Domain controller agent subscription to kerberos events for reliable transparent identification

A system for identifying network users comprising:

• a domain controller agent operating on a processor and having a user map, the domain controller agent configured to receive user data, to save the user data in an updated user map and to replace the user map with the updated user map;
• a filtering service operating on the processor and having the user map, the filtering service configured to receive the updated user map and to replace the user map with the updated user map;
• and
• an event subscription system operating on the processor and configured to generate event subscription data, wherein the domain controller agent is configured to subscribe to the event subscription system and to receive the event subscription data.