Forum Discussion

ndaems's avatar
ndaems
Icon for Nimbostratus rankNimbostratus
May 05, 2021

APM not generating Logon Event in DC

Hi,

 

We would like to implement an SSO solution that mainly relies on some Event logs (Logon - ID4624)

 

We found that when connecting via the Big-IP in VPN we don't have any such log in the Domain Controller. We are using an AD_Auth & AD-Query in the authentication scheme so I'm wondering why such log are not visible in the DC ?

 

Does someone has any experience on this ?

 

For the moment we need to wait until the user generate a windows action that trigger the Event ID to get authenticated into the SSO system

 

Thank you

 

Best regards

 

Nicolas

BIG-IP Access Policy Manager (APM)
security
  • Dario_Garrido's avatar
    Dario_Garrido
    Icon for MVP rankMVP
    May 22, 2021

    Hello Ndaems.

    ​

    F5 caches info from AD. There is an option called "Group Cache Lifetime" which rules that.

    https://techdocs.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-12-1-0/2.html

    ​

    Applying a new config at one APM policy should also clear cache.

    ​

    Regards,

    Dario.