Unauthorised access

Got a strange problem with an ISA SP1 Cache only server.

Access to the Internet is via  Group membership, applied to site and content 
rules.

So far so good, been working OK for ages, but now someone has turned up in the 
logs who does NOT have access via the group membership.

Furthermore, looking thru the security log, there is no evidence of this person 
ever having authenticated with the ISA.. 
ISA is set to Authenticate Users, using Basic and Windows authentication.

Tests have shown that removing a legitimate user from the Group does remove 
their access - as it should.

So how does my mystery user get access? It's not via any nested group 
membership either.

I'm stuffed if I can find out..

Cheers
Neil

Other related posts: