UserID Reporting Computer Names

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L4 Transporter

UserID Reporting Computer Names

Quick question.

 

We are having some issues where a users' computer name i.e. acme\pc01$ is being reported by UserID rather than the user i.e. acme\jbloggs.

 

Anyone seen this before and\or advice what it could be?

 

We have a horendously complicated UserI setup so not going to go into detail, but suffice to say that I'm sure that's part of it!

 

Thanks

Tags (1)
Highlighted
L7 Applicator

Do you use certificates to authenticate to GlobalProtect for example?

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L4 Transporter

We do, but these entires seem to be coming directly from a UserID agent service as we can see them in the monitoring logs.

Highlighted
L7 Applicator

@apackard, can you see the device names in the user-id agent monitoring.

 

I'm using agent 8.0.5-7 and am not seeing any device names at all.

 

I do know that the device name and ip address are within the AD security log but no idea why the panagent would be using this.

Highlighted
L7 Applicator

also.. this is the 3rd time this issue has been logged here within a couple of weeks so something strange is going on...

Highlighted
L4 Transporter

Thanks, yes, they are showing up in the monitoring logs.

 

I'm going to try downgrading our agents to see if it is something to do with that.

 

Rgds

Highlighted
L7 Applicator

what version are you currently running?

Highlighted
L4 Transporter

I was running 8.1.0-x, but have dropped back to 8.0.8-2 and that seems to have fixed the issue.

Highlighted
L3 Networker

I saw this also.  I upgraded to User-Agent 8.1.0 and started seeing strange things.

 

Release notes said Palo changed default naming convention and that it won't display it as domain\username anymore.

 

I was seeing lots of user@domain.name and a lot of machinename$ listings. I didn't know how to fix.

 

I got burned and rolled back to prior version.  Issues went away.

 

FWIW

Dannon

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!