TS Agent Unable to Map Users to SMB Traffic
33672
Created On 09/25/18 20:40 PM - Last Modified 04/30/26 13:16 PM
Symptom
- SMB traffic is not assigned a user mapping by the Terminal Server Agent.
Cause
- Sessions to SMB file shares set up by users on the terminal server are not mapped to usernames by the Terminal Server Agent and are thus not mapped to a user in the traffic log.
- If the traffic is initiated by an application running with the context of a user (e.g. telnet), the socket information can be intercepted by the TS Agent, which will replace the source port. However, if the traffic is generated by a service running with System context, the agent is not able to determine the user information. The Terminal Server Agent will not identify SMB traffic, as this is run in a system context.
- On Windows machines, you can use Task Manager to identify the username associated with a running process. If the process is assigned to the correct user, it should be running in the appropriate session. Note that any process running as SYSTEM, for example, will not be covered by Terminal Server Agent.