Help - Userid Responsiveness

[jhickey]

We're at the point where we want to apply URL Filtering policies based on userid. This means its very important that Pan-Agent is accurately identifying users. We did a test and added a user to a monitored group. The policy started working properly. We took him out and it took hours before the policy reverted properly.

We only have 1 PanAgent deployed on a member server. Can I make the identification more resposive by deploying more agents to multiple places ? To specific servers ? Domain Controllers ?

Any opinions on if this is a reliable enough process when tuned correctly ?

Any help would be appreciated.

Thanks,

Justin

[shasnain]

Hi,

The new UID agent is very good. You can have one UID agent pull information from mulitple domains as well. Generally you can use one UID agent and connect multiple Domain controllers to it and do user to ip mapping and it should be no problem for the agent.

If you feel that you need to install more than one UID agent for more resposive by deploying more agents to multiple places for specific servers and Domain Controllers you can do that as well.

Thanks,

Syed Hasnain

[rmonvon]

Hi...Is it well-known that Windows servers do not record logoff events reliably:

http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2management/thread/aaff36f4-f818-...

As such, we only detect logon events.  In your testing, you should try to logoff user1 and then login as user2.  The PA device should pick up user2 immediately to accurately reflect the changing of the user.

As suggested, you should use the latest 4.1 UserID agent.  The 4.1 UserID agent supports the monitoring of logon events on Exchange servers where most devices will have access to email via active-async.  You can set active-sync to login frequently and the PA device will update accordingly.

You can also enable WMI probing on the UserID agent to monitor user status as well.  Thanks.