topic Re: UserID Reporting Computer Names in General Topics

UserID Reporting Computer Names

apackard — Wed, 28 Mar 2018 19:47:16 GMT

Quick question.

We are having some issues where a users' computer name i.e. acme\pc01$ is being reported by UserID rather than the user i.e. acme\jbloggs.

Anyone seen this before and\or advice what it could be?

We have a horendously complicated UserI setup so not going to go into detail, but suffice to say that I'm sure that's part of it!

Thanks

Raido_Rattameister — Wed, 28 Mar 2018 21:14:07 GMT

Do you use certificates to authenticate to GlobalProtect for example?

apackard — Wed, 28 Mar 2018 23:14:42 GMT

We do, but these entires seem to be coming directly from a UserID agent service as we can see them in the monitoring logs.

Mick_Ball — Thu, 29 Mar 2018 09:01:14 GMT

@apackard, can you see the device names in the user-id agent monitoring.

I'm using agent 8.0.5-7 and am not seeing any device names at all.

I do know that the device name and ip address are within the AD security log but no idea why the panagent would be using this.

Mick_Ball — Thu, 29 Mar 2018 09:17:22 GMT

also.. this is the 3rd time this issue has been logged here within a couple of weeks so something strange is going on...

apackard — Thu, 29 Mar 2018 09:32:11 GMT

Thanks, yes, they are showing up in the monitoring logs.

I'm going to try downgrading our agents to see if it is something to do with that.

Rgds

Mick_Ball — Thu, 29 Mar 2018 09:33:22 GMT

what version are you currently running?

apackard — Tue, 03 Apr 2018 11:18:49 GMT

I was running 8.1.0-x, but have dropped back to 8.0.8-2 and that seems to have fixed the issue.

dannon — Wed, 04 Apr 2018 19:19:21 GMT

I saw this also. I upgraded to User-Agent 8.1.0 and started seeing strange things.

Release notes said Palo changed default naming convention and that it won't display it as domain\username anymore.

I was seeing lots of user@domain.name and a lot of machinename$ listings. I didn't know how to fix.

I got burned and rolled back to prior version. Issues went away.

FWIW

Dannon