Skip to main content
daac
daac
New Member
December 18, 2017
Question

Event id Winserver Fsso Agent based

  • December 18, 2017
  • 1 reply
  • 9653 views

Hello if you can help me with a clarification, I am setting up a small lab with an ad win server 2008, and seeing the logon and logoff events log I see that when entering the user credentials in a pc they register several 4624 logon events and then several of 4634 of logoff, reading a bit I find that these events can be of various types, I see events type 3 that are network and events type 2 Interactive and others have no type, for the case of the installation of collector and dc agent what kinds of events and type it takes to send the collector and collector to fortigate. According to documentation http://kb.fortinet.com/kb....do?externalID=FD36424 I do not see a relation of the 4634 events that correspond to logoff Thank you

    1 reply

    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    December 19, 2017

    Hi,

    AFAIK Collector, if set, process all 4624, but due to misleading info in type 3 (Network) those are going to be excluded from 4624 processing. I'm also unaware of 4634 processing. Collector used to use Remote Registry Service and now they use WMI API to check user presence without relying on 4634.

    Best regards,

    Tomas

    joe72
    joe72
    New Member
    June 6, 2018

    Hi Tomas,

    we have more or less the same problem, the CA missing several logon, all logon have Event ID 4624 type 3, I don't know how to troubleshooting this problem, because the situation is very randomicaly.

     

    Have you Suggestions ?

     

    Thanks

    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    June 6, 2018

    Hi,

    4624 type 3 are Network logons. Logons like to shared printer or folder. Most probably you do not want those logons in your FSSO at all, as their Data contain misleading IP so the users overwrite each other in FSSO user list. Similar issue as with RDP.

     

    We can use re_4624 entry to get rid of 4624 type 3.

    Launch regedit.exe, go to HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Fortinet\FSAE\collectoragent, create an entry called "re_4624", the type for this entry is REG_SZ, enter value 'LogonType:(?!3).', it could filter out EventID 4624 Network logon (type 3).

     

    Tomas

    Terms & ConditionsAccessibility statement