locked
DC not showing some info RRS feed

  • Question

  • I have a Lightweight Gateway installed on a virtual DC, and everything seems to work fine except when I select that DC's computer account in ATA console. Both Recently accessed resources and Users who recently logged onto this computer show none which is definitely not the case. Any reason why is this happening?
    Wednesday, June 14, 2017 2:54 PM

All replies

  • Hello,

    First, please make sure the service for ATA Lightweight Gateway is up and running. You can check this from the Services MMC on the DC.

    On the other hand, you can find the logs for ATA Center at location: C:\Program Files\Microsoft Advanced Threat Analytics\Center\Logs. You can check if there is any errors in the log file "Microsoft.Tri.Center-Errors.log".

    By the way, how long have the ATA been deployed?

    Best regards,
    Andy Liu

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, June 15, 2017 6:21 AM
  • Yes, the service is running cause other servers show the right info. Only DC does not show what's needed.

    No such log file in that folder.

    ATA has been deployed recently in our test environment.

    Thursday, June 15, 2017 7:34 AM
  • Hello,

    Based on my knowledge, to create a profile for an entity, such as user or computer, ATA needs to see network activity for the entity 12 out of the last 21 days.

    Therefore, please make sure there is network activity generated for the domain controller. For example, a user access the domain controller from a workstation, or accessing the server or application from the domain controller.

    Best regards,

    Andy Liu


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, June 16, 2017 9:46 AM
  • Network activity is being generated all the time, and it doesn't make sense what you say because I can see that information on any other computer or user account, but it only doesn't work on DC. So no information about Recently accessed resources and Users who recently logged onto this computer only for DC. For other servers that information EXISTS.
    Friday, June 16, 2017 2:40 PM