In regard to user identification of traffic, older implementations of PAN we would install the PAN-Agent, but after reading a bit more on the 4.1 it seems I would no longer need to use the agent in an Active Directory installation.
Is there any documentation on how to do this for multiple DCs in multiple domains? We are in the midst of a domain transition.
If the agent is still required for 4.1 installations? If so what premissions are needed on the member server, user, and domain controllers for it to work?
If the agent is not required are there any limitations to the number of DCs that can be added to the groups?
Can I also use the new way of doing profiles to allow usernames to have certain levels of administration of the appliance itself?
In 4.1 you still need the user-id agent to be installed on the AD server. This user-id agent should be provided with the adminstrator username and password for retrieving the info from the windows security logs. It same as it was in panagent. the only major difference is that for grouping of users, you have to create ldap server profiles which is not necessary in panagent.
You can grant another user admin rights to READ only
You may want to review documents on the MS knowledge base e.g.
As this is a setting on the Active Directory so best that you contact MS Support for how to create and grant READ ONLY access to user/admin accounts.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!