User-ID PanOS 4.1

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

User-ID PanOS 4.1

Not applicable

In regard to user identification of traffic, older implementations of PAN we would install the PAN-Agent, but after reading a bit more on the 4.1 it seems I would no longer need to use the agent in an Active Directory installation.

Is there any documentation on how to do this for multiple DCs in multiple domains?  We are in the midst of a domain transition.

If the agent is still required for 4.1 installations?  If so what premissions are needed on the member server, user, and domain controllers for it to work? 

If the agent is not required are there any limitations to the number of DCs that can be added to the groups? 

Can I also use the new way of doing profiles to allow usernames to have certain levels of administration of the appliance itself?

6 REPLIES 6

L6 Presenter

I hope this document will assist you in your upgrade to new user id agent 4.1.

https://live.paloaltonetworks.com/docs/DOC-3120

Tx,

Sandeep T

In 4.1 you still need the user-id agent to be installed on the AD server. This user-id agent should be provided with the adminstrator username and password for retrieving the info from the windows security logs. It same as it was in panagent. the only major difference is that for grouping of users, you have to create ldap server profiles which is not necessary in panagent.

Not applicable

any idea on what user premissions are required to read exchange logs?  I have added the user to the Event Log Readers group and can connect/poll from the Domain Controller, but not from Exchange.

Hi,

The login credentials should have the Admin rights to read and write the logs.

Let us know if you have any more questions.

Thanks,

Khubaib

Do you know the admin rights name or group?  I can't give this service domain administrator rights as for security purposes.

You can grant another user admin rights to READ only

You may want to review documents on the MS knowledge base e.g.

http://support.microsoft.com/kb/323076

As this is a setting on the Active Directory so best that you contact MS Support for how to create and grant READ ONLY access to user/admin accounts.

  • 3955 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!