Technical Tip: How to trigger the User Access Integration with Active Directory

[ymasaki]

Description	This article describes how to trigger the User Access Integration to disable a domain user or reset a domain user password with Active Directory.
Scope	FortiEDR v6.0.
Solution	To set up the User Access connector, visit the administration guide for more information: User Access integration Make sure the test is successful in the User Access connector : The Playbook is in Prevention mode and assigned to the correct group (Enable 'Disable user' or 'Reset user password'): Logged in as a domain user ('fortilabym1' in this test scenario) to the test Collector PC. Run the connectivity test command in Powershell to generate the FortiEDR event. tnc -ComputerName x.x.x.x -Port xxx <----- Replace 'x' with a test IP and port. Event (powershel.exe) is detected as Inconclusive and User Access Integration is triggered properly.  In both Active Directory and the test PC, the user is disabled as expected. A password reset is also required upon login with the domain user.