User-ID Agent, uninstall slows down network logons

Showing results for 
Show  only  | Search instead for 
Did you mean: 

User-ID Agent, uninstall slows down network logons

L0 Member



I am not a Network Engineer but am trying to assist the folks running the network at my company. I am in charge of Active Directory. The Network Engineers recently uninstalled the Palo Alto User-ID from two of my Domain Controllers. Since then, we have seen network slow downs randomly, for certain Netlogon connections between Domain Controllers. I have also requested them to re-install the software. It is apparently re-installed, yet I clearly see no users in the logs as having been discovered so I can only believe that something is still not quite right with the setup. Does anyone have anything they can recommend I do next? I am at my wits end and truly believe that somehow the Palo Alto User-ID service was somehow helping to keep our logons working correctly, but the network team is swamped with other work as well. Thanks!


Cyber Elite
Cyber Elite


Ya, that's not how it works. The user-id agent simply reads the event logs, it doesn't listen to the network traffic or anything like that. Uninstalling the agent or re-installing the agent absolutely should have no effect on the speed of your Domain Controllers or Netlogon connections. 

If what you say is true... why would we start seeing these messages inundating our event logs on the DCs after uninstalling the User-ID Agent? It can't just be a coincidence. Somehow there must be a correlation?


Netlogon has failed an authentication request of account *** domain ***. The request timed out before it could be sent to domain controller **** in domain ***. This is the first failure. If the problem continues, consolidated events will be logged about every 30 minutes. Please see for more information.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!