problem with userIDAgent in RDP

[BigPalo]

hello

We have a problem with users when they connect in RDP

We found a solution whit this KB:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleBCAS

but we have new questions:

1.- Is there a way to know what information the userIDAgent gets from the AD?

2.- Is there any way to limit the type of events it reads (as far as I understand, in Fortinet's User-ID agent (FSSO) this type of configuration is possible)?

Thanks

Kind regads

[reaper]

the userID agent reads the event log on the active directory and picks up logon and auth-success messages, to collect username + ip address info

you can add a ignore_user_list.txt file in the uid agent folder and add usernames (one per line) the agent needs to ignore (typically service accounts and admins)