SSO - TSAgent on RDS servers not sending info to collector

[Tudor]

Hello Guys,

In my environment we have 5 RDS servers and local computers.

The local computers SSO is working fine. We can see the logons on the collector and on fortinet 90d.

We have installed TSAgent on each RDP server, (open the ports, enabled remote reg) etc.. but at this point is allowing only one sesion / rdp to get connection.

Please find the below low from TSagent. 

The moment testuser2 connects tesuser1 is kicked out. 

Any ideas? Please Help

06-14-2016 18:06:05 [00000988] session ID:1, username: testuser, domain: DISCOVERY 06-14-2016 18:06:05 [00000988] session ID:1 has added to session table 06-14-2016 18:06:05 [00000988] succeeded to allocate port range 1001-1200 for session 1 06-14-2016 18:06:05 [00000988] ******** packet info -- workstation: 10.1.163.125, IP address: 10.1.163.125 ******** 06-14-2016 18:06:05 [00000988] Failed to call WTSQuerySessionInformation with WTSUserName, username length is 0, error:0 06-14-2016 18:06:05 [00000988] Failed to get username for session ID:65536 06-14-2016 18:06:05 [00000988] failed to add session 65536 06-14-2016 18:07:54 [00000988] Message WTS_REMOTE_CONNECT, session ID:2 06-14-2016 18:07:54 [00000988] Failed to call WTSQuerySessionInformation with WTSUserName, username length is 0, error:0 06-14-2016 18:07:54 [00000988] Failed to get username for session ID:2 06-14-2016 18:07:57 [00000988] Message WTS_SESSION_LOGON, session ID:2 06-14-2016 18:07:57 [00000988] session ID:2, username: testuser2, domain: DISCOVERY 06-14-2016 18:07:57 [00000988] session ID:2 has added to session table 06-14-2016 18:07:57 [00000988] succeeded to allocate port range 1201-1400 for session 2 06-14-2016 18:07:57 [00000988] ******** packet info -- workstation: 10.1.163.125, IP address: 10.1.163.125 ****

[Smoetzak]

Hello

I have the exact same issue.

Have you found a solution to this?

[boneyard]

can you share your log? the above one doesn't appear to point in a very specific issue.

[Smoetzak]

Sure.

Files are on my Owncloud:

https://smoetzak.no-ip.info:9000/s/r5zzMVg4cy7yp2Z

Password: fortinet

[boneyard]

so what exactly fails? the log seems to indicate sessions , loginnames and port ranges being handed out.

[Smoetzak]

Indeed. Everything looks ok, but still when the user goes to a website it shows in the webfilter logs as an unauthenticated users, and thus being hit on the wrong policy.

[boneyard]

and there is a rule above this one that the user hits and allows such access? or is that rule below it? what happens if you disable that other rule?

[Smoetzak]

Yes, there are rules above it (which require authentication) and are working fine: I must say I only have this phenomenon on the citrix servers.

If the users are working on their local computers they are authenticated just fine and are hit by the right policy (the one above being hit on the citrix).

I've opened a ticket with fortinet. I'll keep you updated.

[lsauthie]

Hi guys, exactly the same issue

[DiamondGalant]

Hi! We have the same problem too. What about answers by tech support?