problem with userIDAgent in RDP

BigPalo — Thu, 21 Oct 2021 15:14:56 GMT

hello

We have a problem with users when they connect in RDP

We found a solution whit this KB:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleBCAS

but we have new questions:

1.- Is there a way to know what information the userIDAgent gets from the AD?

2.- Is there any way to limit the type of events it reads (as far as I understand, in Fortinet's User-ID agent (FSSO) this type of configuration is possible)?

Thanks

Kind regads

Re: problem with userIDAgent in RDP

reaper — Thu, 21 Oct 2021 21:18:24 GMT

the userID agent reads the event log on the active directory and picks up logon and auth-success messages, to collect username + ip address info

you can add a ignore_user_list.txt file in the uid agent folder and add usernames (one per line) the agent needs to ignore (typically service accounts and admins)

topic Re: problem with userIDAgent in RDP in General Topics

problem with userIDAgent in RDP

Re: problem with userIDAgent in RDP