High number of logins to AD

[smwilliams]

Good day,

Is it normal for the account that the FW uses to get the user-id information from AD to have a high number of logins? Across our entire network, this account is over 90% of all of our successful logins. It just seems that this account is logging in way too much.

Thanks

[Raido_Rattameister · Accepted solution]

Well firewall communicates quite often with domain controllers.

Try if installing UserID agent on domain controllers solves this issue.

[reaper]

you could install a UserID agent on the AD which will run as a service so won't need to authenticate as much (the agentless deployment needs to connect to the AD so it may request authentication each time and log each event)

[TranceforLife]

Hey,

Sorry for the intrusion. 

How ofter the firewall talking to the agents or it is actually agents feed the user mapping to the firewall?

How about sys log listener (s):

So Palo listens for syslogs from the syslog server or another way you can use the agent as a listener and then point Palo to talk to that agent. Sorry, my new journey USER-ID 😉