topic User-ID mapping for users logged in to a domain controller in General Topics

User-ID mapping for users logged in to a domain controller

Leo_Huang — Wed, 03 Mar 2021 02:07:36 GMT

Hi Guys,

Does anyone know or have experience on configuring User-ID agent to perform user mappings for users who are currently logged in to a domain controller.

The issue I am facing is that anyone logs into a domain controller is not being pickup by User-ID agent, so there is no user mapping for any of our domain controllers. All other servers on the same subnet as the DC are fine, no issues.

Any ideas?

Thanks

Leo

Re: User-ID mapping for users logged in to a domain controller

Mick_Ball — Wed, 03 Mar 2021 06:55:12 GMT

Hi @Leo_Huang , From what I can remember... this is because DC local logins are not registered in the security logs. I can’t remember what we did so will have a dig.

Re: User-ID mapping for users logged in to a domain controller

nikoolayy1 — Mon, 22 Mar 2021 18:30:01 GMT

The normal server Monitoring should do the trick. Do you see the user login events in the Domain server logs, if not then it is a Windows issue. If they are present you will need to check many things like if the Palo Alto has the right credentials if login attemps are seen on the DC from the Palo Alto, does the zone has User id mapping allowed, do the DC allow a non Windows device like palo alto to connect or an external UserId agent is needed, maybe do pcap captures and check the Palo Alto authd log and so on:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5bCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClR1CAK