topic Re: Help - Userid Responsiveness in General Topics

Help - Userid Responsiveness

jhickey — Mon, 23 Apr 2012 12:31:33 GMT

We're at the point where we want to apply URL Filtering policies based on userid. This means its very important that Pan-Agent is accurately identifying users. We did a test and added a user to a monitored group. The policy started working properly. We took him out and it took hours before the policy reverted properly.

We only have 1 PanAgent deployed on a member server. Can I make the identification more resposive by deploying more agents to multiple places ? To specific servers ? Domain Controllers ?

Any opinions on if this is a reliable enough process when tuned correctly ?

Any help would be appreciated.

Thanks,

Justin

Re: Help - Userid Responsiveness

shasnain — Tue, 01 May 2012 19:21:14 GMT

Hi,

The new UID agent is very good. You can have one UID agent pull information from mulitple domains as well. Generally you can use one UID agent and connect multiple Domain controllers to it and do user to ip mapping and it should be no problem for the agent.

If you feel that you need to install more than one UID agent for more resposive by deploying more agents to multiple places for specific servers and Domain Controllers you can do that as well.

Thanks,

Syed Hasnain

Re: Help - Userid Responsiveness

rmonvon — Thu, 03 May 2012 15:25:31 GMT

Hi...Is it well-known that Windows servers do not record logoff events reliably:

http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2management/thread/aaff36f4-f818-46be-b27a-3295e8944c05

As such, we only detect logon events. In your testing, you should try to logoff user1 and then login as user2. The PA device should pick up user2 immediately to accurately reflect the changing of the user.

As suggested, you should use the latest 4.1 UserID agent. The 4.1 UserID agent supports the monitoring of logon events on Exchange servers where most devices will have access to email via active-async. You can set active-sync to login frequently and the PA device will update accordingly.

You can also enable WMI probing on the UserID agent to monitor user status as well. Thanks.