UserID Reporting Computer Names

[apackard]

Quick question.

We are having some issues where a users' computer name i.e. acme\pc01$ is being reported by UserID rather than the user i.e. acme\jbloggs.

Anyone seen this before and\or advice what it could be?

We have a horendously complicated UserI setup so not going to go into detail, but suffice to say that I'm sure that's part of it!

Thanks

[Raido_Rattameister]

Do you use certificates to authenticate to GlobalProtect for example?

[apackard]

We do, but these entires seem to be coming directly from a UserID agent service as we can see them in the monitoring logs.

[Mick_Ball]

@apackard, can you see the device names in the user-id agent monitoring.

I'm using agent 8.0.5-7 and am not seeing any device names at all.

I do know that the device name and ip address are within the AD security log but no idea why the panagent would be using this.

[Mick_Ball]

also.. this is the 3rd time this issue has been logged here within a couple of weeks so something strange is going on...

[apackard]

Thanks, yes, they are showing up in the monitoring logs.

I'm going to try downgrading our agents to see if it is something to do with that.

Rgds

[Mick_Ball]

what version are you currently running?

[apackard]

I was running 8.1.0-x, but have dropped back to 8.0.8-2 and that seems to have fixed the issue.

[dannon]

I saw this also.  I upgraded to User-Agent 8.1.0 and started seeing strange things.

Release notes said Palo changed default naming convention and that it won't display it as domain\username anymore.

I was seeing lots of user@domain.name and a lot of machinename$ listings. I didn't know how to fix.

I got burned and rolled back to prior version.  Issues went away.

FWIW

Dannon