User name not showing up for NTLM/AD Joined Auth in Logs

[Guest]

[jfinnigan]

I'm using Edian as a proxy server only (non-transparent and not using it as a router)

It's using NTLM Auth and It is joined to the domain. SSO with the proxy works fine on windows 7 (and my test windows 8 machine)

However the logs never say the user name of the person who got a blocked page  It shows the date 127.0.0.1 then the users actual IP followed by the denied page url.
the Blocked page only shows 127.0.0.1 where the -User flag is at. How do I get it to show there A/D username instead of the loopback ip?

Thanks,
Jason

[jfinnigan]

Update:

I did look in the squid Access logs (/var/log/squid.log) and the usernames show their so why don't they in the dansgurdian logs on EFW webgui?

The odd thing is in the denied entries no username appears, but in the TCP_MISS Entrties they do.