UserID Reporting Computer Names

Reply
Highlighted
L4 Transporter

UserID Reporting Computer Names

Quick question.

 

We are having some issues where a users' computer name i.e. acme\pc01$ is being reported by UserID rather than the user i.e. acme\jbloggs.

 

Anyone seen this before and\or advice what it could be?

 

We have a horendously complicated UserI setup so not going to go into detail, but suffice to say that I'm sure that's part of it!

 

Thanks

Tags (1)
Highlighted
L7 Applicator

Re: UserID Reporting Computer Names

Do you use certificates to authenticate to GlobalProtect for example?

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L4 Transporter

Re: UserID Reporting Computer Names

We do, but these entires seem to be coming directly from a UserID agent service as we can see them in the monitoring logs.

Highlighted
L7 Applicator

Re: UserID Reporting Computer Names

@apackard, can you see the device names in the user-id agent monitoring.

 

I'm using agent 8.0.5-7 and am not seeing any device names at all.

 

I do know that the device name and ip address are within the AD security log but no idea why the panagent would be using this.

Highlighted
L7 Applicator

Re: UserID Reporting Computer Names

also.. this is the 3rd time this issue has been logged here within a couple of weeks so something strange is going on...

Highlighted
L4 Transporter

Re: UserID Reporting Computer Names

Thanks, yes, they are showing up in the monitoring logs.

 

I'm going to try downgrading our agents to see if it is something to do with that.

 

Rgds

Highlighted
L7 Applicator

Re: UserID Reporting Computer Names

what version are you currently running?

Highlighted
L4 Transporter

Re: UserID Reporting Computer Names

I was running 8.1.0-x, but have dropped back to 8.0.8-2 and that seems to have fixed the issue.

Highlighted
L3 Networker

Re: UserID Reporting Computer Names

I saw this also.  I upgraded to User-Agent 8.1.0 and started seeing strange things.

 

Release notes said Palo changed default naming convention and that it won't display it as domain\username anymore.

 

I was seeing lots of user@domain.name and a lot of machinename$ listings. I didn't know how to fix.

 

I got burned and rolled back to prior version.  Issues went away.

 

FWIW

Dannon

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!