FSSO, Identity based policy and shared user accounts

[uhchelpdesk]

We have an issue where a couple of our users occasionally cannot browse the internet. We are using Identity Based Policy without a guest account. I have verified that these workstations do have remote registry turned on. I can connect to the registry remotely. (This was an issue we had on a few of our workstations.) The only thing I can see that the accounts have in common is that they are shared accounts. There are at least 6 or more computers that the same user logs in on. Not all of the computers will have the issue. Typically it is one at a time, but when they do if we log them off then back on again we they can browse the internet again.

[rwpatterson]

Welcome to the forums. When these users are unable to browse, can you see that they are authenticated in the firewall? (Look under ' User > Monitor > Firewall' )

[uhchelpdesk]

Yes but not for that IP address. The logs show Authentication user from X.X.X.X was timed out.

[rwpatterson]

By any chance are you pushing down software during login? If so you may need to exclude that account from FSSO registration.

[uhchelpdesk]

We don’t do that with these shared account but we do with almost all of the other accounts. Why does that make a difference? I don’t understand the connection. On the other hand I think we have narrowed the issue to shared accounts with Windows XP os. We don’t see the same issue with our group that uses a shared account and are all on Windows 7.

[rwpatterson]

When pushing software, that pushed account is seen as being logged in (yes, even after the real user has logged in) while the software push is in place. After the push is done, that account ' logs out' and the login session is shown as terminated. This is why there is an option in the FSSO software to ignore certain accounts.

[uhchelpdesk]

Thanks for the clarification unfortunately that’s not the issue we have here. We did verify that when the user is “blocked” from browsing the internet the account/IP address is not listed in the monitor section of the Fortinet nor are they listed in FSSO. I thought that it was the case that they were listed but had the “Not Verified” status but after further review I don’t see the workstation IP/username combination listed in FSSO. Thanks a lot for your assistance.

[rwpatterson]

Is it based solely on the workstation? What I mean is: can they successfully authenticate from a workstation sometimes, but not other times from the same box?

[uhchelpdesk]

yes it will work fine when a user first logs in then at some point they will be blocked once they are blocked if they lock the workstation then unlock it they can get out again. It acts like it has something to do with being a shared account on XP and some sort of timeout.