Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Unknown User in "Failed Attempts" Log

The "Failed Attempts" log on the ACS 4.1 began showing entries that I do not understand. The backend is Active Directory.

Basically, the entry it is in this format:

date,time,authen failed,foreigndomain\user,localadmingroupname,callerid,External DB user invalid or bad password,... etc.

This is what I don't understand: It appears that the "foreigndomain\user" entry must be a foreign device that is trying to authenticate to our wireless environment (PEAP). But why is it showing the group name as our ACS administrators group!? Shouldn't it see the "foreigndomain\user" as another group like "Default Group"? I have the "\Default" group mapping set to "Default Group".

Thank you.

New Member

Re: Unknown User in "Failed Attempts" Log

we have a similar thing occur when a group mapping cannot be found, it logs the failed attempt against the first group in ACS.

Is "group 1" named "ACS administrators"?

I don't think it means much as I assume group mapping only occurs if an authentication attempt is successful?? It seems there is bug in that ACS needs to put something in the log entry for group and so uses the first group name rather than N/A, blank, or something to that effect.