05-27-2022 02:08 AM
I was quite new to Palo Alto Networks and one that caught my attention is setting up user-id.
However, there are quite many videos which do not mention about the windows-based agent.
What are the advantages if I decided to use windows-based than the integrated PANOS agent? And vice versa.
05-27-2022 07:39 PM
The primary advantage is that you don't need to worry about installing the agent on anything, you simply setup the permissions and can manage everything directly from the firewall. This is more attractive when you have a network that may not want to give PAN-OS administrators direct access to the server running the user-id agent (since you need to have access to a RODC if you choose to use the Domain Credential credential detection method). The admins would be able to manage everything directly from the firewall.
Biggest advantage I can think of off hand is the ability to use the Domain Credential User Credential Detection setting instead of just IP User or Group Mapping. As soon as you want to utilize Domain Credential you absolutely need to be using the Windows-based User-ID agent on a RODC. This allows for much better detection without as many false positive submissions that you'll see using IP User or Group Mapping.
I personally like the Windows user-id agent since it allows for the Domain Credential method. The number of phishing attempts that we identify directly on the firewall and prevent due to this is massive. However, I'm less of a fan of using the Windows agent when the firewall administrators wouldn't have access to the server to manage the agent. In certain installations we've intentionally avoided the agent because the PAN-OS administrators weren't going to have access to the RODC that it was running on to actually manage the agent directly.
05-27-2022 08:51 PM
Hi @IMTechSupport ,
In addition to the Domain Credential Filter that @BPry mentioned, scale is also a consideration. Here is a great article -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpICAS.
@BPry Thank you very much! I will take a good read on this and let you know if I still have any questions.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!