Logon event RDP for FSSO

[anthony956]

Hello, We use FSSO to allow or not connection to Internet for users. We have a problem when we use RDP (Windows remote desktop), they credentials using on the remote desktop are updated also on the computer who has lauch RDP. We have reproduce this issue. We are connected with ABC account on 10.1.1.1. We launch a RDP session from 10.1.1.1 to 10.2.2.2 with account DEF. After that, we can see on the fortigate the DEF account on 10.2.2.2 and on 10.1.1.1. So from the computer 10.1.1.1 with ABC account, we have DEF rights ! So we need to De-authenticate DEF on Fortigate or restart a session to restore ABC rights on 10.1.1.1. When we look logon log on FSSO collector, we can see that DEF connect in first on 10.1.1.1 and after 10.2.2.2. So, why Windows RDP send a logon event whith DEF on 10.1.1.1 ? Do you know this problem ? 

I've opened a ticket on fortinet support, but I think it's not a FSSO bug. This is why I allow myself to ask the question here.

Thank you so much in advance.

Best regards,

Anthony.

[xsilver_FTNT]

Hello,

we saw and investigated that behavior with updated new RDP protocol as development case ID #165397 (not a bug) and problem is that when user authenticate via RDP the MS system creates logon event on DC which is indistinguishable from regular one and contains data as that DEF truly logged on 10.1.1.1.

Therefore Collector and FSSO subsystem spot that logon and as it later it overwrite/update current FSSO records with new data for workstation 10.1.1.1.

Possible solutions I see  (choose either one suitable for you):

---

A: use native RDP vithout security negotiations (older version ).

B: use FSSO WinSec Polling from collector instead of DCAgent mode.

C: as issue is caused by contradictory info gathered through two MS sub-authentication layer channels, then make a fix in registry of DC servers and change this to eliminate channel with wrong data and keep just Kerberos channel opened:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0] delete value Auth0 or change Auth0 value to anything other than dcagent. after that restart domain controller.

Best regards, Tomas

[anthony956]

Hello,

Thank you for your reply.

We have try to modify registr value on Domain Controller but we have the same problem...

Why ? 

Also, this value is not available on a standard Windows, only on Server...

Fortinet ask to me to use a special account for RDP session and to put this account on ignore user list. 

This is not really a good solution for customers...

Best regards,

Anthony.

[xsilver_FTNT]

Hello Anthony,

registry key should work, as it was tested before.

Surely it is just for server platforms as we are talking about registry records on DC not on workstations ! Maybe that's why it's not working as you expect.

Special account distinguishable from regular account by logon name format for RDP is good workaround I think. New RDP does logon action, DC creates two contradicting logon events through Kerberos and MSV channel, and if FSSO monitor both it will get them and update FSSO records one-by-one so if MSV one (wrong data inside) is last one, then you will get workstation overwritten. Issue is created by inacurate logon event through MSV channel. So you have to either ignore channel (registry change), or ignore a user logon event based on user name used (ignore list record).

regards, Tomas

[TG44]

I am on the newest version of FSSO and the problem is still remains. 

I have looked at the workarounds.

A: We need this as we are running RD environment with SSO

B: If your are meaning pulling info with the Fortigate then this environment is probably to big for that.

C: Value Auth0 does not exist

Any thoughts?

[wspsales]

I'm also experiencing this issue.. 

Fortinet replied my ticket:

---------------------

When a user use RDP, a login is registered on the Domain Controller, an IP only can have one user, the IP will use the last login.

With the previous rules, you can do next steps to avoid this override:

- On the FSSO Collector Agent - > Show Monitored DCs - > Select DC to monitor - > Check "Disable RDP override"

- Add accounts used for RDP in the FSSO Collector Agent - > Set Ignore User List - > Add Users - > Select - > Add

* Adding accounts, FSSO Agent will ignore logins from added accounts so the current session will not overridden.

---------------------

There's no such option as "Disable RDP override"..

You guys found any solution?

[lastangel]

HI

i have some problem

try edit regedit on Dc naturally and reboot, not work

flag "Disable RDP override" and reboot, not work

when connect to rdp server fortigate use new rdp user and ip of workstation

it's no a way esclude all user account. i need to use it on other workstation.

have solution???

p.s. Disable RDP override flag stay on last agent version