Technical Note: Solutions for tracking logged in users

cmaheu · ‎03-25-2019

Description
Tracking the logged on user allows the administrator to:

Assign polices for endpoint compliance and/or network access based on user criteria
Track who is logged into the computer at any given time

The currently logged on user for any given host can be accessed from the Administration UI under Hosts > Host View.

Additional configuration is required in order to collect user login information.

Scope
Version: 8.x

Solution
Configuration Options

Use an Authentication VLAN and force users into a captive portal: Requires the user to enter credentials in the Captive Portal. This may result in a second login and will cause a VLAN switch once credentials are supplied in the portal.
Utilize the Persistent Agent credentials dialog: Requires the user to enter credentials via pop-up dialogue from the installed Persistent Agent. This method may result in a second login and may also result in a VLAN switch depending upon Authentication policy configuration. For details, refer to Persistent Agent Configuration and Deployment reference manual in the Fortinet Document Library.
Single Sign On function in the Windows Persistent Agent: For details, refer to Persistent Agent Configuration and Deployment reference manual in the Fortinet Document Library.
RADIUS 802.1x Authentication: User name is tracked as long as the EAP type configured in the host supplicant identifies the user (such as with PEAP). If the user name is encrypted or not provided (such as with EAP TTLS or EAP TLS), the name cannot be identified. For details on wireless integrations, refer to the Wireless Integration Overview guide in the Fortinet Document Library.

Related Articles