Device Administrators

[rcraxton]

Hello,

Can a "Device Administrator" unlock users in "Authentication Profile"?   Don't want to give user "Super User" unless there is no other choice.

Thanks

Rich

[Claw4609]

It looks like it should yes, but it also depending on your situation it may be better to create a custom admin role to restrict to only what is needed. 

Device > Admin Roles (paloaltonetworks.com)

Configure an Admin Role Profile (paloaltonetworks.com)

[rcraxton]

I started with a custom admin role - same issue, couldn't unlock users.  Thus went to device administrator.   Same problem.  Currently on Pan OS 10.2.6.   

[Claw4609]

Do you see the locked users with a device administrator role? It looks like on my Pan-os 10.2.6 I can select users locked under an authentication profile with a device administrator role. Are you doing this through the GUI or CLI?

[rcraxton]

The user can see the locked users but there is no "Unlock" beside the name like when a superuser.  This is being done via GUI, I don't want user down in CLI. 

[Claw4609 · Accepted solution]

Oh that you're right, I wasnt paying close enough attention. At least according to this older article you do in fact need superuser. Solved: LIVEcommunity - SAML login remove lock (superuser?) - LIVEcommunity - 528930 (paloaltonetwor...

[rcraxton]

Didn't want to make user a "SuperUser" but appears I don't have any choice.