Unknown User in "Failed Attempts" Log

sometechguy · ‎11-07-2007

The "Failed Attempts" log on the ACS 4.1 began showing entries that I do not understand. The backend is Active Directory.

Basically, the entry it is in this format:

date,time,authen failed,foreigndomain\user,localadmingroupname,callerid,External DB user invalid or bad password,... etc.

This is what I don't understand: It appears that the "foreigndomain\user" entry must be a foreign device that is trying to authenticate to our wireless environment (PEAP). But why is it showing the group name as our ACS administrators group!? Shouldn't it see the "foreigndomain\user" as another group like "Default Group"? I have the "\Default" group mapping set to "Default Group".

Thank you.

tjlavelle7 · ‎11-08-2007

we have a similar thing occur when a group mapping cannot be found, it logs the failed attempt against the first group in ACS.

Is "group 1" named "ACS administrators"?

I don't think it means much as I assume group mapping only occurs if an authentication attempt is successful?? It seems there is bug in that ACS needs to put something in the log entry for group and so uses the first group name rather than N/A, blank, or something to that effect.