topic Does "pre-logon" user belongs to "known" user? in General Topics

Does "pre-logon" user belongs to "known" user?

Rboehme — Wed, 19 Dec 2018 14:05:17 GMT

Dear Comm,

I was googleing alot about this topic and but only found this:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXlCAK

My specific question is, if a the User ID agent show the username "pre-logon" learned via "GP" - does this "user" counts to the "gruoup" of "known"-user which I can use in security policies?

Thanks for your support.

Kind regards,

Rene

Re: Does "pre-logon" user belongs to "known" user?

Brandon_Wertz — Wed, 19 Dec 2018 19:34:55 GMT

While my response doesn't come with an authoritative 100% assurance, I would suspect the answer to your question is "it does not."

Pre-Logon is a function of Global Protect where the user on the machine is currently unknown. "Known-user" comes from various authentication sources UIA/GP/CP/SSO (NTLM). I can't imagine you'd have that many security rules which would be attributed to a "pre-logon" identified user.

Re: Does "pre-logon" user belongs to "known" user?

Rievax — Fri, 15 May 2026 19:27:42 GMT

Hi.
Never to late to update or clarify an old question..
According to this KB Is pre-logon user part of the known-user? - Knowledge Base - Palo Alto Networks...
YES - ["known-user"] also includes "pre-logon" user as we already have the IP to User association for the "pre-logon" user. Hence, they are part of the known user.