Incorrect User-ID

[Farzana]

Hello,

We are using User-ID Agent. 

A number of Source Users are reported as “sophosupdate”. It is not picking up the correct user.

The expected behaviour would be for the end user name (example of m.hayes in the list below).

How to correct this?

Thanks in advance.

[hpunjabi]

Hi Farzana,

You can try the below link to ignore service accounts:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Ignore-Users-in-User-ID-Agent/ta-p/5...

Usually it should work with bcc\sophosupdate in the list, if it does not works then enter both the formats sophosupdate and bcc\sophosupdate.

[Farzana]

Thanks for the suggestion. Tried that but not working.

Hayes one of our members was logged into a Windows 7 desktop with the IP of 10.1.x.y. At the start of the session (initial login) it changed withing 20 minutes and Hayes could not longer browse the internet. I checked the Palo Alto User Agent on BCC-DC02 and found that it was now registering the SophosUpdate account against the 10.1.x.y address.

I cannot find in the PA the user group that bcc\sophosupdate user belongs to.

> show user user-ids match-user bcc\sophosupdate

User Name                       Vsys    Groups

------------------------------------------------------------------

Total: 829

* : Custom Group

> show user user-id-agent config name BCC-DC02

Has nothing in the Ignore List.

[hpunjabi · Accepted solution]

Hi Farzana,

Try below command ignoring the domain.

show user user-ids match-user sophosupdate

and see if you can see any mapping.

For ignore user list the filename should be exactly ignore_user_list.txt.

Common issue which happens is the file usually gets created with ignore_user_list.txt.txt, 

Untick below: 

Under Tools>Folder Options > Hide extensions for known file types 

Remove the extra .txt if it exists.

[bmorris1 · Accepted solution]

Also make sure to restart the User-ID service once you've implemented the ignore user list so it picks up and reads the list.

[Farzana]

Thank you!

 We added the “ignore” list at the User ID agent and not the FW GUI.

Also cleared the user-id, and user-id-mp caches and restarted the Agent.

Issue is resolved.