Loosing USER-ID

[RobinClayton]

Our AD based USER-ID seems to keep loosing the IP/USER  association.

We only have a few rules which work some of the time and then fail with a blank user.

What's the best solution to get it 100%???

Rob

[MickBall · Accepted solution]

is your user id timeout set to the default 45 mins.

just set it to either 4 hours or 8 hours (mins equiv)

I have mine set to 24 hours...  

[RobinClayton]

Yes 45 mins.

Do new users logins on the same system get picked up ok with that setting of 24Hrs?

Cheers

Rob

[MickBall]

Rob, not sure what you are asking.  but yes..

although the timeout setting is global to all users, it is not a global timer...

so each user, as they authenticate with AD will start there own 24 hour timer for there own mapping.

i think existing mappings will only pick up the new timeout on next authentication.

24 hour is overkill, i only have it as we aslo use Network Access Control on our switches.

4 hours is good practice as usualyy stop for lunch, (lock laptop) 8 hours is a safer bet.

the other option is to use mapping against email server or similar. whatever has the most activity..

[MickBall]

 please note that if an old mapping exists from earlier and your scope runs out of IP addresses then a non AD user could obtain an address of an old mapping prior to it timing out, probably didn't explain that very well, post back if you neeed more info.