topic Does "pre-logon" user belongs to "known" user? in General Topics

Does "pre-logon" user belongs to "known" user?

Rboehme — Wed, 19 Dec 2018 14:05:17 GMT

Dear Comm,

I was googleing alot about this topic and but only found this:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXlCAK

My specific question is, if a the User ID agent show the username "pre-logon" learned via "GP" - does this "user" counts to the "gruoup" of "known"-user which I can use in security policies?

Thanks for your support.

Kind regards,

Rene

Re: Does "pre-logon" user belongs to "known" user?

Brandon_Wertz — Wed, 19 Dec 2018 19:34:55 GMT

While my response doesn't come with an authoritative 100% assurance, I would suspect the answer to your question is "it does not."

Pre-Logon is a function of Global Protect where the user on the machine is currently unknown. "Known-user" comes from various authentication sources UIA/GP/CP/SSO (NTLM). I can't imagine you'd have that many security rules which would be attributed to a "pre-logon" identified user.