Active Directory user long gone but still in the logs

Hi,

 

We have very weird issue. Sophos is in Active Directory environment.

Now, we have an employe who left over a year ago. His machine was given to new employee but the traffic from that machine is counted as it was the former employee acessing the internet. I mean when i go to Logging & Reporting -> Web Protection -> Users. User does not exist in AD.

We have 5 UTMs in the company and only one is acting up.

How is this happening and how can i fix it?

 

Kind regards,

Andrzej

  • It's weird. User apears in Logging & Reporting -> Web Protection -> Users but i searcjhed for it in Web filtering logs and no sign of this user.

  • Hi Andrzej,

    I don't remember seeing this problem mentioned here before, so I'll try guessing.  Is the user object for that user still present in WebAdmin?

    Cheers - Bob

  • In reply to BAlfson:

    Yes, it was. The user was created there to test something and then has been disabled.

    Deleted the user. Hope this resolve the issue

     

    Thank you very much

     

    Kind regards,

    Andrzej

  • In reply to BAlfson:

    Hi,

     

    Unfortunately this didn't resolve the issue. I was checking the Web Usage Report for Today and the user still shows up in the report.

  • In reply to stn:

    This was taken from DHCP Reservation. They were called after users.

    After renaming the reservation user no longer appears in web protection logs