Forticlient EMS user logged into server they shouldn't have access to.

[danvatek]

Hi,

I have a situation where a standard user is being shown as logged into two domain controllers and another server  that they shouldn't have access to. The EMS server indicates the user under All Endpoints (see attached image). I've checked the Forticlient logs and it doesn't give any indication of this user ever being active on any of the servers.

Has anyone seen this before?

Thanks

Dan

[Anthony_E]

Hello Dan,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello Dan,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[Stephen_G]

Hi Dan,

I'm sorry we haven't been able to get you an answer here. It looks like your issue is quite specific to your security setup. If you haven't already, please pursue this with our TAC support team - we'll be happy to help you with your problem.

I hope that helps, but feel free to respond here if you need any more help or would just like further discussion.

Kind regards,