Smoothwall & Chrome running as Admin?

[synaesthesia]

Just found something a little disconcerting - some users filtering requests are going through as unauthenticated IPs despite being successfully authenticated. The logs show some results coming through unauthenticated IPs, others with usernames attached. This appears to be via Chrome, but can't confirm if it happens with other browsers as yet. Have one instance where the same result at exactly the same time reports with and both without the username, as if a simultaneous search is made from the IP separate to the user.

Not a major issue on it's own as long as the user is reported but there's more than one occasion where it's not, and it's only the unauthed IP showing in reports. Any clues where to start on this? Running on Smoothwall Maiden 25.

[tom_newton]

How are you authenticating these users?

[synaesthesia]

Idex across the board, directory diags all pass with flying colours. Forgot to mention, I noted about the chrome running as admin as we'd had that a few times that it was authenticating as the system user for a short while before picking up as the logged in user. That did get resolved though.

[tom_newton]

If the user has properly logged in, Idex should pick up the entire IP as that user - regardless of the software being used. Is there fast user switching or some other horror on the go?

[ibpalle]

If you logged in as local admin, not domain admin, that may not have caused a domain login event and thus no iDex info.

[synaesthesia]

If you logged in as local admin, not domain admin, that may not have caused a domain login event and thus no iDex info.

 

This is just general student usage, no admin login present. I'll do a bit more testing & digging later and raise a case. (I'm currently swearing at Monitor whilst auditing devices )

[BOOT]

Possibly traffic in a category that has been added to authentication exceptions?

[synaesthesia]

Possibly traffic in a category that has been added to authentication exceptions?

 

Oooooh that's a good shout - as it's only search traffic that does fit the bill. Cheers!

[tom_newton]

With idex you should not need any auth exceptions unless some unauthenticated devicers are using the network, or things are happening while no user is logged in