topic Find disabled administrator accounts in General Topics

Find disabled administrator accounts

RobertShawver — Tue, 15 Jun 2021 19:51:04 GMT

Across a large environment, what would be the best way to audit Palo administrator accounts? That is accounts found at Device > Administrators.

For various reasons we all end up with lots of AD accounts, service accounts and so on there, what I'd like to do is find a way to periodically check those accounts against AD to see if they are still valid.

So far the only way that I have found is to export the csv and run a powershell script against the names which pipes out to a simple "true or false". Problem with that is that I have to run it across a ton of Palo's one by one.

There has to be a better way. Even if it's a script that will run against all my palos to get the names first.

Re: Find disabled administrator accounts

BPry — Tue, 15 Jun 2021 21:19:14 GMT

@RobertShawver,

So with your existing script I would just tie in calls to the firewall's API to grab any administrator on the system, instead of doing a CSV export. The API URL would be /api/?type=config&action=get&xpath=/config/mgmt-config/users

Re: Find disabled administrator accounts

RobertShawver — Thu, 17 Jun 2021 16:28:47 GMT

Is there a way to show the Administrators on a template via command line?