cancel
Showing results for 
Search instead for 
Did you mean: 
bjurgens
Level 7

Removing the domain name from "auth user" when running reports

I am using Content Reporter to pull the logs from our Web Gateway device.  The issue I am having is that the user name field is stored as  <domain>\<UserID> and I would like to just return the <UserID> without the domain.  Is there a way to accomplish this?  Thanks in advance for your input.

0 Kudos
2 Replies
McAfee Employee

Re: Removing the domain name from "auth user" when running reports

Hello again bjurgens,

I don't believe removing the domain prefix is possible within Content Reporter without some java trickery, I think the best path would be to remove it from the log files. This can be done on McAfee Web Gateway by modifying a setting in the global.conf file. As discussed in the blockpage thread you can use the Secure Admin shell to make this change to avoid having to restart/stop the MWG service.

From the admin shell you can use the following command:

set global.LogFiles.PrefixNTLMUserNameWithDomain 0

Alternativley you must stop the service, modify line containing 'PrefixNTLMUserNameWithDomain' the global.conf file, and change the value from 1 to 0 and start the service back up.

Best Regards,

Jon

0 Kudos
bjurgens
Level 7

Re: Removing the domain name from "auth user" when running reports

Worked great!!!  Thank you very much.

0 Kudos