This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Some Live Users Show up as Administrator in STAS

Hey i followed this guide to authenticate my Users:

https://community.sophos.com/kb/en-us/123156

But half of the Users show up as Administrators from their PCs.

Why?
To put the Administrator on the Exclusion list is no option.
Then half of the company dont show up.
Its a Domain and all Users log in with: mydomain/username

no one knows the administrator password.

STAS is on a 2012 R2 DC installed. and the local firewall is disabled.

This thread was automatically locked due to age.

Parents

0 Bill Roland over 7 years ago

You have any Windows services or scheduled tasks that use the Administrator user to run under? In my experience, that'll do it.
Cancel
Vote Up 0 Vote Down

Cancel
0 Rob Dust over 7 years ago in reply to Bill Roland

Hi,

no there aren any task on the client pcs.

i have ca. 50 users...

about the half are shown up as Administrator. But not the whole time.

it seems like they show up randomly as Administrator then randomly with the correct name.

I am the first one with this Problem?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 7 years ago in reply to Rob Dust
Hi,

never saw such a issue on STAS before. But the agent basically gets all the Login Events on the DC.

I would recommend to check the event log. There should be some events regarding Administrator logged into the the Client PCs. Maybe some services?

https://www.eventtracker.com/newsletters/following-a-users-logon-tracks-throughout-the-windows-domain/

Additional logon/logoff events on servers and authentication events associated with other types of user activity include:

Remote desktop connections

Service startups

Scheduled task

Application logons – especially IIS based applications like SharePoint, Outlook Web Access and ActiveSync mobile device clients

Cheers
__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LuCar Toni over 7 years ago in reply to Rob Dust
Hi,

never saw such a issue on STAS before. But the agent basically gets all the Login Events on the DC.

I would recommend to check the event log. There should be some events regarding Administrator logged into the the Client PCs. Maybe some services?

https://www.eventtracker.com/newsletters/following-a-users-logon-tracks-throughout-the-windows-domain/

Additional logon/logoff events on servers and authentication events associated with other types of user activity include:

Remote desktop connections

Service startups

Scheduled task

Application logons – especially IIS based applications like SharePoint, Outlook Web Access and ActiveSync mobile device clients

Cheers
__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data