TS Agent Unable to Map Users to SMB Traffic

SMB traffic is not assigned a user mapping by the Terminal Server Agent.

Sessions to SMB file shares set up by users on the terminal server are not mapped to usernames by the Terminal Server Agent and are thus not mapped to a user in the traffic log.

If the traffic is initiated by an application running with the context of a user (e.g. telnet), the socket information can be intercepted by the TS Agent which will replace the source port. However, if the traffic is generated by a service running with System context, the agent is not able to determine the user information. The Terminal Server Agent will not identify SMB traffic as this is run in a system context.