Forum Discussion

Kailashj's avatar
Kailashj
Copper Contributor
Jul 28, 2020

unable resolve unsecure account attributes alert

I have a question to this alert:

 

This message is shown for several weeks now and I searched the local AD for this user, but it seems that the account does not exist anymore. What can I do to confirm the alert?

 

I have no option to dismiss/resolve the open alert.

 

Look at the image attached.

Cloud App Security

4 Replies

    • SamiLamppu's avatar
      SamiLamppu
      Brass Contributor
      Aug 03, 2020

      Hi Kailashj 

       

      This might be caused by a deleted account that has an unsecure attribute still configured. I was able to achieve a similar situation in my test environment with the account that had "DES encryption" enabled when the account was deleted. UserAccountControl attributes still exist (are not wiped out) in the account event it's deleted (see pics - first one from ldp, second from mcas). 

       

      Could you search the account from deleted objects container and verify does it have an unsecure attribute still configured (depending on what it is)? 

       

      • Kailashj's avatar
        Kailashj
        Copper Contributor
        Aug 05, 2020

        No luck the user for whom the alert was triggered couldn't be found anywhere.

         

         

        SamiLamppu 

Resources