topic Re: User-ID Agent, uninstall slows down network logons in General Topics

User-ID Agent, uninstall slows down network logons

tandersen — Thu, 08 Oct 2020 12:27:45 GMT

Hello,

I am not a Network Engineer but am trying to assist the folks running the network at my company. I am in charge of Active Directory. The Network Engineers recently uninstalled the Palo Alto User-ID from two of my Domain Controllers. Since then, we have seen network slow downs randomly, for certain Netlogon connections between Domain Controllers. I have also requested them to re-install the software. It is apparently re-installed, yet I clearly see no users in the logs as having been discovered so I can only believe that something is still not quite right with the setup. Does anyone have anything they can recommend I do next? I am at my wits end and truly believe that somehow the Palo Alto User-ID service was somehow helping to keep our logons working correctly, but the network team is swamped with other work as well. Thanks!

Re: User-ID Agent, uninstall slows down network logons

BPry — Fri, 09 Oct 2020 01:40:38 GMT

@tandersen,

Ya, that's not how it works. The user-id agent simply reads the event logs, it doesn't listen to the network traffic or anything like that. Uninstalling the agent or re-installing the agent absolutely should have no effect on the speed of your Domain Controllers or Netlogon connections.

Re: User-ID Agent, uninstall slows down network logons

tandersen — Fri, 09 Oct 2020 11:34:02 GMT

If what you say is true... why would we start seeing these messages inundating our event logs on the DCs after uninstalling the User-ID Agent? It can't just be a coincidence. Somehow there must be a correlation?

Netlogon has failed an authentication request of account *** domain ***. The request timed out before it could be sent to domain controller **** in domain ***. This is the first failure. If the problem continues, consolidated events will be logged about every 30 minutes. Please see http://support.microsoft.com/kb/2654097 for more information.