FSSO Agent and multiple user logins

[GCC_J]

We have an issue with FSSO-based web filtering that I so far have been unable to solve:

We have the FSSO DC agents installed on all DCs.  We have 4 AD groups set up, and we're using a guest profile set to Deny everything.  Everything is working great, pulling in user logins, blocking sites, etc...  Except for one thing.  We have some users in our organization that either (1) Login from a PC with more than one username at a time, or (2) Admins will connect to other machines, either through CIFS/SMB shares or RDP using their 'Admin' accounts (our admins use a standard user account for day-to-day work activities).  The issue is that when someone does this, the FSSO agent drops their normal user account from the list and adds the second account.  Then when the second account logs off, it doesn't add the original account back, which means the first user account is now using the 'Guest' web filtering profile and they get blocked from all web sites.  To get back on the "Logged on users" list, they have to basically lock their computer, then unlock it, which re-authenticates to Active Directory and the FSSO agent logs it and adds the account back to the list.

This is a major annoyance.  This even impacts certain users who keep remote drives mapped using different credentials.  Is there any way around this?  It is making us re-think our entire setup.

[yorvek]

Did you receive a solution from support regarding this issue? While disabling the RDP override from the collector agent resolves the problem for RDP, it does not address the issue that occurs when running an application as an administrator on a client PC. In such cases, the user will eventually lose internet access and will need to lock and log back into their computer to restore connectivity.

[jpcastilloux1]

Yes, the only way to resolve this is to have a standardised Server / Admin accounts nomenclature that you will be able to ignore in the FSSO configuration.

so let's say, if your admin accounts nomenclature begins by admin-xxxxx , you could ignore in the FSSO the accounts login beginning by admin-* . 

You can also use the '' ? '' to wildcard a specific character position too instead of the Wildcard ''*'' that implicit the rest of the word.

Works like a charm but you need to implemant a standardised nomenclature to achieve it.

[jandrewartha]

My problem is I want to identify our admin accounts (which are d- for domain, s- for server, w- for workstation admins) on servers, but not on workstations. Ignoring them will ignore them everywhere which is not what I want.

[jpcastilloux1]

You could create a separate VDOM for your Workstation and in this VDOM you could point to a different FSSO server that has a different ignore list because each VDOM has the possibility to configure different FSSO servers.