FSSO CA failing to track user logons

[King_Mob]

Network setup: FSSO CA installed on a dedicated server, 4 domain controllers each with a DC agent. Domain controllers are 2012 R2, workstations are Windows 7.

Issue: Users logons occasionally fail to get tracked by the FSSO CA. A user will log in to Windows on their workstation but if you search the “Logon Users” in the CA the user does not show up. This causes the user to get web filter blocked by the firewall when visiting websites.

Findings:

Searching the “View Logon Events” log in the CA does not have an entry for the user logging on. The previous entry for that user is their dead entry timeout from the night before.

Searching the domain controller’s event viewer I do find a logon event for the user.

The CA has the default configuration for which event IDs to track (4768 and 4776) http://kb.fortinet.com/kb/viewContent.do?externalId=FD36424&sliceId=1

We are only auditing for event ID 4768, there are no 4776 event IDs present in the domain controller event viewer.

We are currently using the following settings in the CA: “Disable RDP Override” and “Support NTLM authentication”.

We have added all our AD service accounts to the “Ignore User List” in the CA.

I’ve been troubleshooting this with Fortinet support but they have not been able to resolve the issue so far. Currently they want me to verify that the server that hosts the FSSO CA returns the correct computer name and IP when an nslookup is done on the workstation from the server when the problem occurs, I am waiting for the issue to occur again so I can check this. I think the problem is most likely to do with the event IDs we are generating and tracking but I’m not sure how to troubleshoot this.

Any suggestions are appreciated.

[Jeff_FTNT]

FSSO check event log to find logon user.

Double check your FSSO CA setting, which mode did FSSO use to find login user?

Make sure choose one which is works for your server.

DC Agent mode

Polling +NetAPI --old

Polling +event log

Polling +event log using WMI

[King_Mob]

The log on event is missing from the “View Logon Events” log.

We are using DC agent mode.

[Jeff_FTNT]

"The log on event is missing from the “View Logon Events” log."

Sound like Windows server issue.

[King_Mob]

Jeff_FTNT wrote:

"The log on event is missing from the “View Logon Events” log."

Sound like Windows server issue.

As in the domain controllers? They are generating event ID 4768, what else would the issue be?

[Jeff_FTNT]

Search  event ID 4768 .

Kerberos Authentication Service/Audit Failure

[King_Mob]

Jeff_FTNT wrote:

Search  event ID 4768 .

Kerberos Authentication Service/Audit Failure

Search what, the domain controller events? Yes, the DCs are generating event ID 4768.