Technical Library | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Troubleshooting > User configuration and identification issues > User and group-based policies are not applied
User and group-based policies are not applied
Web Security Help | Web Security Solutions | Version 7.8.x
If Filtering Service is applying computer or network policies, or the Default policy, to Internet requests, even after you have assigned user or group-based policies, or if the wrong user or group-based policy is being applied, use the following steps to pinpoint the problem:
*
If you are using nested groups in Windows Active Directory, policies assigned to a parent group are applied to users belonging to a sub-group, and not directly to the parent group. For information on user and group hierarchies, see your directory service documentation.
*
The User Service cache may be outdated. User Service caches user name to IP address mappings for 3 hours. To clear and recreate the cache, go to the User Service Cache section of the Settings > General > Directory Services page in the Web Security manager, and then click Clear Cache.
*
User Service may have been installed using the Guest account, equivalent to an anonymous user to the domain controller. If the domain controller has been set not to give the list of users and groups to an anonymous user, User Service is not allowed to download the list. See Changing DC Agent, Logon Agent, and User Service permissions.
*
If User Service resides on a Websense appliance or Linux server, and you are using DC Agent (with Active Directory in any mode) or Logon Agent (with Active Directory in native mode) to identify users, verify your WINS server configuration. See User Service on a Websense appliance or Linux server.
*
If a user on a machine running Windows XP SP2 is receiving the wrong policy, the problem could be due to the Windows Internet Connection Firewall (ICF), included and enabled by default in Windows XP SP2. For more information about the Windows ICF, see Microsoft Knowledge Base Article #320855.
For DC Agent or Logon Agent to get user logon information from a machine running Windows XP SP2:
1.
On the Client machine, go to Start > Settings > Control Panel > Security Center > Windows Firewall.
2.
Go to the Exceptions tab.
3.
Check File and Printer Sharing.
4.
Click OK to close the ICF dialog box, and then close any other open windows.
If none of these steps addresses your issue, check the following topics, or search support.websense.com for additional information.
*
Directory service connectivity and configuration
*
Directory service configuration
*
User identification and Windows Server

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Troubleshooting > User configuration and identification issues > User and group-based policies are not applied
Copyright 2016 Forcepoint LLC. All rights reserved.