User ID Agent
cancel
Showing results for 
Search instead for 
Did you mean: 

User ID Agent

L3 Networker

I have a problem where the user id Agent is reporting the wrong user to an IP.

For example, user a is 10.1.1.5 and has id test1

Sometimes user b with an id of test 2 shows up with 10.1.1.5 which is not accurate, if I do a show user Ip mapping it shows test 1 is mapped to 10.1.1.5 and test 2 is mapped to a 10.2.2.5.

These are example IP's.


What is happening user A is being mis identified so blocked applications are allowed throught.  If i show session ID on 10.1.1.5 for skype it shows user id test2, but all other Session IDS show test1 as the user.

10 REPLIES 10

L5 Sessionator

markk96

Could you verify if there is any service running on that machine (10.1.1.5) that might be using the login of user test 2 ?

Also check the domain controller eventvwr security logs related to user test2.

I have 24 user id agents deployed in remote agents all reporting back to the firewall.

I only see user ID 2 on the firewall in the skype application traffic that I am trying to block to user ID1.

User ID 1 is in a totally different office location about 400 miles apart than user ID 2.  User ID2 has never traveled and gotten an IP address from the User ID office location.

L3 Networker

I will also say this is happening to multiple users.

markk96,


Even though the users are in different locations, It could be possible that the machine (10.1.1.5) is a shared resource that can be accessed from multiple locations by many users.

This could explain why the issue might be occurring with multiple users.


Thanks

No that is not the case.  Thanks.

L6 Presenter

have you fixed the issue ?

how many dc do you have ?

any agents are installed on dc ?

L3 Networker

This is a problem with SKYPE and the way the Palo ID's users.

very interesting, user-id not working properly only for Skype.

better to open a case I think.

Controlling Skype

See page 4.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!