FortiAnalyzer report

[kinmun]

I noticed that in the Top 30 Users by Bandwidth and Session Report.

there is always an Administrator user in my report.

I believed that this is the windows default Administrator account.

How can I find out which are the servers or desktops is using this account consuming the data?

does it count even if the administrator is not logon to the servers or desktops??

[abelio]

Hi,

what do your logs say? IPs are there.

If you use FSSO, perhaps those administrator logins are related with some services account enabled and not filtered within FSSO setup

regards

[kinmun]

we do not use FSSO.

i guess i found the co-relation between the different reports.

all the windows desktop count towards the administrator bandwidth