03-02-2012 08:27 AM
In regard to user identification of traffic, older implementations of PAN we would install the PAN-Agent, but after reading a bit more on the 4.1 it seems I would no longer need to use the agent in an Active Directory installation.
Is there any documentation on how to do this for multiple DCs in multiple domains? We are in the midst of a domain transition.
If the agent is still required for 4.1 installations? If so what premissions are needed on the member server, user, and domain controllers for it to work?
If the agent is not required are there any limitations to the number of DCs that can be added to the groups?
Can I also use the new way of doing profiles to allow usernames to have certain levels of administration of the appliance itself?
03-02-2012 03:07 PM
I hope this document will assist you in your upgrade to new user id agent 4.1.
https://live.paloaltonetworks.com/docs/DOC-3120
Tx,
Sandeep T
03-02-2012 03:16 PM
In 4.1 you still need the user-id agent to be installed on the AD server. This user-id agent should be provided with the adminstrator username and password for retrieving the info from the windows security logs. It same as it was in panagent. the only major difference is that for grouping of users, you have to create ldap server profiles which is not necessary in panagent.
03-03-2012 08:28 AM
any idea on what user premissions are required to read exchange logs? I have added the user to the Event Log Readers group and can connect/poll from the Domain Controller, but not from Exchange.
03-05-2012 04:25 PM
Hi,
The login credentials should have the Admin rights to read and write the logs.
Let us know if you have any more questions.
Thanks,
Khubaib
03-06-2012 07:34 AM
Do you know the admin rights name or group? I can't give this service domain administrator rights as for security purposes.
03-13-2012 08:31 AM
You can grant another user admin rights to READ only
You may want to review documents on the MS knowledge base e.g.
http://support.microsoft.com/kb/323076
As this is a setting on the Active Directory so best that you contact MS Support for how to create and grant READ ONLY access to user/admin accounts.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
