PAN-Agent and Mac OS X Clients

[mharding]

Has anyone had sucess in the PAN-Agent capturing logins for Mac OS X clients joined to Active Directory?

We have about 100 iMacs running Mac OS 10.6.5, and I always get a "_unknown_" username when looking at their IP address in the PAN-Agent. We have a Server 2008 R2 domain controller.

[bpappas]

Question:

do the Mac users ever show up with correct user-IP mappings?

[mharding]

No.

It worked at one time before we made the move to Snow Leopard.

Three things have haven't since it quit working:

- We made the move from Tiger (10.4.11) to Snow Leopard (10.6.5.)

- The PAN-Agent was upgraded from v2 to v3.

- We moved from a Server 2003 to Server 2008 Active Directory infrastructure.

[bpappas]

Based upon the number of changes you have made to the environment I would suggest that you may want to open a support case so that our team can quickly get to the bottom of the problem.

[mharding]

Already done so. Just not getting anywhere.

Wondered if anyone else had it working.

[Laforgepaul]

This is working for us, Mac osx users are configured to use AD for login.  Our pan agents do identifes them correctly.

We have had issues and had to redo the ad configs on the mac.

[mharding]

Can you give me a brief idea of what configs you have? I'm completely at a loss here on how to get it to work.

[mharding]

We found the answer a few days ago. Sucessful account logons weren't being auditied. Since Mac OS 10.4 could use NetBios, my guess is that the PAN-Agent was able to probe the 10.4 clients for logins.

Everything is working great since we made the change to the default domain controller audit policies.

[lester_tt]

What changes?

[mharding]

We modified the Default Domain Controller policy to enable successful logon of accounts.