topic Re: What happens when you do switch user, does the integrated User Agent logoff the original user? in General Topics

What happens when you do switch user, does the integrated User Agent logoff the original user?

Wasfi.Bounni — Wed, 10 Apr 2019 11:29:26 GMT

Hi;

What happens when you do switch user, does the integrated User Agent logoff the original user? Does the original entry in the user to IP mapping table get overwritten ?

Kindly

Wasfi

Re: What happens when you do switch user, does the integrated User Agent logoff the original user?

Brandon_Wertz — Wed, 10 Apr 2019 12:37:53 GMT

@Wasfi.Bounni wrote:
Hi;

What happens when you do switch user, does the integrated User Agent logoff the original user? Does the original entry in the user to IP mapping table get overwritten ?

Kindly
Wasfi

Say user A logs into a machine with IP 1.1.1.1. Provided you are capturing the correct mapping criteria UIA will see user A tied to 1.1.1.1.

That user locks their machine and user B comes to the same machine and "switches user". User B provides credentials and logs into this same machine with IP 1.1.1.1. Again, provided the authentication messages are being captured at this time the OLD record of user A being tied to 1.1.1.1 is removed and is replaced with user B as being associated with 1.1.1.1.

Re: What happens when you do switch user, does the integrated User Agent logoff the original user?

OGMaverick — Wed, 10 Apr 2019 13:46:55 GMT

@Brandon_Wertz wrote:
@Wasfi.Bounni wrote:
Hi;

What happens when you do switch user, does the integrated User Agent logoff the original user? Does the original entry in the user to IP mapping table get overwritten ?

Kindly
Wasfi

Say user A logs into a machine with IP 1.1.1.1. Provided you are capturing the correct mapping criteria UIA will see user A tied to 1.1.1.1.

That user locks their machine and user B comes to the same machine and "switches user". User B provides credentials and logs into this same machine with IP 1.1.1.1. Again, provided the authentication messages are being captured at this time the OLD record of user A being tied to 1.1.1.1 is removed and is replaced with user B as being associated with 1.1.1.1.

However, if fast user switching is used again so B switches back to A, the logs will most likely continue seeing user B on that IP. This came up recently here and it doesn't appear that the Palo reads the proper events to keep track of FUS events. I beleive I read that other vendors solved this by reading 4778 & 4779

Re: What happens when you do switch user, does the integrated User Agent logoff the original user?

jeremy.larsen — Wed, 10 Apr 2019 16:38:25 GMT

Running the Global Protect Agent on this machine is supposed to fix this issue. The same problem exists with a shared machine running multiple remote desktop sessions.

*I have not tested this yet.