11-23-2011 10:37 AM
A new customer during deployment was wanting to test how well the TS User ID agent was working at identifying users. We logged on as User A and started a specific ping. We search the log file, and there was the ping. We had it running continuous for several minutes. During a refresh, we started to notice that other users were also pinging this exact same address from the same TS. This was very unlikley, so we logged in User B. As soon as we logged in, the log indicated the User B was responsible for the pings, even though we could clearly see this was not the case. After explaining these results to Support, here was the explanation:
Since the TS User-ID agent uses port ranges to identify each user, it only is capable of identifying the traffic for a user if the protocol tcp/udp (because they are port based).
My customer is a Bank, and they consider the feature unusable, because the last user to login, may not be allowed to ping, or gre, or whatever.
Has anyone else noticed this behavior? Any workarounds or fixes in the mix?
11-23-2011 11:08 AM
I'm not sure why they would consider it "unusable?" The main purpose of the TS UserID function is to enable you to do per-user web filtering from a Terminal Server, without having to use virtual IPs per each individual.
I would never allow my users to do anything that would involve GRE from a terminal server. That could do $deity knows what to other people on the same terminal server and is not a good idea.
Ping is ICMP so it isn't tracked by UserID, but really, is that something you are concerned about? Our users can't even access the command line on our terminal servers, so they don't really have any way to ping.
11-23-2011 12:04 PM
I suppose that's fine if you only want web filtering, however, that is not the case here.
11-23-2011 01:21 PM
@dpayne:
As you have learned from your call to Technical Support the Terminal Services agent works by restricting the source port on a per user basis for TCP and UDP protocols. For applications that use other network protocols the Terminal Services agent will be unable to perform any function.
If you wish to see the Terminal Services agent support protocols other than TCP and UDP you will need to have your sales team submit a feature request.
-Benjamin
11-23-2011 01:26 PM
Yes, I have done so. Personally, I can work around it, and hopefully the custoemr can as well. I was just kind of surprised is all.
Thanks,
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
