This message was deleted.

Hi Mate - yeah we had this. Check in the session profile for the VPN and see if “Single Sign On to Web Applications” is turned on. If it is switch that off. We were getting a ton of lockouts because of that being on and sending NULL SID

@Dave Brett yo! yeah that was the first thing i tried, but no instant difference so i turned it back to normal, i will turn off again and see if i am going mad - did you need to do anything with domains on your AAA auth profile at all as well?

no that I remember - can send you the session profile CLI so you can take a look

Yeah the SSO setting is usually the culprit here. If you can, try talking to the SCCM admins to see if you can get an example entry from the Security log on the relevant SCCM server for one of the clients having an issue. The smoking gun is that usually the authentication realm is sent as "NETSCALER" if SSO's trying to kick in.

Jumped on a Teams Meeting with Kindo earlier - think its sorted out now

Yeah thank you very much lads - mostly sorted, just working through some straggler lockouts now trying to see what/why it's happening