This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Active Directory user long gone but still in the logs

Hi,

We have very weird issue. Sophos is in Active Directory environment.

Now, we have an employe who left over a year ago. His machine was given to new employee but the traffic from that machine is counted as it was the former employee acessing the internet. I mean when i go to Logging & Reporting -> Web Protection -> Users. User does not exist in AD.

We have 5 UTMs in the company and only one is acting up.

How is this happening and how can i fix it?

Kind regards,

Andrzej

This thread was automatically locked due to age.

0 stn over 5 years ago

It's weird. User apears in Logging & Reporting -> Web Protection -> Users but i searcjhed for it in Web filtering logs and no sign of this user.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 5 years ago

Hi Andrzej,

I don't remember seeing this problem mentioned here before, so I'll try guessing. Is the user object for that user still present in WebAdmin?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 stn over 5 years ago in reply to BAlfson

Yes, it was. The user was created there to test something and then has been disabled.

Deleted the user. Hope this resolve the issue

Thank you very much

Kind regards,

Andrzej
Cancel
Vote Up 0 Vote Down

Cancel
0 stn over 5 years ago in reply to BAlfson

Hi,

Unfortunately this didn't resolve the issue. I was checking the Web Usage Report for Today and the user still shows up in the report.
Cancel
Vote Up 0 Vote Down

Cancel
+1 stn over 5 years ago in reply to stn

This was taken from DHCP Reservation. They were called after users.

After renaming the reservation user no longer appears in web protection logs
Cancel
Vote Up 0 Vote Down

Cancel