How to identify PTA authentication agent id

Copper Contributor


we are using 4 pta agents across our environment and looking to identify PTA agent id for each installed server. 

 

we send azure authentication logs to SIEM. Our SIEM logs show that user has authenticated through PTA with

PTA AgentId: xx13bxxx-54xx-41xx-8exx-xxxx2d9xxxx"

 

i am interested to know through which agent user has been authenticated through.  Is there way to find out each allocated pta agent id for individual servers ? 

1 Reply
We can get using powershell command.

Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Azure AD Connect Agents\Azure AD Connect Authentication Agent'| FL