McAfee Data Loss Prevention 9.2.2 Product Guide

13Managing McAfee DLP systemsAdding servers to McAfee DLP systems5 Highlight and copy the entire text, including the BEGIN and END CERTIFICATE lines.6 Open a web browser and logon to the Network McAfee DLP Manager.7 In ePolicy Orchestrator, select Menu | Data Loss Prevention | DLP Sys Config | System Administration | DirectoryServices.8 From the Actions menu, select Create McAfee Logon Collector.9 Type the IP address of the McAfee Logon Collector into the IP Address field.10 Select the Paste from Clipboard option and paste the Base 64 text into the box.Alternatively, you can export the certificate from McAfee Logon Collector to your desktop, thenBrowse to it from the Import MLC Certificate | From File field.11 Click Apply.This authenticates the McAfee Logon Collector to McAfee DLP Manager.12 Click the Export link to save the NetDLP certificate to your desktop.The file name is netdlp_certificate.cer.13 Open a web browser, enter the IP address of the McAfee Logon Collector in the address bar, and logon.14 Select Menu | Configuration | Trusted CA.15 Click New Authority.16 Browse to the netdlp_certificate.cer file you saved to your desktop.17 Click Open, then Save.This authenticates McAfee DLP Manager to McAfee Logon Collector.18 Open a Remote Desktop session on the McAfee Logon Collector server and restart it.When the server comes up, the SSL connection between the servers is complete.How McAfee Logon Collector enables user identificationMcAfee Logon Collector is used to map IP addresses to user identities within Active Directory servers.Without it, users might be hard to identify because they might be logged into different or multipleworkstations. IP addresses change when DHCP servers assign new addresses, and more than one usermight be logged on to the same workstation.When a McAfee Logon Collector is configured with McAfee DLP Manager, it resolves user identities byretrieving collections of user account information from all Active Directory servers that have beenadded to the DLP system. Supporting multiple domain controllers means that large‐scale enterpriseoperations can be served by McAfee applications.For McAfee DLP, that means that after McAfee Logon Collector is enabled, McAfee DLP administratorscan configure Active Directory‐based queries and rules to find out what activities specific users areengaging in on the network.How McAfee DLP uses SIDsBecause McAfee Logon Collector allows McAfee DLP to key on SIDs (Security Identifiers) instead ofsAMAccountnames, the identities of individual users can be resolved and their traffic can be270 McAfee Data Loss Prevention 9.2.2 Product Guide