Password activity is not being captured by the EmpowerID Domain Controller Filter

Owned by Pooja Gupta 2 (Unlicensed)
Jun 02, 2021
2 min read

You may find password activity is not being captured or forwarded by the EmpowerID Domain Controller Filter even after following the EmpowerID Domain Controller Filter installation guide. This issue is normally caused by a lack of permissions for the logged in user that originally executed the installer.

An administrator will need to register our password filter on the domain controller as a user who is a member of the Domain Admins security group to resolve this issue.

  1. Login to a domain controller that has the EmpowerID Domain Controller Filter installed.

  1. While holding down the SHIFT button, right click the Command Prompt and choose "Run as Different User". You can do this directly to %windir%\System32\cmd.exe or to a Command Prompt shortcut.

  1. In the Windows Security window that appears, enter the credentials of an account that is a member of the Domain Admin security group and click OK.

  1. In the Command Prompt window that appears, type the following command and press ENTER:

"%ProgramFiles%\EmpowerID Domain Controller Filter\RegAsm.exe" /verbose %windir%\System32\CSPwdFilter.dll

You should see the message "Types registered successfully" displayed.

  1. Reboot the domain controller. The EmpowerID Domain Controller Filter should now be able to capture password activity.

  1. Repeat Steps 1-5 for any remaining domain controllers that have the EmpowerID Domain Controller Filter installed.

Please feel free to contact us by e-mail at support@empowerid.com or by phone at (877) 996-4276 (Option 2) if you have any questions or concerns regarding this guide.