How can I tell which users are counted against my license?

Answer

GFI WebMonitor 2015 and later

1. Browse to Settings > Licensing
2. Under the Licensed Seats, click the link that show the number of users / license

3. This will open a page with a list of user and you can use the export list link to have the list exported as a text file.
4. From this list you can also add users to the exclusion link, clicking the link exclude.

GFI WebMonitor 2013

1. Stop all the GFI WebMonitor services (also the TMG firewall service when applicable)
2. Open regedit (Start > Run > Type 'regedit' and press Enter)
3. Browse to:
   • x86: [HKEY_LOCAL_MACHINE\SOFTWARE\GFI\Webmonitor]
   • x64: [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\GFI\Webmonitor]
4. Change the debug dword value from '0' to '1'
5. Re-start the services stopped in step 1

1. Open GFI WebMonitor configuration in order to create the log files. The resulting log file detectedusers.log is located in the folder ..\GFI\WebMonitor\DebugLogs.
2. Open the file 'detectedusers.log'. This contains all the users / IPs that are being counted against the license.

GFI WebMonitor 2012 or earlier

1. Open GFI WebMonitor in order to create the log files. The resulting log file WebMonUsers.txt is located in the folder ..\GFI\WebMonitor\DebugLogs.
2. Open the file WebMonUser.txt using a text editor 
3. Search the file from the end of the file up for the string New user detected. You should see and entry like this:
   • "WebMonUsers","LC: New user detected:: user:DOMAIN\JSMITH, last_machine:192.168.1.55."
   • followed by:
   • "WebMonUsers","LC: Recalculating user count >>" 
4. From this point each user that is being counted toward the license. It will be listed starting with the string USER DETECTED: user. Here an example:
   • "WebMonUsers","LC: USER DETECTED: user:DomainName\administrator, last_machine:192.168.1.55."
   • "WebMonUsers","LC: USER DETECTED: user:192.168.1.22, last_machine:192.168.1.22."
5. Ignore any of the entries that begin with the string USER DETECTED but NOT added:
6. At the end of the recalculation you will see it end with the following total number of users counted and it should match with your counting:
   • "WebMonUsers","LC: [106] <<"

1. Counted users listed with only an IP Address (e.g. "WebMonUsers","LC: USER DETECTED: user:192.168.1.22, last_machine:192.168.1.22.") means the following:
   • When integrated authentication is used: an user or service application, attempted a request but could not authenticate. This could happen with an ISA /TMG server when a browser requests the WPAD.dat automatic proxy configuration script.
   • When integrated authentication is not used: A normal connection that originates from an IP address is being counted.
2. Users listed as <ComputerName>$ are normally services on the <ComputerName> computer that are running under the Local System account. These are often anti-virus or other software updater application. If you are sure these URLs they are accessing are safe and secure, then add the <ComputerName>$ user to the Always Allowed List (in GFI Webmonitor 2012) or Whitelist (in GFI Webmonitor 2011). This  will cause them not to be counted AND for the traffic not to pass through any filters or anti-virus scanning. If you do this, make sure these sites they are accessing are safe and secure.