FSSO - logon filtering at DC agent level

[FrancoisBlanchon]

Dear community,

I am configuring DC agents to push logons information to Collector Agent (CA on dedicated server).

I am using this msi setup command line:

msiexec /i DCAgent_Setup_5.0.0302_x64.msi COLLECTORAGENTLIST="10.y0.xx.11;10.y0.xx.11" DONOTRESOLVE=1 IGNORELIST="mydomain\?*-s;mydomain\HEALTHMAILBOX?*" ENABLELOG=1

My question is about IGNORELIST parameter. It seems that my DC agents is still sending information about service accounts (mydomain\?*-s) that are supposed to be filtered.

This syntaxe is working well to filter at Collector Agent level, but I would prefer to filter as early as possible in FSSO process, so at DC agent level.

The msiexec command is accepted, collector agents list param is well used to setup DC agent but not ingnorelist param.

Thanks for any advices.

[Debbie_FTNT · Accepted solution]

Hi Francois,

the issue is that DC Agent can't handle wildcard characters in the ignore list. If you specify individual usernames, it can ignore them just fine.

You can also find the ignore list in the registry at "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FSAE\DCAgent".

The Collector Agent, on the other hand, can handle wildcards in the ignore user list.

[FrancoisBlanchon]

Hi Debbie,

Thanks a lot for this setup info. It should be able to handle wildcard chars, very usefull to save traffic and information amount to handle by CA!

Hope it will be improved in the future.

Regards,