Identify the user account while using RDP on desktop

[RvtKruijs]

Hi,

This is just an query, so that I can understand this topic better. Bear with me, since I am not a network specialist.

Environment

• User works remotely on a laptop and uses GlobalProtect VPN client to remote in on a desktop
• The desktop is located in the office, which allows the user to RDP in on it from any location outside the office
• The desktop is configured to have only one user account allowed to remotely connect
  • IT department has the same permission
  • Policy is only one user per desktop is allowed to RDP and is local admin on the desktop
• The desktop is configured with an static IP Address and a firewall rule created to allow that user to connect to the desktop

We can confirm the user, once logged into GlobalProtect VPN. But it seems that we are not able to confirm this, once the user is logging in through RDP on the desktop. I know it sounds weird, but it is topic that we are discussing.

Question(s):

• How can we confirm the authenticity of the user account?
• Or 😁 does it even make sense, since the user is the only one allowed to log in remotely.

[kiwi]

Hi @RvtKruijs ,

This article explains which credentials you'll see when using RDP:

What Login Credentials Does Palo Alto Networks User-ID Agent See when Using RDP?

Hope it helps,

-Kiwi.