topic Re: User Agent picking up domain service account instead of end user in General Topics

User Agent picking up domain service account instead of end user

cityofmarietta — Fri, 28 Oct 2011 13:11:15 GMT

We are running a 2008 R2 domain and the user agent is in and working. However, it keeps showing one of our domain service accounts on many (not all) of the reports and monitoring instead of the actual user that is browsing. We run the same service account that is showing up in the reports for our KACE agent and Sophos agent. Not sure if this is what's causing the Palo to pick them up, but we need a way to see the actual end user and not the service account running (if this is indeed where it is coming from). Again, this does not happen for all PCs, but quite a large percentage. Any ideas on this?

Re: User Agent picking up domain service account instead of end user

gswcowboy — Fri, 28 Oct 2011 13:23:18 GMT

Create an ignore list and add the 'service' account so it does not overwrite the locally logged in user. Place the file in the pan-agent installation directory and then restart the pan-agent service.

"ignore_user_list.txt"

Example of names to place in the list:

ntadmin

administrator

Re: User Agent picking up domain service account instead of end user

cityofmarietta — Fri, 28 Oct 2011 13:27:37 GMT

I will try that, it sounds right. Is there any special syntax for what I put in the txt file or is just the fully qualified name with carriage return at the end required?

Re: User Agent picking up domain service account instead of end user

gswcowboy — Fri, 28 Oct 2011 13:31:15 GMT

Service account name would be sufficient. Feel free to update the thread if you're still having issues nonetheless.

Regards,

Renato

Re: User Agent picking up domain service account instead of end user

cityofmarietta — Fri, 28 Oct 2011 13:39:40 GMT

Got the file in and restarted the service. The Traffic Monitoring still shows the service account going by. Does it take a while to flush the service account name out of the Security Logs on the DC maybe?

Re: User Agent picking up domain service account instead of end user

gswcowboy — Fri, 28 Oct 2011 13:44:32 GMT

Does the pan-agent GUI still map the ip to the service account(via gui interface)? If not, try resetting the connection between the pan-agent and the pan device with the following command on the pan device:

> debug device-server reset pan-agent all

Re: User Agent picking up domain service account instead of end user

FSB — Thu, 04 Jul 2013 01:44:37 GMT

Thanks that worked for me!

nato wrote:

Create an ignore list and add the 'service' account so it does not overwrite the locally logged in user. Place the file in the pan-agent installation directory and then restart the pan-agent service.

"ignore_user_list.txt"

Example of names to place in the list:

ntadmin

administrator