Forum Discussion

Kailashj's avatar
Kailashj
Copper Contributor
Jul 28, 2020

unable resolve unsecure account attributes alert

I have a question to this alert:   This message is shown for several weeks now and I searched the local AD for this user, but it seems that the account does not exist anymore. What can I do to conf...
Cloud App Security
Kailashj's avatar
Kailashj
Copper Contributor
Jul 30, 2020

Can someone help me?

SamiLamppu's avatar
SamiLamppu
Brass Contributor
Aug 03, 2020

Hi Kailashj 

 

This might be caused by a deleted account that has an unsecure attribute still configured. I was able to achieve a similar situation in my test environment with the account that had "DES encryption" enabled when the account was deleted. UserAccountControl attributes still exist (are not wiped out) in the account event it's deleted (see pics - first one from ldp, second from mcas). 

 

Could you search the account from deleted objects container and verify does it have an unsecure attribute still configured (depending on what it is)? 

 

  • Kailashj's avatar
    Kailashj
    Copper Contributor
    Aug 05, 2020

    No luck the user for whom the alert was triggered couldn't be found anywhere.

     

     

    SamiLamppu 

  • Kailashj's avatar
    Kailashj
    Copper Contributor
    Aug 05, 2020

    I will check on this and get back to you.

Resources