Excessive Windows Security Events when Modifying AD Groups in Identity Manager

Products

• CA Identity Manager

Issue/Introduction

Modifying an Active Directory (AD) group via CA Identity Manager results in excessive Windows Event Viewer Security events. This typically occurs when a hotfix or Cumulative Hotfix (CHF) has not been applied correctly, causing the Java Connector Server (JCS) to reference an outdated csproxy bundle version.

Environment

• Product: CA Identity Manager
• Version: Identity Suite 14.4.2 CHF1
• Component: Java Connector Server (JCS)

Cause

When you modify a group membership for an account through the Identity Manager (Web interface or Provisioning Manager), the modification succeeds. However, the Microsoft AD Windows Server Security Event Log displays events for removing all users from the group and adding them back individually, rather than logging only the specific user change you intended. This behavior may cause confusion when you review logs in third-party audit tools like QRadar.

JCS is loading an incorrect or outdated csproxy bundle version (v1.1.0.20220419). The correct version for Identity Suite 14.4.2 CHF1 is 1.1.0.20231016.

Resolution

The JCS admin console is showing an old version 1.1.0.20220419 of csproxy bundle. The correct version of csproxy bundle for 14.4.2 CHF001 is 1.1.0.20231016.

 

Perform the following steps to force your JCS to refresh its cache and load the correct bundle:

1. Stop the External Windows JCS Server service.
2. Navigate to the \data folder in your Connector Server installation directory.
3. Create a backup of the cache folder, then delete the original cache folder.
4. Start the JCS server.
5. Check the csproxy bundle version in the JCS Admin Console; verify that it reads 1.1.0.20231016.
6. Test the group modification to confirm that the Security Event Log now records only the necessary user change events.