topic Re: User details in Cortex XDR Discussions

User details

Shahwaz_Md — Tue, 03 Oct 2023 10:32:29 GMT

Hi Team,

Can we check user details on the XDR console - Local user with admin privileges?

Any way to identify such users?

Regards,

Shahwaz

Re: User details

Vinothkumar_SBA — Tue, 03 Oct 2023 11:39:43 GMT

Yes, you can easily check user privileges in the Cortex XDR console by following these steps:

Log in to the Cortex XDR management console.
Select Settings → Configurations → Access Management → Users.
In the Users page, you will find a variety of options to assist you in managing users
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions https://live.paloaltonetworks.com/t5/general-topics/how-and-why-to-accept-a-solution-to-your-post/td...

Re: User details

aspatil — Tue, 03 Oct 2023 15:21:57 GMT

Hello Shahwaz,

Do you mean the windows local account with admin rights?

Re: User details

Shahwaz_Md — Tue, 03 Oct 2023 15:37:01 GMT

Yes, correct. Any way to identify that through XDR.

Re: User details

PiyushKohli — Wed, 04 Oct 2023 05:39:52 GMT

Hi @Shahwaz_Md

Thank you for writing to live community! Yes, you can identify windows user accounts with admin rights however it would require Host Insights License. If you have HI License, you may use "Users to Groups" under Host Inventory locate at Incident Response → Investigation → Host Inventory. User to Groups shows a list mapping of all the users, local and in your domain, to the existing user groups on an endpoint. And you may filter Group names by "Administrator" to look for users with Admin rights.

For details you may check under here

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Re: User details

BrockJudd — Tue, 14 Nov 2023 22:27:12 GMT

Accept as Solution