Service Account used for UserID Agent

MasoodBrv — Tue, 03 Jun 2025 00:23:37 GMT

Hi Support Team, We need to ensure the service accounts used for the UserID agents installed on the domain controllers have the right active directory permissions and limit the permissions to what is required for them to function. I have the following question: 1. What are the required permissions and privileges for it to be functional? 2. What are the risks of misconfiguration or disabling this account?

Re: Service Account used for UserID Agent

OtakarKlier — Tue, 03 Jun 2025 19:51:21 GMT

Hello,

I would first direct you to read the best practices: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVPCA0

To answer your questions:

1. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/map-ip-addresses-to-users/create-a-dedicated-service-account-for-the-user-id-agent

2. if you disable the account and have policies that utilize User-ID as a requirement, then this will cause traffic to those policies to not be matched and the traffic would not be allowed.

Hope that helps.

topic Service Account used for UserID Agent in Next-Generation Firewall Discussions

Service Account used for UserID Agent

Re: Service Account used for UserID Agent