User-ID Struggles with picking up computer account logons

[brianlr7773]

Hello!

I have an open ticket with Palo Alto for our 5020 series and User-ID problems. My organization has been using PA for years and we never had issues with the User-ID portion until after moving into version 8 (it would seem). Support hasnt been much help for this question, so I want to figure out what your doing for this.

I have our User-ID agent on 3 DC's (2012) and is scraping all our other servers. The problem were having is that nearly all our user rules are based on active directory group association or username based. So the username is the key. Lately the identification is posing major challenges as its flopping between the actual user account logged in and the computer account.

In the firewall were picking up Computer names from AD (with the $ preceding), which from my understanding in the past this was ignored via the User-ID  / Firewall. 

How are you dealing with the detection of computernames$ being present in the security logs for logon/logoff events and getting User-ID agents or the firewall to ignore the $ named logons, I have attempted doing exclusions but this is not working.

Thanks in advance!

[Remo · Accepted solution]

Did you install User-ID Agent 8.1.0 recently? If yes, then update to version 8.1.1 and the problem is gone.

(Bug WINAGENT-269 - https://www.paloaltonetworks.com/documentation/81/pan-os/ua-81-release-notes/user-id-agent-8-1-relea...)

[brianlr7773]

Wow! thanks for that, I am not sure why support didn't catch that.

Its all fixed, thanks 🙂

[DLONGPRÉ]

Hello,

Strangely, I got that problem on PA Integrated USER ID on PAN-OS 9.1.3.

Any thought, idea ?