You can monitor the authentication activity of a specific user in the User report tab. This report includes all the successful and the failed authentication details of the Advanced Authentication events.
This report allows you to analyze the following details of a specific user:
The frequency of login
The logged in events
The authenticators used for login
To monitor the user report, perform the following steps in the helpdesk portal:
Specify the name of the user whose authentication report you require to monitor, and then click Next.
Click the User report tab.
The User report tab includes the following information about each authentication activity of the user:
Time: Time when the user initiated the login.
Tenant: Name of the tenant to which the user is associated.
Server: IP address of the Advanced Authentication server that processed the authentication.
User name: Name of the user.
Event name: Name of the event to which the user tried to log in.
Chain name: Name of the chain used for authentication.
Method name: Name of the method used for authentication.
Result: Authentication result. A check mark indicates successful authentication and an X mark indicates failed authentication.
Reason: A comment about the cause of failed authentication. The Reason is empty for a particular login activity if the authentication is successful.
NOTE:In the clustered environment, when you try to monitor the report of a user, the Advanced Authentication server contacts with each site in the cluster then verifies some details on the DC side and collects necessary data for the report. This might lead to a delay in fetching the report.
For example, in a cluster, if a helpdesk administrator from Europe tries to view a user report, the Advanced Authentication server communicates with another AA server (including DC on each site) from each site to collect all necessary data for the report.