My username is showing in loads of computers

[insuirin]

Logon_event.log

I have circa 1000 users daily. For some reason when checking Logon_event.log, I can see my username on loads of the workstations. This makes no sense to me. Other users are logged on these devices. 

I am checking for a service that may be running as me etc. 

[xshkurti]

@insuirin 
This forum is about Fortinet products and their implications. You should check in microsoft/linux forum about this type of issue.(depeding on Operating System you are using)

[insuirin]

Apologies. I would assume seeing as you are down as staff you would realise the 'Logon_event.log' is the Fortinet logs for the FSSO Agent. I should have made my post more clear.

This log file is where I see my username appear on loads of machines that I am not logged on to. I have a theory that one of my servers which is integrating my workstations to run inventory (PDQ Inventory) is running as my user and it could be generating logon events confusing the Firewall into thinking a different user is logged on to the workstation. I could be wrong on this but I have told FSSO agent to 'Ignore' my account for now.

[spoojary]

Given the context of the Logon_event.log from the Fortinet FSSO Agent, and with your observation regarding the PDQ Inventory, your theory could very well be the reason behind the behavior you're seeing. Here's a breakdown based on your information:

1. PDQ Inventory or Other Management Tools: If PDQ Inventory or any other remote management tool is running under your credentials, every time it accesses a workstation to pull inventory data (or for any other task), it might trigger a logon event. The Fortinet FSSO agent could interpret this as you logging onto the machine, especially if PDQ Inventory is using some form of network or interactive logon that FSSO monitors.

2. Fortinet FSSO Behavior: The Fortinet FSSO agent works by monitoring specific logon/logoff events from domain controllers and other sources. If a system or tool causes a logon event to be generated using your credentials, FSSO would interpret that as you logging onto the system, hence your username appearing in the logs against many machines.

3. Ignoring User Account: Using the 'Ignore' option for your account in the FSSO configuration is a good temporary measure to prevent your account from being incorrectly mapped to multiple machines. However, it also means your actual logons may not be tracked accurately by FSSO.

4. Validation: To validate your theory:

   • Check when PDQ Inventory or any other management tools run their scans or tasks.
   • Cross-reference these times with the Logon_event.log to see if there's a correlation between the PDQ tasks and the unexpected logon events.
   • If possible, temporarily change the credentials under which PDQ Inventory runs and observe if the behavior persists.

5. Permanent Solution: If PDQ Inventory (or another tool) turns out to be the cause, consider using a dedicated service account for such tools, rather than a personal user account. This not only helps in scenarios like this but is also a best practice from a security standpoint.

In conclusion, based on your description, it seems quite plausible that a system or tool like PDQ Inventory, when accessing workstations using your credentials, could be generating logon events that the FSSO agent picks up on. Validating this theory and then implementing best practices should help address the issue.

[insuirin]

The reason for my username showing up everywhere was due to a service (PDQ inventory) that was running as my account, this was connecting to workstations and generating logon events which confused FSSO. I changed this account to a service account and told FSSO to ignore that account.