topic Re: Ignoring Users in Mapping in General Topics

Ignoring Users in Mapping

PIRSA — Wed, 27 Jun 2018 04:06:11 GMT

Howdy,

Sorry if this has been asked thousands of times, but I cannot seem to locate something quite similiar.

We have noticed recently, that some users are logging in with a local computer account and then obviously being able to browse the internet falling into a catch all rule for 'Known Users' which is required.

It was suggested, as an option that we try to not learn them as 'known Users' etc. However, I am not sure how we would handle that in our case.

The problem is that the workstation name is not constant like if the user were coming in with their domain\username, so the users are appearing as below in the user mapping tables:

User: mn2343234\administrator
User: mn12345\administrator

User: mn56789\administrator

etc etc

So if I am reading things correctly the only way to stop this access is that we would need to somehow make that text file the agent uses on the server dynamic and populate it with computer name/username items one per line, then restart the agent to apply the settings? Is there another easier way to ignore these users?

Re: Ignoring Users in Mapping

reaper — Wed, 27 Jun 2018 08:39:30 GMT

If the users are being learned, you have probing enabled: when an unknown IP connects to the firewall, the firewall will ask the UserID agent for information. if it does not havbe a mapping and probing is enabled, it will then probe the IP and detect the local account

Probing has pro's and cons: it will also periodically probe existing mappings and if a user has logged out or moved to a new ip (wifi roaming), the no-longer-active session/unused ip will be cleared from mapping. This helps prevent other iusers swooping in and abusing the previous user's mappings access

so the best option is to simply exclude the admin accounts from being registered, through the ignore_user_list.txt

Re: Ignoring Users in Mapping

OtakarKlier — Wed, 27 Jun 2018 17:12:23 GMT

Hello,

One option would be to use user-id in your allow internet browsing policy. Then anyone who is not a 'domain user' would not be able to browse the internet. In the past I used the group 'Domain User' if anything fell outside of it it would fall int oa more stringent policy.

Hope it helps.