topic Re: Palo Alto drops current local login when using RDP in General Topics

Palo Alto drops current local login when using RDP

mapfre — Mon, 03 Jun 2013 02:46:37 GMT

Hi!

We are currently using a PA500 appliance using User ID Agent on Windows Server 2008 R2.

My profile account (ex. super_user) is exempted to all which means I have no restrictions in accessing any websites.

Apparently, when I RDP our servers I have to login as our admin account (ex. adm_user). After my activity on our servers, I closed RDP and go back to my internet activities but apparently Palo Alto validates my login as adm_user and not super_user anymore.

Re: Palo Alto drops current local login when using RDP

gafrol — Mon, 03 Jun 2013 07:11:43 GMT

That's expected behavior with the current implementation of User-ID. If you logoff logon from your locl machine, User-ID will pick up your correct user name again.

Re: Palo Alto drops current local login when using RDP

mikand — Mon, 03 Jun 2013 09:11:27 GMT

A workaround is to add adm_user to the exclude list (that is use a dedicated account for RDP (that means you got two accounts - one to login with and the other to use for RDP)) in the PAN-agent. This way the PAN-agent will ignore adm_user when it login through RDP.