Windows Based Agent vs Integrated PANOS Agent

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Windows Based Agent vs Integrated PANOS Agent

L2 Linker

Hi everyone!


I was quite new to Palo Alto Networks and one that caught my attention is setting up user-id.

However, there are quite many videos which do not mention about the windows-based agent.

What are the advantages if I decided to use windows-based than the integrated PANOS agent? And vice versa.




Cyber Elite
Cyber Elite



The primary advantage is that you don't need to worry about installing the agent on anything, you simply setup the permissions and can manage everything directly from the firewall. This is more attractive when you have a network that may not want to give PAN-OS administrators direct access to the server running the user-id agent (since you need to have access to a RODC if you choose to use the Domain Credential credential detection method). The admins would be able to manage everything directly from the firewall.


Windows Agent

Biggest advantage I can think of off hand is the ability to use the Domain Credential User Credential Detection setting instead of just IP User or Group Mapping. As soon as you want to utilize Domain Credential you absolutely need to be using the Windows-based User-ID agent on a RODC. This allows for much better detection without as many false positive submissions that you'll see using IP User or Group Mapping. 


I personally like the Windows user-id agent since it allows for the Domain Credential method. The number of phishing attempts that we identify directly on the firewall and prevent due to this is massive. However, I'm less of a fan of using the Windows agent when the firewall administrators wouldn't have access to the server to manage the agent. In certain installations we've intentionally avoided the agent because the PAN-OS administrators weren't going to have access to the RODC that it was running on to actually manage the agent directly. 

Cyber Elite
Cyber Elite

Hi @IMTechSupport ,


In addition to the Domain Credential Filter that @BPry mentioned, scale is also a consideration.  Here is a great article ->





Help the community: Like helpful comments and mark solutions.

@BPry Thank you very much! I will take a good read on this and let you know if I still have any questions.

@TomYoung Thank you! I will read this article as well. 


  • 4 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!