https://live.paloaltonetworks.com/t5/general-topics/windows-based-user-id-agent-for-user-mapping-issue/m-p/513452#M106651 <P>We are using&nbsp;Windows-Based User-ID Agent for User Mapping. But For last few days, for some users Paloalto FW shows U-ID mapping as below instead of actual username. If anyone can explain this behavior it would be appreciated.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="3ce0226582b332e5cd9121636128484c_0-1661948046541.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/43457iBD4A34FEE3B1911F/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="3ce0226582b332e5cd9121636128484c_0-1661948046541.png" alt="3ce0226582b332e5cd9121636128484c_0-1661948046541.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Wed, 31 Aug 2022 12:21:49 GMT Bijesh 2022-08-31T12:21:49Z https://live.paloaltonetworks.com/t5/general-topics/windows-based-user-id-agent-for-user-mapping-issue/m-p/513452#M106651 <P>We are using&nbsp;Windows-Based User-ID Agent for User Mapping. But For last few days, for some users Paloalto FW shows U-ID mapping as below instead of actual username. If anyone can explain this behavior it would be appreciated.</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="3ce0226582b332e5cd9121636128484c_0-1661948046541.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/43457iBD4A34FEE3B1911F/image-size/medium/is-moderation-mode/true?v=v2&amp;px=400" role="button" title="3ce0226582b332e5cd9121636128484c_0-1661948046541.png" alt="3ce0226582b332e5cd9121636128484c_0-1661948046541.png" /></span></P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Wed, 31 Aug 2022 12:21:49 GMT https://live.paloaltonetworks.com/t5/general-topics/windows-based-user-id-agent-for-user-mapping-issue/m-p/513452#M106651 Bijesh 2022-08-31T12:21:49Z https://live.paloaltonetworks.com/t5/general-topics/windows-based-user-id-agent-for-user-mapping-issue/m-p/513459#M106653 <P>Usernames ending in $ look like computer accounts.<BR /><BR /></P> <P>Check this KB article:</P> <P><A href="https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oN0iCAE" target="_blank">https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oN0iCAE</A></P> <P><BR />The article seems to indicate that it is not unusual for computer accounts to generate a logon message. It states that the computer logon messages will be logged (like what you're seeing), but will not generate an actual user-to-IP mapping.&nbsp;<BR />This behavior could probably be verified from CLI:<BR />show user ip-user-mapping all</P> Wed, 31 Aug 2022 13:09:56 GMT https://live.paloaltonetworks.com/t5/general-topics/windows-based-user-id-agent-for-user-mapping-issue/m-p/513459#M106653 IanH1 2022-08-31T13:09:56Z