topic Re: USER-ID - Windows Server 2016 - Event Log Viever permission issue in General Topics

USER-ID - Windows Server 2016 - Event Log Viever permission issue

junior_r — Tue, 03 Jul 2018 20:43:20 GMT

I cannot read AD logs on Windows Server 2016 with the event viewer read group access. Is there anything special that needs to be on Windows 2016 Domain?

Thanks

Re: USER-ID - Windows Server 2016 - Event Log Viever permission issue

BPry — Wed, 04 Jul 2018 00:51:30 GMT

@junior_r,

There are a number of limitations with getting this to function that primarly deal with what PAN-OS version you are running. Can you list what firmware you are running and the user-id agent version if applicable.

Re: USER-ID - Windows Server 2016 - Event Log Viever permission issue

junior_r — Wed, 04 Jul 2018 12:58:29 GMT

@BPry

PAN-OS 8.1.2

Latest USER-ID agent installed on WIndows Server 2016

DC is running Windows server 2016

Re: USER-ID - Windows Server 2016 - Event Log Viever permission issue

junior_r — Thu, 05 Jul 2018 13:05:11 GMT

anyone?

Thanks

Re: USER-ID - Windows Server 2016 - Event Log Viever permission issue

BPry — Thu, 05 Jul 2018 14:10:28 GMT

@junior_r,

Did you go back through and give the SA that you setup permissions to the installation folder so that it can actually interact with the user-id agent? That's about the only thing that I can think of, the USER-ID agent permissions are relatively straight forward in the fact that you only need the Event Log Reader permissions unless you use the integrated user-id agent in the firewall.