User-ID Agent Losing Users

[Terry]

We've been running into an issue with our User-ID Agent where it seems to not have enough discovered users but its also losing them randomly as well. Running User ID Agent version 4.1.4-3, we have it pointed at 5 DCs and it is picking up around 1500 users, but we are expecting there to be over 3000 users at any given time.

After doing some investigation, it appears that this may be a problem with the ignore_user_list functionality that is in place. We have 34 service accounts that are ignored, but the one that seems to be causing the issue is the service account for McAfee. This account connects to each machine periodically and get updated information about the AV status and this is picked up in the DC authentication logs. When this account does one of its checks though it seems to wipe out the existing user to ip mapping that it has previously discovered. If I disable the ignore_user_list, then we get 3500 entries in the mapping table, but most of these then point to the McAfee service account, not the currently logged in user.

I've also noticed that even though I have the mapping timeout set to 24 hours the count goes down as well as up, reinforcing the idea that something else is removing the mappings from the table. This is even after restarting the service to reset the timeout timer.

I thought if you entered a user into the ignore_user_list file, then it would just ignore logons from that user, not remove any existing mapping that is already in place? Can anyone confirm if this is expected behaviour or if its something wrong in our setup that's causing the issue.

Any help anyone can provide would be most appreciated

[Terry · Accepted solution]

This morning I've tried downgrading the agent to 4.1.3-2 and the issues goes away. I've not attempted re-install 4.1.4-3 yet because I need this working, but there may be a bug in the latest User ID Agent.

[dtaylor]

I've run into exactly the same problem at a customer site doing a PoC. I've sent them the 4.1.3-2 agent and asked them to downgrade.

[tcrawford]

We experienced this issue a couple weeks ago after upgrading to User Agent 4.1.4-3. Support had us downgrade to 4.1.2-2 which resolved the issue.

My understanding is that the ignore_user_list functionality had changed so that the service account login was ignored but the existing mappings were removed. Similar to you, our AV service account was being detected by Palo Alto even though it was in the Ignore list and existing users were being removed, which was functionally different from previous versions. It took us a couple days to identify the same results you were seeing.