Article Number
000044868
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent for Windows
RSA Version/Condition: 7.2.x, 7.3.x, 7.4.x
Issue
Users report slow authentication while logging in or unlocking their Windows machines.
Cause
The challenge settings for the RSA Authentication Agent 7.x for Windows are configured to include or to exclude a local group that contains local users and Active Directory groups, which results in a time delay to fetch all these nested data.
The symptom is found in the SIDAuthenticator(LogonUI).log on the Windows agent machine:
....
....
2020-05-22 15:40:38.191 11252.6308 [V] [ADSIHelper::ParseGroupName] fullGroupPath = .\test_local_group
2020-05-22 15:40:38.191 11252.6308 [V] [ADSIHelper::ParseGroupName] groupDomainORworkstationName = W-103559, groupName = Support_Users
2020-05-22 15:40:38.191 11252.6308 [V] [ADSIHelper::ParseGroupName] Return
2020-05-22 15:40:38.191 11252.6308 [V] [ADSIHelper::ADSIHelper] groupDomainOrWorkstation is equal to the computer name, so the group is assumed to be a local group
....
....
2020-05-22 15:41:07.020 11252.6308 [V] [ADSIHelper::ParseGroupName] fullGroupPath = "Domain_name"/exampledomainpath
2020-05-22 15:41:07.020 11252.6308 [V] [ADSIHelper::ParseGroupName] groupDomainORworkstationName = TCPL, groupName = R_RSA_Exclude_Challenged
2020-05-22 15:41:07.020 11252.6308 [V] [ADSIHelper::ParseGroupName] Return
2020-05-22 15:41:07.020 11252.6308 [V] [ADSIHelper::isDomainGroup] The group is assumed to be a domain group
....
....
2020-05-22 15:41:07.450 11252.6308 [V] [sidChallenge::cacheUserGroupInfo] Stored UserLocation: USER_NOT_IN_GROUP
2020-05-22 15:41:07.450 11252.6308 [V] [sidChallenge::cacheUserGroupInfo] Stored TimeStamp: 0x5ec7f293
2020-05-22 15:41:07.450 11252.6308 [V] [sidChallenge::cacheUserGroupInfo] Return
2020-05-22 15:41:07.450 11252.6308 [V] [sidChallenge::checkUserInGroup] userLocation = USER_NOT_IN_GROUP
2020-05-22 15:41:07.450 11252.6308 [V] [sidChallenge::checkUserInGroup] Return
2020-05-22 15:41:07.450 11252.6308 [I] [sidChallenge::getChallengeType] userLocation is: USER_NOT_IN_GROUP
2020-05-22 15:41:07.450 11252.6308 [V] [sidChallenge::getChallengeType] bStaleResult = false
2020-05-22 15:41:07.450 11252.6308 [V] [sidChallenge::getChallengeType] challengeType = CHALLENGE_USER
2020-05-22 15:41:07.450 11252.6308 [V] [LACPolicies::~LACPolicies] Enter
2020-05-22 15:41:07.450 11252.6308 [V] [LACPolicies::~LACPolicies] Return
2020-05-22 15:41:07.450 11252.6308 [V] [RsaDesktopConfig::~RsaDesktopConfig] Enter
2020-05-22 15:41:07.450 11252.6308 [V] [RsaDesktopConfig::~RsaDesktopConfig] Return
2020-05-22 15:41:07.450 11252.6308 [V] [sidChallenge::getChallengeType] Return
2020-05-22 15:41:07.450 11252.6308 [I] [LACAuthenticator::isChallenged] getChallengeType has determined that the user is challenged.
2020-05-22 15:41:07.450 11252.6308 [V] [LACAuthenticator::isChallenged] Return
2020-05-22 15:41:07.450 11252.6308 [I] [LACAuthenticator::Authenticate] User is challenged
....
....Resolution
Change the challenge settings either to exclude or include either the local group or the Active Directory group for a better performance.
To change the challenge settings locally,
- Open the Control Center and select Challenge users.
- Change the Group field accordingly.
To change the challenge settings through the domain controller GPO,
- Click Start > Administrative Tools > Group Policy Management.
- If necessary, double-click the domain name in the left-hand frame to expand it.
- If necessary, double-click Group Policy Objects to expand it.
- Right-click the policy with the template you must edit, for example, Default Domain Policy, and click Edit.
- Double-click Policies from Computer Configuration.
- Double-click Administrative Templates: Policy definitions (ADMX files).
- Double-click RSA Desktop > Local Authentication Settings.
- Double-click Challenge Users on the right window.
- Change the Group field accordingly.
