Troubleshooting Directory Connector With Login Monitor on Windows Server

When using Directory Connector you need to also deploy a method for Active Directory to send user login events to the NGFW. The simplest method is to install the Login Monitor on each Active Directory server.

In many cases that is all that needs to happen for everything to work smoothly. However, there are some settings in Active Directory that, if not set properly, can cause the Login Monitor to not send login events back to the NGFW.

Note: The following settings and related images are from Windows Server 2012 R2. These settings exist in other versions of Windows Server but may be located in slightly different locations.

Audit Kerberos Authentication Service

1. Open Local Policy Editor. On Server 2012 this can be done in Server Manager > Tools.
   
   
2. After Local Security Policy is open expand Advanced Audit Policy Configuration > System Audit Policies- Local Group Policy Object > Account Logon
   
   Clicking the image above will load it, full-size, in a new window.
   
   
3. Double click Audit Kerberos Authentication Service
   
   Clicking the image above will load it, full-size, in a new window.
   
   
4. Under the Policy tab check the Configure the following audit events and the Success check Boxes.
   
   Clicking the image above will load it, full-size, in a new window.

Audit Logoff

1. Open Local Policy Editor. On Server 2012 this can be done in Server Manager > Tools.
   
   Clicking the image above will load it, full-size, in a new window.
   
   
2. After Local Security Policy is open expand Advanced Audit Policy Configuration > System Audit Policies- Local Group Policy Object > Logon/Logoff
   
   
3. Double click Audit Logoff
   
   Clicking the image above will load it, full-size, in a new window.
   
   
4. Under the Policy tab check the Configure the following audit events and the Success check boxes.
   
   Clicking the image above will load it, full-size, in a new window.

Audit Logon

1. Open Local Policy Editor. On Server 2012 this can be done in Server Manager > Tools.
   
   Clicking the image above will load it, full-size, in a new window.
   
   
2. After Local Security Policy is open expand Advanced Audit Policy Configuration > System Audit Policies- Local Group Policy Object > Logon/Logoff
   
   
3. Double click Audit Logon
   
   Clicking the image above will load it, full-size, in a new window.
   
   
4. Under the Policy tab check the Configure the following audit events and the Success check boxes.
   
   Clicking the image above will load it, full-size, in a new window.