User Agent picking up domain service account instead of end user

[cityofmarietta]

We are running a 2008 R2 domain and the user agent is in and working.  However, it keeps showing one of our domain service accounts on many (not all) of the reports and monitoring instead of the actual user that is browsing.  We run the same service account that is showing up in the reports for our KACE agent and Sophos agent.  Not sure if this is what's causing the Palo to pick them up, but we need a way to see the actual end user and not the service account running (if this is indeed where it is coming from).  Again, this does not happen for all PCs, but quite a large percentage.  Any ideas on this?

[gswcowboy]

Create an ignore list and add the 'service' account so it does not overwrite the locally logged in user. Place the file in the pan-agent installation directory and then restart the pan-agent service.

"ignore_user_list.txt"

Example of names to place in the list:

ntadmin

administrator

[cityofmarietta]

I will try that, it sounds right. Is there any special syntax for what I put in the txt file or is just the fully qualified name with carriage return at the end required?

[gswcowboy]

Service account name would be sufficient. Feel free to update the thread if you're still having issues nonetheless.

Regards,

Renato

[cityofmarietta]

Got the file in and restarted the service.  The Traffic Monitoring still shows the service account going by.  Does it take a while to flush the service account name out of the Security Logs on the DC maybe?

[gswcowboy · Accepted solution]

Does the pan-agent GUI still map the ip to the service account(via gui interface)? If not, try resetting the connection between the pan-agent and the pan device with the following command on the pan device:

> debug device-server reset pan-agent all

[FSB]

Thanks that worked for me!

nato wrote:

Create an ignore list and add the 'service' account so it does not overwrite the locally logged in user. Place the file in the pan-agent installation directory and then restart the pan-agent service.

"ignore_user_list.txt"

Example of names to place in the list:

ntadmin
administrator