> Source: [sk108235](https://support.checkpoint.com/results/sk/sk108235)

# sk108235 - Identity Collector - Technical Overview

| Property | Value |
|----------|-------|
| Solution ID | sk108235 |
| Date Created | 2016-03-30 |
| Last Modified | 2026-01-26 |
| Technical Level | General |
| OS | Gaia |

## Solution

### Introduction {#Introduction}

Check Point Identity Collector is a Windows-based application which collects information about identities and their associated IP addresses and sends it to the Check Point Security Gateways for identity enforcement.

The identities are collected from these servers:

* Microsoft Active Directory Domain Controllers:   
  - Windows Server 2008  
  - Windows Server 2008 R2  
  - Windows Server 2012  
  - Windows Server 2012 R2  
  - Windows Server 2016  
  - Windows Server 2019  
  - Windows Server 2022  
  - Windows Server 2025

<!-- -->

* Cisco Identity Services Engine (ISE) Servers, versions 2.0, 2.1, 2.2, 2.3, 2.4, 2.6, 2.7, 3.0, and 3.1
* Syslog messages (requires Identity Awareness Gateway R80.20 and higher)
* NetIQ eDirectory Servers (requires Identity Awareness Gateway R80.20 and higher)

### Requirements for the Windows Server {#Mandatory_Requirements}

These are minimum requirements for the Windows Server on which Identity Collector is installed:

* Supported versions of Windows Server: Windows Server 2008, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2025
* Windows Server must have a minimum of 8 GB of RAM
* Windows Server must have a minimum of 10 GB of free disk space
* Windows Server must have .NET framework (version 4) installed
* If you install Identity Collector directly on the Domain Controllers (DCs) (including Windows Firewall), make sure the Windows Firewall rules allow DNS, LDAP, and DCOM traffic from the computer on which Identity Collector is installed.
  * In Windows Firewall, add this "Allow" rule:  
    "`Remote Event Log Management`" -\> "`Remote Event Log Management (RPC)`".
* Windows Server must connect to the Identity Awareness Gateway over TCP port 443
* Identity Collector processes these Windows events:
  * Authentication events - 4624, 4768, 4769, 4770
  * Group update events - 4728, 4729, 4732, 4733, 4756, 4757
  * Group deletion events - 4730, 4734, 4758

### Best Practice

For best performance, use a Windows Server with:

* A minimum of 12 CPU cores
* A minimum of 16 GB of RAM
* A minimum of 60 GB of free disk space

### Additional Requirements {#Additional_Requirements}

* LDAP Account Unit(s) must be configured to allow PDP Identity Awareness Gateways to perform group lookups for user and machine identities.
* No AD schema changes are required.

<br />

**For additional information and functionality, refer to [Identity Awareness Clients Administration Guide](https://sc1.checkpoint.com/documents/Identity_Awareness_Clients_Admin_Guide/Default.htm) \> Identity Collector section**

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content