I have been doing some pretty extensive testing with MWR and have found some relatively concerning/annoying 'features'.
When I try and run a report against a username/period of time. To see what sites this user has access. The report shows URL's that were returned to the user, not what URL's the user requested.
For example. I created a brand new AD User and went straight to 'http://www.speedtest.net/' and only there.
When I look at reporting I have 'http://www.facebook.com/' showing up in reported along side a number of other addresses like 'http://www.ookla.com' that weren't explicitly requested, but I'm guessing were returned as they are links on the site.
The only reference to Facebook on the Speedtest site is down in the bottom Left Hand corner where it is simply a link to their FB page.
The reason this is of concern is because if we for example tell users we don't want them accessing FB, we are unable to create a report that will accuratey determine they've explciitly disobeyed this request. I'm not lookingto block FB or anything of this nature, I'm just looking for more accurate reporting. Reporting that only returns what was requested by the user, not what was returned by the browser.
You have to look for the urls with no referer String.... but I don't know if this is possible with the Reporter. We do this for our own with some scripts.
Any chance you can better explain what you mean by refferer string? For example, this is one of the links that I never hit, but have been loaded by another URL: