UserID Reporting Computer Names

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

UserID Reporting Computer Names

L4 Transporter

Quick question.

 

We are having some issues where a users' computer name i.e. acme\pc01$ is being reported by UserID rather than the user i.e. acme\jbloggs.

 

Anyone seen this before and\or advice what it could be?

 

We have a horendously complicated UserI setup so not going to go into detail, but suffice to say that I'm sure that's part of it!

 

Thanks

8 REPLIES 8

Cyber Elite
Cyber Elite

Do you use certificates to authenticate to GlobalProtect for example?

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

We do, but these entires seem to be coming directly from a UserID agent service as we can see them in the monitoring logs.

@apackard, can you see the device names in the user-id agent monitoring.

 

I'm using agent 8.0.5-7 and am not seeing any device names at all.

 

I do know that the device name and ip address are within the AD security log but no idea why the panagent would be using this.

L7 Applicator

also.. this is the 3rd time this issue has been logged here within a couple of weeks so something strange is going on...

Thanks, yes, they are showing up in the monitoring logs.

 

I'm going to try downgrading our agents to see if it is something to do with that.

 

Rgds

what version are you currently running?

I was running 8.1.0-x, but have dropped back to 8.0.8-2 and that seems to have fixed the issue.

I saw this also.  I upgraded to User-Agent 8.1.0 and started seeing strange things.

 

Release notes said Palo changed default naming convention and that it won't display it as domain\username anymore.

 

I was seeing lots of user@domain.name and a lot of machinename$ listings. I didn't know how to fix.

 

I got burned and rolled back to prior version.  Issues went away.

 

FWIW

Dannon

 

  • 4906 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!