RDP and the PAN-Agent

[bhavin_bhatt]

Hi James,

the workstation and its ip address are being associated with the local login as well as the ad login credentials used to rdp to other servers.

This confuses the palo alto while deciding which user to associate the ip address to...the correct policy does not match for the user in question.

cheers

[mharding]

My solution was to exclude the subnet our servers were on. May not be viable for everyone.

[mrajdev]

Bhavin,

The server account which you use to login during an RDP session is it part of domain administrator account? If yes then can you please try an account which is not part of domain adminstrator and see if the PC retains it original user id and IP address.

Thanks

[bhavin_bhatt]

Hi mrajdev,

thanks for the response, i am afraid the usernames are part of the domain and unfortunately, in our environment, non-domained usernames are not permitted, is there any other solutions ?

i was thinking of ignoring the admin ad users on pan-agent and use the sys admins ip addresses in the policies, not a very smart solution, but am still in search of a better solution to this problem.

Cheers

Bhav

[bryan]

Hello Bhav,

When this issue occurs, are you logging on via RDP to a Domain Controller? If so, can you attempt to logon via RDP to another Server/Workstation (Non-DC) & confirm whether the original User-ID mappings on both machines are retained?

Thanks,

Bryan

[bhavin_bhatt]

Hi Bryan,

I am RDP'ing to a server and not a domain controller.

Cheers

Bhav

[bhavin_bhatt]

Hi Bryan,

unfortunately we dont have any non-domained PCs connected in our domain.

Cheers

Bhavin

[bjackson]

Also experiencing the exact same behaviour!

Is there a best practice guide on how to best overcome this issue?

Thanks

[mharding]

My only solution is to either wait for the WMI Query or have the user lock and unlock their PC.

[mikand]

According to some docs the following eventid's are being monitored for by the pan agent:

Win2003 DCs:

672

673

674

Win2008 DCs:

4768

4769

4770

So I find it interresting that your eventid 4624 would have something to do with this... has the pan agent been updated to cover even the 4624 events for some odd reason?