The network team has identified a system using an abnormal amount of bandwidth. After further investigation it was found that WGSS.exe (QESSO Security Services) was the source. What is the service doing to create this unexpected traffic/bandwidth usage?
This issue can been seen when a connection to the QESSO Controller(s) is not possible due network filewalls or local system configuration.
If you have enabled tracing and have a log file to review look for an entry similar to the following:
b6c:(YY/MM/DD HH:MM:SS.####):AdsiHandler.cpp :###: Retrieving all sites and subnets...
The key is the " Retrieving all sites and subnets" entry. This indicates the QESSO Controller cannot be contacted and thus the service performs a directory-wide search based off SITES and SUBNETS. In a large environment this can lead to a large amount of data transfer.
Verify that you have connectivity to your appropriate QESSO controllers on port 3644.
To enable debug tracing for Quest Enterprise Single Sign-On, please refer to Knowledge Article 46435, "How to enable debug tracing for Quest Enterprise Single Sign-On (QESSO)": https://support.quest.com/enterprise-single-sign-on/kb/46435.