topic Re: User-ID agent 4.1.0 service logon account permissions. in General Topics

User-ID agent 4.1.0 service logon account permissions.

ST1985 — Wed, 09 Nov 2011 18:49:20 GMT

User-ID agent 3.1.0 ran quite happily on our Domain Controller under a regular domain user account (no group membership apart from the default Domain Users, and I guess "Ran as service" was granted automatically during the installation).

The new version of User-ID agent refuses to start the service under that account. No events are loged in Windows Event Log, and none in the UaDebug.txt file either.

Once I granted the service account full access to the "C:\Program Files (x86)\Palo Alto Networks\User-ID Agent" I could se the following errors in the UaDebug file:

11/08/11 23:31:07:575[ Info 1634]: ------------Service is being started------------
11/08/11 23:31:07:575[ Info 1641]: Os version is 6.0.2.
11/08/11 23:31:07:575[Error 510]: Cannot open config reg log key: 5!
11/08/11 23:31:07:575[Error 1659]: Start error -1!!
11/08/11 23:31:07:575[Error 361]: Device listening thread stops timeout!
11/08/11 23:31:07:575[ Info 253]: Log thread stops.
11/08/11 23:31:07:575[ Info 256]: pool(svc pool): thread 5200 exiting
11/08/11 23:31:07:575[ Info 256]: pool(svc pool): thread 3472 exiting
11/08/11 23:31:07:591[ Info 256]: pool(svc pool): thread 5848 exiting
11/08/11 23:31:07:591[ Info 256]: pool(svc pool): thread 5084 exiting
11/08/11 23:31:07:591[ Info 1505]: Service stopped.
11/08/11 23:33:04:279[ Info 1634]: ------------Service is being started------------

The service itself still refuses to start.

My temporary workaround was to add the service account to the Domain Administrators group, but I am not happy with that solution and would like to eventually move the account out of that group (apart from running WMI queries really I see no need for such a high permission level for a service account in this case).

Please advise what other permissions the service account must be granted in order to run successfully.

Cheers,

Arthur

Re: User-ID agent 4.1.0 service logon account permissions.

gswcowboy — Wed, 09 Nov 2011 19:59:03 GMT

Hi Arthur,

I resolved the service account issue (not starting) by adding it to the local administrator group where the UID agent resides.

Re: User-ID agent 4.1.0 service logon account permissions.

ST1985 — Wed, 09 Nov 2011 20:12:46 GMT

In our case the agent is running on a Domain Controller, which does not have a Local Administrators group by design.

Re: User-ID agent 4.1.0 service logon account permissions.

gswcowboy — Thu, 10 Nov 2011 01:45:23 GMT

Will speak to Development regarding this issue. I will provide feedback upon receipt of their response.

Re: User-ID agent 4.1.0 service logon account permissions.

agi — Wed, 16 Nov 2011 21:31:43 GMT

I found the same to be true (needed to add to local administrators group). I am hoping to hear this can be relaxed (maybe just some directory permission changes?).

-David

Re: User-ID agent 4.1.0 service logon account permissions.

essnet — Thu, 08 Dec 2011 07:25:34 GMT

I found that problem also in latest version of agent: UaInstall-4.1.1-7.msi

Thank you

Re: User-ID agent 4.1.0 service logon account permissions.

npiagentini — Mon, 19 Dec 2011 17:13:54 GMT

You should be able to get around the issue by giving the agent account rights to the HKEY_LOCAL_MACHINE\Software\Palo Alto Networks sub tree on the systems registry....

Re: User-ID agent 4.1.0 service logon account permissions.

mattwestby — Tue, 14 Feb 2012 12:41:04 GMT

Had a similar issue and found that the regkey on a 64bit server gets put under HKLM\SOFTWARE\Wow6432Node\Palo Alto Networks

So, rather than making local Administrator, give the service account permissions on the regkey as instructed in the "4.1 User-ID Agent install guide".

Matt