User ID credential phishing service does not work on Full Domain controller

User ID credential phishing service does not work on Full Domain controller

18715
Created On 03/05/19 17:34 PM - Last Modified 10/15/26 09:51 AM


Symptom


User ID credential service does not work on Full Domain controller

Environment


  • Windows User-ID Agent.
  • User-ID Credential Agent.
  • Windows Server 2012 R2 / Windows Server 2016 or 2019.

Cause


  • User ID credential service add-on is not able to read the data from the cache of Full Domain Controller.
  • The data is not stored in Full DC (Domain controller)  compared to the RODC ( Read-only Domain controller) where the details are pulled from the cache.

Resolution


For the User ID credential phishing agent to work correctly it has to be installed on Read-Only Domain controller.
 

Additional Information


Configure Credential Detection with the Windows User-ID Agent

Note: Error messages can be seen in the User-ID agent folder of the Domain Controller.  Check the log "UaCredDebug", to see the message "Error: Unable to extract credentials"
 
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boGsCAI&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language