topic User-id issue. in General Topics

User-id issue.

GideonKonga — Thu, 26 Nov 2020 11:33:42 GMT

Hi All,

Firewall is 3050 with pan-os version 9.0.9-h1 we are using user-id agent as well as agentless for user-mapping.

Sometimes we are getting machine names instead for ip-address instead of source usernames.we have user-based security policy. Why do we get machine names for usernames in the user-id logs.

Agent version is 9.0.5-8

Thanks and regards,

Gideon Konga

Re: User-id issue.

reaper — Thu, 26 Nov 2020 14:12:47 GMT

do you have probing enabled and does the sevice account have all the appropriate WMI privileges?

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/user-id/map-ip-addresses-to-users/create-a-dedicated-service-account-for-the-user-id-agent.html

Re: User-id issue.

BPry — Fri, 27 Nov 2020 17:07:11 GMT

@GideonKonga,

Do you have certificate authentication for anything in your environment? If you absolutely don't want your user-id to ever pick up machine accounts simply add them into your ignore-user list; assuming you follow a naming convention you can just wildcard all of them and they won't be added into the user-id database.