topic Re: User-ID Agent 8.1 help needed in General Topics

User-ID Agent 8.1 help needed

dannon — Mon, 16 Apr 2018 17:34:23 GMT

Hello.

AD integration using the User-ID agent. We were on 8.0.7-2 and things were working fine.

I tried upgrading to version 8.1.0-66 and had several problems with wrong user-id being reported. I saw in the release notes for 8.1:

• Since multiple username attributes are supported, you must select the Primary
Username attribute that you want to use for user identification.
• Previously, the firewall normalized usernames received from User-ID sources (such
as an LDAP directory) to the domain\username format. In PAN-OS® 8.1, when the
Primary Username is in UPN format, it will not be normalized as in previous PAN-OS
versions. As a result, usernames

My question is if I use the new agent, how can I get my username to show up as

domain\userid

again?

When I tried 8.1.0-66 I was seeing usernames as

domain@username

and

MACHINENAME$

All my rules broke.

To correct quickly, I reverted back to the older user-id version.

Thanks,

Dannon

Re: User-ID Agent 8.1 help needed

BPry — Mon, 16 Apr 2018 20:05:11 GMT

@dannon,

A new feature was included in PAN-OS 8.1 that allows the administrator to set the Primary Username so that it switches back to domain\username instead of UPN. You can find more information HERE

Re: User-ID Agent 8.1 help needed

dannon — Mon, 16 Apr 2018 21:09:33 GMT

Here is what I have setup right now. I've see that article before. What I am wondering is what to set things now in order to get things normalized like they were before.

Re: User-ID Agent 8.1 help needed

mdk1380 — Tue, 24 Apr 2018 11:21:21 GMT

We have the exact same configuration and issue so would welcome some feedback from dev's or users.

Re: User-ID Agent 8.1 help needed

Remo — Thu, 10 May 2018 17:46:55 GMT

Just in case you don't know this already ( @dannon, @mdk1380😞 this problem with the computernames was a bug (WINAGENT-269) which is resolved in User-ID Agent 8.1.1.

Re: User-ID Agent 8.1 help needed

egarantiva — Fri, 18 Jun 2021 13:42:34 GMT

Hello

I have the same Issue, the Windows User-id Agent 9.1-2 shows some mapped users in format "domain\user" and some in "user@emaildomain" , and even shows localmachine users mapped too. Is there a way to force the user format normalization like previous to 8.1 User-id versions do ?