The only time I've seen this happen is when she tries to login while plugged into the network but also on via wireless.  It'll login by one, but the client doesnt realize that it's connected through the other interface, so it pops up again.  Then when you login, it uses the default route (read: default interface) and logs in through the "primary" interface again.  It's still not on via wireless, or the secondary interface, so it tries to login again.  I'd definately try disabling her wireless first

But why that would cause it not to happen when you're in your office....do you get wireless reception in there?

Regards,
Alex Lanstein




-----Original Message-----
From: Perfigo SecureSmart and CleanMachines Discussion List on behalf of Grzeczka, Timothy J.
Sent: Wed 4/19/2006 12:02 PM
To: [log in to unmask]
Subject: Re: 3.5.13 Agent Question
 
On Tuesday, I posted regarding a student having issues logging into
Clean Access. When she signs in, she is immediately forced off. I ran a
few spyware and virus scans on the machine to be sure there was nothing
wrong with it and it passed every scan. I then logged in as my username
and was able to stay logged in with no problem.

I returned the laptop to the student this morning and she called back
within a few minutes reporting the same issue. Within seconds of
pressing OK on the "login succeeded" screen, she is asked to login
again. I checked our Clean Access Agent Reports and the last report for
her username is 3/31/2006 (a success).

Here's where it gets interesting. I checked the Event Log and found two
entries. First is the student's successful login:

-----

Category - Authentication 
Time - 2006-04-19 10:38:24
Event - [00:12:3F:81:BA:98 ## 10.0.51.173] - o'colaur - Successfully
logged in, Provider: DOM, Access point: N/A, Network: N/A

-----

Then I find this entry about two seconds later:

-----

Category - Authentication
Time - 2006-04-19 10:38:26
Event - [00:12:3F:81:BA:98 ## 10.0.51.173] o'colaur - Forcefully logged
out by administrator

-----

This combination of entries is present for this user "o'colaur" from
about April 6th onward. I checked with the other admin and we haven't
made any changes to our checks and config in a while. We're running
Version 3.5.10 of CCA and the student has the 3.5.13 agent installed.
None of our other 270 or so users have reported this.

My only though was maybe the quote in her username might be causing some
issues, but she's been using this login name since we rolled CCA out
last year.

Any thoughts or ideas are welcome.




 
Timothy Grzeczka
Network Analyst
Dominican University
[log in to unmask]
Voice - (708) 524-6568
Fax - (708) 488-5111