Welcome to ISAserver.org

ISA server 2004 Unknown users

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 Firewall] >> Logging and Reporting >> ISA server 2004 Unknown users

Page: [1]

Message

<< Older Topic Newer Topic >>

ISA server 2004 Unknown users - 24.Apr.2006 6:30:25 PM

ZEN2005

Posts: 6
Joined: 7.Apr.2005
Status: offline

Hi there

When I check my reports, TOp users I saw a lot of unknown users, as we know this kind of users are (SecureNAT clients and unauthenticated Web Proxy clients). So, the question is, there is any option in order to identify this users? you know.

thanks in advance

bye

Post #: 1

Featured Links*

RE: ISA server 2004 Unknown users - 24.Apr.2006 6:53:34 PM

Kiddx

Posts: 38
Joined: 12.Jun.2004
From: Boca Raton, FL
Status: offline

You have to disable Anonymous users or All Users for web traffic, or any traffic that you want to collect user information on.

Goto your http/https outbound rule and remove all users and set it to authenticated users only. This will force the fwclient to send the credentials to ISA.

If you only want web traffic create a seperate rule for http/https outbound and 'other' traffic outbound. Since your servers usually require things like sntp/dns/smtp etc you want to seperate usage so you dont squash your servers ability to do its work.

(in reply to ZEN2005)

Post #: 2

RE: ISA server 2004 Unknown users - 18.May2006 6:57:22 PM

ZEN2005

Posts: 6
Joined: 7.Apr.2005
Status: offline

Hi there

I already did that, all my access rules has included all auth uses, but in my reports I still see a lot of unknown users, how is this possible?

By the way, my users doen�t have Isa firewall client installed, they are configured as a web proxy clients.
This is the cause of this behavior?

Hope any suggestions !

thx a lot !

(in reply to Kiddx)

Post #: 3

RE: ISA server 2004 Unknown users - 18.May2006 7:01:36 PM

LLigetfa

Posts: 2184
Joined: 10.Aug.2004
From: fort frances.on.ca
Status: offline

quote:

my access rules has included all auth uses

It is not a matter of inclusion but of exclusion. You have to exclude "All Users".

_____________________________

The School of Hard Knocks is a mean teacher. She gives the exam before the lesson.

(in reply to ZEN2005)

Post #: 4

RE: ISA server 2004 Unknown users - 18.May2006 9:49:51 PM