web access for local administrators

[Carpetright]

We have our web access rules setup to match up with AD groups, so if you’re not in an web access AD group then you can’t get on the internet.

The issue our PC support guys have is when they log into a PC or laptop as a local administrator they will need internet access to install software such as Office 365, web browsers etc. but cant because they are logged in as a local administrator which obviously isnt in a AD group.

This used to be fine with our old web filter as PC support could manually type in a the proxy address or PAC file into IE to get internet access, this is not possible with the Palo Altos so I was wondering how do people get around this issue?

Thanks

[Remo · Accepted solution]

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/user-id/map-ip-addresses-to-username...

Using the captive portal, which presents a login form in the browser for not yet identified users should probably solve your problem

[Carpetright]

That sounds like it could do the trick, i will take a look

thanks