Our web filter seems to be pulling ldap from a cache, and throwing logins randomly through out the reports. We run a Citrix environment, which we noticed was causing an issue with ldap. I have since configured hybrid authentication and setup the Citrix users to run through the proxy, with Kerberos. All seemed to be going well until we started to notice some funny reports the past couple days.
Using my login for an example. I went to a couple linux sites yesterday and downloaded some distros, so I had high usage. The reports are showing a different user going to those sites instead. Now I could see this if it was on a Citrix server (inline config), but I don't run Citrix.
Also, I had a linux box that I was updating(not on the domain) and the reports came back saying that it was using an AD account that I had deleted months ago.
1. Is it...