topic Can I not to install user identification agent to the domain controller? in General Topics https://live.paloaltonetworks.com/t5/general-topics/can-i-not-to-install-user-identification-agent-to-the-domain/m-p/12763#M9350 <HTML><HEAD></HEAD><BODY><P>The client would like to use their Active-Directory for user identification in PAN.</P><P>However, they are not prefer to install the agent in their domain controller.</P><P></P><P>Is it possible to install the agent in a computer which has already joined the domain, but not on the domain controller?</P><P>If so, what rights the user account/computer should have?</P><P>Please also provide me the implementation steps.</P><P></P><P>Thanks in advance!!</P><P></P><P>Best Regards,</P><P>Frank</P></BODY></HTML> Fri, 22 Jul 2011 07:31:18 GMT frankchow 2011-07-22T07:31:18Z Can I not to install user identification agent to the domain controller? https://live.paloaltonetworks.com/t5/general-topics/can-i-not-to-install-user-identification-agent-to-the-domain/m-p/12763#M9350 <HTML><HEAD></HEAD><BODY><P>The client would like to use their Active-Directory for user identification in PAN.</P><P>However, they are not prefer to install the agent in their domain controller.</P><P></P><P>Is it possible to install the agent in a computer which has already joined the domain, but not on the domain controller?</P><P>If so, what rights the user account/computer should have?</P><P>Please also provide me the implementation steps.</P><P></P><P>Thanks in advance!!</P><P></P><P>Best Regards,</P><P>Frank</P></BODY></HTML> Fri, 22 Jul 2011 07:31:18 GMT https://live.paloaltonetworks.com/t5/general-topics/can-i-not-to-install-user-identification-agent-to-the-domain/m-p/12763#M9350 frankchow 2011-07-22T07:31:18Z Re: Can I not to install user identification agent to the domain controller? https://live.paloaltonetworks.com/t5/general-topics/can-i-not-to-install-user-identification-agent-to-the-domain/m-p/12764#M9351 <HTML><HEAD></HEAD><BODY><P>Yes it is completely possible,</P><P>I believe a guide is <A href="https://live.paloaltonetworks.com/docs/DOC-1166">https://live.paloaltonetworks.com/docs/DOC-1166</A></P><P></P><P>In a nut shell the account you set to run the agent service must have read / audit rights on your security logs on your DC (but no other elevated rights)</P></BODY></HTML> Fri, 22 Jul 2011 08:20:19 GMT https://live.paloaltonetworks.com/t5/general-topics/can-i-not-to-install-user-identification-agent-to-the-domain/m-p/12764#M9351 JohnP 2011-07-22T08:20:19Z