Global Protect not passing last login information?

[rgreens]

We have a few vendors who have AD accounts, but only connect to Global Protect to SSH to specific servers.  They don't use any other domain resources.  When we look in the domain controllers there is no last login information.  So our policy to disable unused accounts after 21 days keeps disabling active accounts.

Anyone know how to get it to pass this information?

Thank you,

Randy

[hshah]

Hi Randy,

I am rephrasing the question, correct me if I am wrong.

Question : How to find out unused GP users for last 21 days?

If that is the question, you can not readily pull out that information from Firewall.

However, system logs have information about GP user login/logout activity. You should forward it to syslog server. And do the analysis from login/logout logs.

Let me know if that helps.

Regards,

Hardik Shah

[ajbool]

I think he means; how can a user logging into Global Protect cause the last-logged-in timestamp held in Active Directory to be updated.

[rgreens]

ajbool, correct.  I can see in the Palo Alto the last login for Global Protect, but in the Domain Controllers in doesn't update the last login information.

[hshah]

Hi Ajbool,

When user tries to login, firewall sends credentials to AD for verification. So, AD should have that log in security logs.

Regards,

Hardik Shah

[hshah · Accepted solution]

Hello Rgreens,

This appears to be AD log issue, try to deep dive into security logs of AD.

I dont think there is any issue with firewall, if user is authenticated than firewall must have forwarded request to AD.

Regards,

Hardik Shah

[panos]

just check AD settings for logging that.

Not a firewall issue.

[rgreens]

The issue is with AD in the fact the Palo Alto's are only using "simple bind" with the LDAP lookup.  From what I found the AD should use lastlogonTimeStamp instead of lastlogon for "simple bind."  However it appears it is still not accurate.  Showed a user last logged on 7 days ago, but the are currently logged on.