wrong IP address allocation

[Eslam_Samy]

hello I am having a Problem with one of the Notrbooks in my domain that any account log in to this notebook it shows a wrong IP address in the "Firewall user monitor " rather than the real one that the notebook already had , that is affecting logging to the internet Fortigate 90D thanks

[xsilver_FTNT]

If the logon in Firewall user monitor is FSSO then most probable reason is that your DNS returns that wrong IP for your workstation name. And as FSSO relies heavily on DNS, then wrong IP is picked up for logon records.

[Alivo__FTNT]

That looks really as DHCP/DNS issue. When you see difference in IP addresses > run in command line on your DC: nslookup workstation_name Result will be what your DNS sees. You will very likely see IP address that is also in Collector Agent(s). Fix is on DNS/DHCP.

[xsilver_FTNT]

Yes, that's good approach.

Check and compare affected workstations' ipconfig with nslookup <workstattion-name> run on workstation .. those are supposed to be same.

If it's FSSO setup then check nslookup on DC where Collector runs. As THIS is the point where DNS lookup or getHostByName is done and from this point of view is the IP resolved. And again, if whole DNS works well then even this nslookup result should show same IP as on workstation. You might also want to check that DC and workstation has same DNS setting.