The agent is not able to establish LDAPS connectivity for user groupmapping.
Root cause• The AD is not configured to listen on the LDAPS port (636).
• The firewall is blocking the connection that uses the LDAP port (636).
Resolution
Verify that the domain controller is configured to listen on the LDAPS port
(636).
Verify that the LDAPS port is blocked by the firewall. If the firewall isblocking the LDAPS port connectivity between the domain controller and theagent server, then open the port.

To test domain controller connectivity
To test the LDAPS connectivity in the domain controller using ldp.exe,
perform the following steps.
Procedure
1.

Login to the domain controller by going to Start > Run > type Idp.exe.

2.

Click Connection, and then click Connect as shown in the image below.

9-23

Identity Agent User Guide

9-24

3.

Enter the full FQDN of the domain controller for the server, enter 636 forthe port, and select the SSL check box, as shown in the image below.

4.

Click OK.

5.

If you receive the domain information, the LDAPS connection was
performed successfully, as shown in the image below.

Identity Agent issues and resolutions

To test agent machine connectivity
To test the LDAPS connectivity in agent machine using ldp.exe, perform thefollowing steps.
Procedure
1.

Login to the agent machine by going to Start > Run > type Idp.exe.

2.

Click Connection, and then click Connect as shown in the image below.

9-25

Identity Agent User Guide

9-26

3.

Enter the full FQDN of the domain controller for the server, enter 636 forthe port, and select the SSL check box, as shown in the image below.

4.

Click OK.

5.

If you receive the domain information, the LDAPS connection was
performed successfully, as shown in the image below.

Identity Agent issues and resolutions

9-27

Item Code: TPEM19840/230927