Does "pre-logon" user belongs to "known" user?

[Rboehme]

Dear Comm,

I was googleing alot about this topic and but only found this:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXlCAK

My specific question is, if a the User ID agent show the username "pre-logon" learned via "GP" - does this "user" counts to the "gruoup" of "known"-user which I can use in security policies?

Thanks for your support.

Kind regards,

Rene

[Brandon_Wertz]

While my response doesn't come with an authoritative 100% assurance, I would suspect the answer to your question is "it does not."

Pre-Logon is a function of Global Protect where the user on the machine is currently unknown.  "Known-user" comes from various authentication sources UIA/GP/CP/SSO (NTLM).  I can't imagine you'd have that many security rules which would be attributed to a "pre-logon" identified user.