Export Users by CLI

[javier.allende]

Good afternoon,

Is it possible to export by CLI the list of users of Palo Alto? At this moment I've only get through Device - Database User Locals but I cannot export.

regards 

[BPry]

I don't believe that you can; you used to be able to run show user local-user-db but that looks like it's no longer a valid command as you get a depreciated error.

You can export the config and delete everything before <local-user-database> and then everything after </local-user-database and then use the excel import from xml source to generate a nice list of the users with the p-hash, disabled status, and you also get the user groups. 

[reaper · Accepted solution]

do you mean the locally configured users ?

admin@myNGFW> show authentication local-user-db 
+ disabled   Filter by disabled/enabled
+ username   User name
+ vsys       Virtual System
  |          Pipe through a command
  <Enter>    Finish input

[BPry · Accepted solution]

@reaper there's the command; I haven't ran a PA for a long time with local-users. @javier.allende reapers command works perfectly and you won't have to export the config and modify it to get the list. 

[javier.allende]

Many thanks.

the version of my PanOs the command that i have to lunch is the following

show authentication groupdb | match vsys1

regards 

PD: appears all the users that are in the database but are not the same as appears in the webGUI. A few delete users from the WEBGUI appears on it

[reaper]

have you tried pushing a 'commit force' ?

[javier.allende]

Which is the purpose of this command? 

[reaper]

it may help remove any leftover artefacts