article Nominated Discussion: Disable Local Account When NAC is Reachable in General Articles

article Nominated Discussion: Disable Local Account When NAC is Reachable in General Articles https://live.paloaltonetworks.com/t5/general-articles/nominated-discussion-disable-local-account-when-nac-is-reachable/ta-p/512261 <P><STRONG><EM><I data-stringify-type="italic">This article is based on a discussion, <SPAN><A title="Disable Local Account when NAC is reachable" href="https://live.paloaltonetworks.com/t5/general-topics/disable-local-account-when-nac-is-reachable/m-p/510749#M106254" target="_blank" rel="noopener">Disable Local Account when NAC is reachable</A>,</SPAN></I><I data-stringify-type="italic"> posted by <A href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/227075" target="_blank" rel="noopener">@BradleyFergel</A> </I><I data-stringify-type="italic">and answered by <A href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/11943" target="_blank" rel="noopener">@Kiwi</A> .</I><I data-stringify-type="italic"> Read on to see the discussion and solution!</I></EM></STRONG></P> <P> </P> <DIV class="lia-message-template-content-zone"> <BLOCKQUOTE> <P>Is there a way to disable the local account when an external authentication method is reachable? Only being able to log into the local account if it cant reach the external authentication server?</P> </BLOCKQUOTE> <P> </P> <P><STRONG>You can't disable an admin account directly on the administrator menu. However there's a little trick you can do:</STRONG></P> <P> </P> <P>First create a local user via Device > Local User Database > Users</P> <P> </P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="kiwi_0-1659601881274.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/42773i1F3215718E8130AE/image-size/large?v=v2&px=999" role="button" title="kiwi_0-1659601881274.png" alt="kiwi_0-1659601881274.png" /></span></P> <P> </P> <P>Then create a local authentication profile and add the user to it via Device > Authentication Profile</P> <P> </P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="kiwi_1-1659601981844.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/42774iB7718610A3C5B0A8/image-size/large?v=v2&px=999" role="button" title="kiwi_1-1659601981844.png" alt="kiwi_1-1659601981844.png" /></span></P> <P> </P> <P>Next add an administrator account for the same user and use the local authentication profile via Device > Administrators</P> <P> </P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="kiwi_2-1659602321547.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/42775i9FF69606A8010A9D/image-size/large?v=v2&px=999" role="button" title="kiwi_2-1659602321547.png" alt="kiwi_2-1659602321547.png" /></span></P> <P> </P> <P>This way you can simply enable/disable the admin account by checking/unchecking the 'Enable' box on the Local User profile:</P> <P> </P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="kiwi_3-1659602391289.png" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/42776i88EB9957A138C4C8/image-size/large?v=v2&px=999" role="button" title="kiwi_3-1659602391289.png" alt="kiwi_3-1659602391289.png" /></span></P> <P> </P> <P>Note: If you just need a fallback authentication method then you'll need to look into an authentication sequence where you can put multiple authentication methods in sequence where the firewall tries the configured methods sequentially from top to bottom and will deny access if ALL of the methods fail.</P> </DIV> <DIV id="ConnectiveDocSignExtentionInstalled" data-extension-version="1.0.4"> </DIV> Thu, 18 Aug 2022 15:46:12 GMT kiwi 2022-08-18T15:46:12Z Nominated Discussion: Disable Local Account When NAC is Reachable https://live.paloaltonetworks.com/t5/general-articles/nominated-discussion-disable-local-account-when-nac-is-reachable/ta-p/512261 <P> </P> <DIV id="ConnectiveDocSignExtentionInstalled" data-extension-version="1.0.4"> </DIV> Thu, 18 Aug 2022 15:46:12 GMT https://live.paloaltonetworks.com/t5/general-articles/nominated-discussion-disable-local-account-when-nac-is-reachable/ta-p/512261 kiwi 2022-08-18T15:46:12Z