topic Re: Device Administrators in General Topics

Device Administrators

rcraxton — Thu, 08 Feb 2024 14:35:12 GMT

Hello,

Can a "Device Administrator" unlock users in "Authentication Profile"? Don't want to give user "Super User" unless there is no other choice.

Thanks

Rich

Re: Device Administrators

Claw4609 — Thu, 08 Feb 2024 20:00:43 GMT

It looks like it should yes, but it also depending on your situation it may be better to create a custom admin role to restrict to only what is needed.

Device > Admin Roles (paloaltonetworks.com)

Configure an Admin Role Profile (paloaltonetworks.com)

Re: Device Administrators

rcraxton — Thu, 08 Feb 2024 20:07:49 GMT

I started with a custom admin role - same issue, couldn't unlock users. Thus went to device administrator. Same problem. Currently on Pan OS 10.2.6.

Re: Device Administrators

Claw4609 — Thu, 08 Feb 2024 20:36:27 GMT

Do you see the locked users with a device administrator role? It looks like on my Pan-os 10.2.6 I can select users locked under an authentication profile with a device administrator role. Are you doing this through the GUI or CLI?

Re: Device Administrators

rcraxton — Thu, 08 Feb 2024 20:41:01 GMT

The user can see the locked users but there is no "Unlock" beside the name like when a superuser. This is being done via GUI, I don't want user down in CLI.

Re: Device Administrators

Claw4609 — Thu, 08 Feb 2024 20:54:31 GMT

Oh that you're right, I wasnt paying close enough attention. At least according to this older article you do in fact need superuser. Solved: LIVEcommunity - SAML login remove lock (superuser?) - LIVEcommunity - 528930 (paloaltonetworks.com)

Re: Device Administrators

rcraxton — Thu, 08 Feb 2024 20:59:24 GMT

Didn't want to make user a "SuperUser" but appears I don't have any choice.