we use XIRRUS and PaloAlto at customer site and have to install an agent that reports the successfully logged on users to PaloAlto.
By now, the users (students) connect to WiFi with Radius Authentication and have to enter the same credentials at a captive portal from PaloAlto to get access to internet.
We want to get rid of this "feature" and want to use the PaloAlto User Agent.
In Event Viewer we found at NPS-Log "Microsoft Windows security" Event ID 6278 which reports that a user access got granted.
Is there a way to get the IP adress of the client?
Is there an Event for successfully authenticated wired clients?
Not all of our users use WiFi to connect, many are still connected by cable and we want to grant them access to internet by logging in at Windows Logon on their desktop (domain member).
On the DC there must be an event which reports that a users with this IP was successfully logged on...isn't it?
Please help me to find this IDs.