Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: How To Collect Logs For Active Directory Login Errors (Web Console)

App Control: How To Collect Logs For Active Directory Login Errors (Web Console)

Environment

App Control Server: All Supported Versions

Objective

How to collect logs for Active Directory console login errors

Resolution

  1. Confirm that the App Control domain service account has the permissions needed to access all Active Directory domains needed with this KB
  2. Login to the App Control Console using the local "admin" user
  3. Navigate to > https://ServerName/Support.php > go to the Diagnostics tab
    • For App Control Server version 8.9.x and higher:
    • Select the "Snapshot Server Logs" button
    • Set logging duration: 30 Minutes
    • Debug Level: Verbose
    • Reporter Log Level: Minimum(default)
    • Script Debug Level: Verbose
    • Active Directory Debug Level: Verbose
    • Start Logging
    • For App Control Server version 8.8.x and lower:
    • Select the "Snapshot Server Logs" button
    • Set logging duration: 30 Minutes
    • Debug Level: Verbose
    • Reporter Log Level: Minimum(default)
    • Script Debug Level: Verbose
    • Start Logging
  4. Reproduce the login error several times
  5. Go back to the Support.php page and select "Stop Logging"
  6. On the Right side of the page > under Related Views > Select "Available Log Files".
  7. Save the following files that have today's date:
    • AppControlAD-todays-date-time.log
    • ServerLog-todays-date-time.bt9
  8. On the server navigate and copy these files:
    \Program Files (x86)\Bit9\Parity Server\scripts\Adrules.xml
    \Program Files (x86)\Bit9\Parity Server\scripts\Adrules.xsd  <-- This file only exists in version 8.9+ -->
    
  9. Please make screenshots of the following console pages:
    • Gear Icon > System Configuration > General Tab
    • Support.php > Advanced Configuration tab
  10. Please zip and upload all collected data to CB Vault

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-08-2022
Views:
418
Contributors