topic Re: User Identification Agent in General Topics

User Identification Agent

patrickproy — Fri, 05 Mar 2010 11:19:44 GMT

I have forget to start/restart service, before configure so I have this message : "Please start the PanAgent service first" in status agent.

When I click on "start", this message display:

Impossible de démarrer le service PanAgent Service sur Ordinateur local.

Erreur 1069: l'échec d'une ouverture de session a empêché le démarrage du service

What can I do ?

I can delete informations on "configure agent".

Please help me

Re: User Identification Agent

swhyte — Fri, 05 Mar 2010 21:57:51 GMT

Hello Patrick,

Please verify that the user that you used to log onto the machine that the user identification agent is installed on, has adequate privelleges to run the pan agent service. Try logging on to the machine as local admin.

Re: User Identification Agent

fw_admin — Tue, 16 Mar 2010 14:02:09 GMT

Hi,

We've had this problem too. We've been able to fix it, by means of administrator rights in the machine for the user who executes the PanAgenController.exe and besides we execute this programs with "run as administrator". This has been the only way to solve it.

Nevertheless, we're still seeing a strange message in the Show Information Window, the Agent Status says "Cannot open security log" sometimes.

Regards,

Re: User Identification Agent

swhyte — Thu, 18 Mar 2010 16:09:11 GMT

If your pan agent is configured to read the security logs of multiple domain controllers and the user that you are using for the pan agent service does not have adequate priveledges to read the security log of one or more of the domain controllers, then you will still get that "cannot open security log" error.

Re: User Identification Agent

harish — Thu, 02 Sep 2010 18:58:14 GMT

Configure your PanAgentService to "Log on as:" domain\administrator account and restart the service.

Re: User Identification Agent

jickfoo — Tue, 01 Mar 2011 15:32:34 GMT

I have this same issue but dont want to put domain admin accounts in services. Anyone know what permissions I can add to the account short of making them domain admin ?

Re: User Identification Agent

bpappas — Tue, 01 Mar 2011 15:39:09 GMT

Your Pan Agent service will need to be able to "manage" and "audit" the security event log on the DCs to pick up the logon events from the security event logs.

-Benjamin

Re: User Identification Agent

jickfoo — Wed, 02 Mar 2011 14:34:13 GMT

Any documentation on how to do this in Active Directory ? Is there a prebuilt domain role that would provide this functionality ? Server Operators anything like that ?

Thanks.

Re: User Identification Agent

mderksen — Wed, 02 Mar 2011 14:43:43 GMT

Have you seen this one:

https://live.paloaltonetworks.com/docs/DOC-1166

Marcel

Re: User Identification Agent

jickfoo — Wed, 02 Mar 2011 14:47:47 GMT

no I hadn't, thats perfect, thank you