UserID Reporting Computer Names

apackard · ‎03-28-2018

Quick question.

We are having some issues where a users' computer name i.e. acme\pc01$ is being reported by UserID rather than the user i.e. acme\jbloggs.

Anyone seen this before and\or advice what it could be?

We have a horendously complicated UserI setup so not going to go into detail, but suffice to say that I'm sure that's part of it!

Thanks

Raido_Rattameister · ‎03-28-2018

Do you use certificates to authenticate to GlobalProtect for example?

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

apackard · ‎03-28-2018

We do, but these entires seem to be coming directly from a UserID agent service as we can see them in the monitoring logs.

Mick_Ball · ‎03-29-2018

@apackard, can you see the device names in the user-id agent monitoring.

I'm using agent 8.0.5-7 and am not seeing any device names at all.

I do know that the device name and ip address are within the AD security log but no idea why the panagent would be using this.

Mick_Ball · ‎03-29-2018

also.. this is the 3rd time this issue has been logged here within a couple of weeks so something strange is going on...

apackard · ‎03-29-2018

Thanks, yes, they are showing up in the monitoring logs.

I'm going to try downgrading our agents to see if it is something to do with that.

Rgds

Mick_Ball · ‎03-29-2018

what version are you currently running?

apackard · ‎04-03-2018

I was running 8.1.0-x, but have dropped back to 8.0.8-2 and that seems to have fixed the issue.

dannon · ‎04-04-2018

I saw this also. I upgraded to User-Agent 8.1.0 and started seeing strange things.

Release notes said Palo changed default naming convention and that it won't display it as domain\username anymore.

I was seeing lots of user@domain.name and a lot of machinename$ listings. I didn't know how to fix.

I got burned and rolled back to prior version. Issues went away.

FWIW

Dannon