Terminal server user identification

[Radmin_85]

Hello.We have terminal server in which there are many users logged in.But we see them in traffic monitoring only as one Ip address and no separate users.I have installed terminal service agent on terminal server and everything is ok.IT shows connected and green and TS agent define the users.But in firewall i cant see the separate users in monitoring -traffic log. i want to mention that i use agentless ldap integration.But can check with user id agent also.Is there any tips regarding terminal server?

[Radmin_85]

But how about internet traffic

Is it possible to identify separate users who go to Internet

[vsys_remo]

This definately is possible. What output does the following command show you: "show user ip-port-user-mapping all"?

[Radmin_85]

the output shows doman name\usernames

so it is ok

[reaper]

are you seeing these same source ports appear in your firewall's sessions from that server's IP address ?

except for a handful of 'system' services like SMB, every normal user session should be sourced from those source ports. if you see different source ports, you may need to check if htere's a proxy, webfiltering or AV service installed on the server that could intercept outgoing connections and alter the source port once more

[Radmin_85]

I will check it
I also used to ping 8.8.8.8 by logging in with one of the users credentials .But in logs i only see the source ip of terminal server and no user