Cortex XDR Endpoints not showing logged User

[orbcom_tecnicos]

Hi!

On our Cortex XDR tenant some computers are not displaying the User that is connect to the endpoint, performing a heart beat doesn't poppulate that field either, how can we make it so the User "domain\user" appears on the All Endpoints list?

Best Regard

[aspatil]

Hello @orbcom_tecnicos  ,

Thanks for reaching out on LiveCommunity!

Please note that, in All Endpoints under this field you will see username of the user, if user is logged into the endpoint. If in case user is not logged in on the endpoint the entry in User field will be blank. https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/user-details-in-xdr/td-p/548483 Please have a look on those machines, whether they are connected or not as filter has disconnected machines as well. Take few machines and see whether it is Server or any endpoint and check with your Device Management Team whether any user is currently using that machine. Also, it would be great if you have CIE activated. https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Set-Up-Clou...
Additionally, there is a feature request raised to always show the last logged-in user in the endpoints table even if no active sessions are present or the endpoint is powered off.

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".