topic Re: PAN-Agent and Mac OS X Clients in General Topics

PAN-Agent and Mac OS X Clients

mharding — Tue, 18 Jan 2011 17:39:45 GMT

Has anyone had sucess in the PAN-Agent capturing logins for Mac OS X clients joined to Active Directory?

We have about 100 iMacs running Mac OS 10.6.5, and I always get a "_unknown_" username when looking at their IP address in the PAN-Agent. We have a Server 2008 R2 domain controller.

Re: PAN-Agent and Mac OS X Clients

bpappas — Tue, 18 Jan 2011 18:13:22 GMT

Question:

do the Mac users ever show up with correct user-IP mappings?

Re: PAN-Agent and Mac OS X Clients

mharding — Tue, 18 Jan 2011 19:12:30 GMT

No.

It worked at one time before we made the move to Snow Leopard.

Three things have haven't since it quit working:

- We made the move from Tiger (10.4.11) to Snow Leopard (10.6.5.)

- The PAN-Agent was upgraded from v2 to v3.

- We moved from a Server 2003 to Server 2008 Active Directory infrastructure.

Re: PAN-Agent and Mac OS X Clients

bpappas — Tue, 18 Jan 2011 19:15:51 GMT

Based upon the number of changes you have made to the environment I would suggest that you may want to open a support case so that our team can quickly get to the bottom of the problem.

Re: PAN-Agent and Mac OS X Clients

mharding — Tue, 18 Jan 2011 19:17:10 GMT

Already done so. Just not getting anywhere.

Wondered if anyone else had it working.

Re: PAN-Agent and Mac OS X Clients

Laforgepaul — Wed, 19 Jan 2011 17:03:47 GMT

This is working for us, Mac osx users are configured to use AD for login. Our pan agents do identifes them correctly.

We have had issues and had to redo the ad configs on the mac.

Re: PAN-Agent and Mac OS X Clients

mharding — Wed, 19 Jan 2011 17:13:12 GMT

Can you give me a brief idea of what configs you have? I'm completely at a loss here on how to get it to work.

Re: PAN-Agent and Mac OS X Clients

mharding — Fri, 21 Jan 2011 14:54:08 GMT

We found the answer a few days ago. Sucessful account logons weren't being auditied. Since Mac OS 10.4 could use NetBios, my guess is that the PAN-Agent was able to probe the 10.4 clients for logins.

Everything is working great since we made the change to the default domain controller audit policies.

Re: PAN-Agent and Mac OS X Clients

lester_tt — Fri, 28 Jan 2011 16:00:18 GMT

What changes?

Re: PAN-Agent and Mac OS X Clients

mharding — Fri, 28 Jan 2011 19:41:32 GMT

We modified the Default Domain Controller policy to enable successful logon of accounts.

Re: PAN-Agent and Mac OS X Clients

rvillega — Mon, 05 Sep 2011 04:12:07 GMT

can you please elobarate how did you redo your ad configs on mac. thanks.

Re: PAN-Agent and Mac OS X Clients

r.turner — Fri, 20 Jan 2023 03:34:01 GMT

Did you find a working solution?