topic Incorrect User-ID in General Topics

Incorrect User-ID

Farzana — Tue, 10 Oct 2017 23:39:08 GMT

Hello,

We are using User-ID Agent.

A number of Source Users are reported as “sophosupdate”. It is not picking up the correct user.

The expected behaviour would be for the end user name (example of m.hayes in the list below).

How to correct this?

Thanks in advance.

Re: Incorrect User-ID

hpunjabi — Wed, 11 Oct 2017 02:28:59 GMT

Hi Farzana,

You can try the below link to ignore service accounts:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Ignore-Users-in-User-ID-Agent/ta-p/59136

Usually it should work with bcc\sophosupdate in the list, if it does not works then enter both the formats sophosupdate and bcc\sophosupdate.

Re: Incorrect User-ID

Farzana — Wed, 11 Oct 2017 22:59:39 GMT

Thanks for the suggestion. Tried that but not working.

Hayes one of our members was logged into a Windows 7 desktop with the IP of 10.1.x.y. At the start of the session (initial login) it changed withing 20 minutes and Hayes could not longer browse the internet. I checked the Palo Alto User Agent on BCC-DC02 and found that it was now registering the SophosUpdate account against the 10.1.x.y address.

I cannot find in the PA the user group that bcc\sophosupdate user belongs to.

> show user user-ids match-user bcc\sophosupdate

User Name Vsys Groups

------------------------------------------------------------------

Total: 829

* : Custom Group

> show user user-id-agent config name BCC-DC02

Has nothing in the Ignore List.

Re: Incorrect User-ID

hpunjabi — Thu, 12 Oct 2017 05:01:32 GMT

Hi Farzana,

Try below command ignoring the domain.

show user user-ids match-user sophosupdate

and see if you can see any mapping.

For ignore user list the filename should be exactly ignore_user_list.txt.

Common issue which happens is the file usually gets created with ignore_user_list.txt.txt,

Untick below:

Under Tools>Folder Options > Hide extensions for known file types

Remove the extra .txt if it exists.

Re: Incorrect User-ID

bmorris1 — Thu, 12 Oct 2017 11:32:24 GMT

Also make sure to restart the User-ID service once you've implemented the ignore user list so it picks up and reads the list.

Re: Incorrect User-ID

Farzana — Fri, 13 Oct 2017 02:30:21 GMT

Thank you!

We added the “ignore” list at the User ID agent and not the FW GUI.

Also cleared the user-id, and user-id-mp caches and restarted the Agent.

Issue is resolved.