UserID - nt authority\accesso anonimo

[TheRealDiz]

Hi guys,

Enviroment

PA3020

panOS 7.1.11 -- UserID agent 7.0.4

I got issue with UserID that is currently receiving identites from UserID Agent.

UserID has already mapped IP address with a specific LDAP user for example "domains.it\test".

Sometimes happens that UserID starting to map the same IP address with this user: "nt authority\accesso anonimo (anonymous access)".

I believe that UserID Agent takes this user from somewhere..but I checked personally:

1. UserID status -- No issues

2. AD -- I didn't find anywhere "nt authority\accesso anonimo"

3. Other users mapped with UserID agent are working properly

I think this is NOT a Palo Alto's issue.

Just per confirmation guys, do you have experienced this behavior before?

Thoughts/Suggestions?

Thanks in advance,

BR

Luca

[Raido_Rattameister]

Not sure why UserID is picking this up but you can exclude this user from Palo side.

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Ignore-Users-in-User-ID-Agent/ta-p/5...

Sometimes some software (like AV) might fool UserID with it's own user account.

https://live.paloaltonetworks.com/t5/General-Topics/Anyone-running-Sophos-antivirus-webfiltering-sol...

[TheRealDiz]

Hi @Raido_Rattameister,

Thank you so much for your reply.

Yes, I'm agree with you! I'm investigating.. I'll update you with my findings.

Thanks also for the linked articles.

BR

Luca

[LorenzoNeri]

Hi Luca,

we have the same problem. We would investage about that issue. 

Did you solve it? Can you reach me at lorenzo.neri[at]aditinet[dot]it or send me a your contact?

Many thanks

Regards,

Lorenzo