UserID Reporting Computer Names

Reply
L4 Transporter

UserID Reporting Computer Names

Quick question.

 

We are having some issues where a users' computer name i.e. acme\pc01$ is being reported by UserID rather than the user i.e. acme\jbloggs.

 

Anyone seen this before and\or advice what it could be?

 

We have a horendously complicated UserI setup so not going to go into detail, but suffice to say that I'm sure that's part of it!

 

Thanks

Tags (1)
L7 Applicator

Re: UserID Reporting Computer Names

Do you use certificates to authenticate to GlobalProtect for example?

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE (3.0, 5.0, 6.0, 7.0), PCNSE (6, 7), PCNSI
L4 Transporter

Re: UserID Reporting Computer Names

We do, but these entires seem to be coming directly from a UserID agent service as we can see them in the monitoring logs.

L7 Applicator

Re: UserID Reporting Computer Names

@apackard, can you see the device names in the user-id agent monitoring.

 

I'm using agent 8.0.5-7 and am not seeing any device names at all.

 

I do know that the device name and ip address are within the AD security log but no idea why the panagent would be using this.

L7 Applicator

Re: UserID Reporting Computer Names

also.. this is the 3rd time this issue has been logged here within a couple of weeks so something strange is going on...

L4 Transporter

Re: UserID Reporting Computer Names

Thanks, yes, they are showing up in the monitoring logs.

 

I'm going to try downgrading our agents to see if it is something to do with that.

 

Rgds

L7 Applicator

Re: UserID Reporting Computer Names

what version are you currently running?

L4 Transporter

Re: UserID Reporting Computer Names

I was running 8.1.0-x, but have dropped back to 8.0.8-2 and that seems to have fixed the issue.

L3 Networker

Re: UserID Reporting Computer Names

I saw this also.  I upgraded to User-Agent 8.1.0 and started seeing strange things.

 

Release notes said Palo changed default naming convention and that it won't display it as domain\username anymore.

 

I was seeing lots of user@domain.name and a lot of machinename$ listings. I didn't know how to fix.

 

I got burned and rolled back to prior version.  Issues went away.

 

FWIW

Dannon

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!