TS Agent no port mapping when using windows net use

ErrantOsi — Mon, 15 Apr 2019 13:02:39 GMT

Hey Guys

We have noticed a weird behaviour:

When I do a telnet to IP 1.1.1.1 Port 445 on our Terminal Server with the TS Agent installed, the associated Port Range will be used as expected and the source user-id will be mapped.

But when we do a net use in the same CMD window, it won't associate it with the expected port range but with a higher, not related to the users one and won't map the user-id. Both connections are Port 445 (checked in the logs).

I found this article online regarding that system context actions can't be mapped:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClkCCAS

Anyone has/had the same issue? Can it be that net use is running in system context and can't be tracked?

Thanks and best regards

Re: TS Agent no port mapping when using windows net use

Remo — Mon, 15 Apr 2019 13:14:37 GMT

@ErrantOsi wrote:
Can it be that net use is running in system context and can't be tracked?

That's already the reason why the TS Agent is not able to determine the source user for SMB traffic

topic TS Agent no port mapping when using windows net use in General Topics

TS Agent no port mapping when using windows net use

Re: TS Agent no port mapping when using windows net use