FortiNAC
NOTE: FortiNAC is now named FortiNAC-F. For post-9.4 articles, see FortiNAC-F. FortiNAC is a zero-trust network access solution that provides users with enhanced visibility into the Internet of Things (IoT) devices on their enterprise networks.
FortiKoala
Staff
Staff
Article Id 193912
Description
Windows 10 MAC Randomization Causing Multiple Host Records

Scope
Version: Network Sentry 8.0.3 and above
Solution
Version: Network Sentry 8.0.3 and above

Issue: Multiple host records listed in Host View with the same hostname but different Mac addresses.  This behavior can occur if the following conditions are met:
  • Host is running Windows 10.
  • Host has MAC Randomization enabled.
  • Host has two adapters enabled: wireless and Ethernet.
  • Host is connected to the network via Ethernet.
  • Host's wireless adapter keeps attempting to connect to the Wifi unsuccessfully.


Note that Windows 10 machines with more than two adapters enabled (whose address does not change) in addition to the wireless adapter do not exhibit this behavior.


Example:
Machine exhibiting the behavior would only display two adapters when "ipconfig /all" is run in the hosts's command line:
00:11:22:33:44:55 - Wired Ethernet adapter
02:00:00:00:00:01 - Wireless adapter

Machine not exhibiting the behavior:
00:11:22:33:44:55 - Wired Ethernet adapter
00:11:22:33:44:56 - Bluetooth adapter
02:00:00:00:00:01 - Wireless adapter


Workaround:
Option 1) Disable Mac Randomization on host.
Option 2) Disable wireless adapter on host.


Solution:  Addressed in Network Sentry 8.1.5


Contributors