Creating Contractor user with a corporate email address causing existing user isolation

[mbas]

Dear team,

Has anyone else observed this issue?

When we create a contractor user with a corporate email address and no one logs in with that user, after a while, it causes the existing user VLAN to change to isolation. When I check that user and click Show Hosts, I can see another host belonging to the same user with the contractor email address. The strange thing is that when I check that host, I can see that the logged-on user is the contractor user, even though we did not log in.

Somehow, I guess the passive agent finds that device user, checks the email address, and matches it with the contractor user. Is this normal behavior? It's not happening instantly; it takes some time to detect the other host and link it with the contractor user.

My goal is to create a contractor user, assign them to the onboarding VLAN, and install new computers. That's why the help desk team creates users with corporate email addresses and keeps them for a month. Do you have any suggestions for overcoming this issue?

[AEK · Accepted solution]

In your LDAP config, what is set as identifier? sAMAccountName or mail?

[mbas · Accepted solution]

Hi AEK,

No, that was the UserPrincipalName attribute in LDAP. I don't use MSCHAPv2; I use EAP-TLS authentication with a user certificate. When I authenticate the user, the host registered with 802.1x auto registration, and the username is shown as UserPrincipalName in the RADIUS logs because we setup the certificate settings as UserPrincipalName.

Host View;

However, after changing the identifier to sAMAccountName, the logged-on user was shown as UserID.

No Persistant Agent installed. 

After creating a contractor account with the same email address of the existing user, I can see both Radius-authenticated user and contractor user in the User Accounts menu.

Before, the user IDs were the same because the email address was the same as the userPrincipalName. As you can see, the user IDs are different now. There is no match for hosts :)

This entry can be closed. Thank you so much @AEK and @ebilcari :)