Skip to main content
anthony956
anthony956
New Member
July 28, 2015
Question

Logon event RDP for FSSO

  • July 28, 2015
  • 2 replies
  • 19752 views

 

Hello, We use FSSO to allow or not connection to Internet for users. We have a problem when we use RDP (Windows remote desktop), they credentials using on the remote desktop are updated also on the computer who has lauch RDP. We have reproduce this issue. We are connected with ABC account on 10.1.1.1. We launch a RDP session from 10.1.1.1 to 10.2.2.2 with account DEF. After that, we can see on the fortigate the DEF account on 10.2.2.2 and on 10.1.1.1. So from the computer 10.1.1.1 with ABC account, we have DEF rights ! So we need to De-authenticate DEF on Fortigate or restart a session to restore ABC rights on 10.1.1.1. When we look logon log on FSSO collector, we can see that DEF connect in first on 10.1.1.1 and after 10.2.2.2. So, why Windows RDP send a logon event whith DEF on 10.1.1.1 ? Do you know this problem ? 

 

I've opened a ticket on fortinet support, but I think it's not a FSSO bug. This is why I allow myself to ask the question here.

 

Thank you so much in advance.

 

Best regards,

Anthony.

 

2 replies

xsilver_FTNT
Staff
xsilver_FTNT
Staff
July 28, 2015

Hello,

 

we saw and investigated that behavior with updated new RDP protocol as development case ID #165397 (not a bug) and problem is that when user authenticate via RDP the MS system creates logon event on DC which is indistinguishable from regular one and contains data as that DEF truly logged on 10.1.1.1.

Therefore Collector and FSSO subsystem spot that logon and as it later it overwrite/update current FSSO records with new data for workstation 10.1.1.1.

 

Possible solutions I see  (choose either one suitable for you):

---

A: use native RDP vithout security negotiations (older version ).

B: use FSSO WinSec Polling from collector instead of DCAgent mode.

C: as issue is caused by contradictory info gathered through two MS sub-authentication layer channels, then make a fix in registry of DC servers and change this to eliminate channel with wrong data and keep just Kerberos channel opened:

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0] delete value Auth0 or change Auth0 value to anything other than dcagent. after that restart domain controller.

 

Best regards, Tomas

anthony956
anthony956Author
New Member
August 5, 2015

Hello,

 

Thank you for your reply.

 

We have try to modify registr value on Domain Controller but we have the same problem...

Why ? 

Also, this value is not available on a standard Windows, only on Server...

Fortinet ask to me to use a special account for RDP session and to put this account on ignore user list. 

This is not really a good solution for customers...

 

Best regards,

Anthony.

 

xsilver_FTNT
Staff
xsilver_FTNT
Staff
August 10, 2015

Hello Anthony,

 

registry key should work, as it was tested before.

Surely it is just for server platforms as we are talking about registry records on DC not on workstations ! Maybe that's why it's not working as you expect.

Special account distinguishable from regular account by logon name format for RDP is good workaround I think. New RDP does logon action, DC creates two contradicting logon events through Kerberos and MSV channel, and if FSSO monitor both it will get them and update FSSO records one-by-one so if MSV one (wrong data inside) is last one, then you will get workstation overwritten. Issue is created by inacurate logon event through MSV channel. So you have to either ignore channel (registry change), or ignore a user logon event based on user name used (ignore list record).

 

regards, Tomas

TG44
TG44
New Member
May 18, 2017

I am on the newest version of FSSO and the problem is still remains. 

 

I have looked at the workarounds.

A: We need this as we are running RD environment with SSO

B: If your are meaning pulling info with the Fortigate then this environment is probably to big for that.

C: Value Auth0 does not exist

 

Any thoughts?

 

Terms & ConditionsAccessibility statement