Wrong user from access log

[BethSouza]

Hello!

The local user Administrator is logged in on the desktop and he is not allowed to access the internet. But he can access.

When checking in Monitor on PA220, I noticed that another user appears in the Source User column and not the Administrator user.

Has anyone ever experienced this?

Software version 8.0.10 

Thank you!

[MickBall]

the local admin account probably has nothing to do with AD so your your user ID is still seeing the account that last registered with your AD server.

[BethSouza]

Ok... but, do you know how we can solve this issue?

Thank you!

[MickBall]

ooh... good point...  not sure... I'm sure someone will jump in and advise.. 

to confirm..

are you using AD for user-ID. 

[BethSouza]

Yes... I am using AD server.

So, let´s wait... 

Thanks

[MickBall]

Have you tried this approach...

•Device > User Identification> User Mapping > Palo Alto Networks User-ID Agent Setup > Client Probing

You can configure the User-ID agent to perform WMI client probing for each client system that the user mapping process identifies. The User-ID agent will periodically probe each learned IP address to verify that the same user is still logged in. When the firewall encounters an IP address for which it has no user mapping, it sends the address to the User-ID agent for an immediate probe. To configure client probing settings, complete the following fields.

[MickBall]

https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/user-identification/devi...

[BethSouza]

This option is enabled...

[BPry]

@BethSouza,

You'll never get local admin accounts to actually show up as a user-id, unless you poll the machine in question which would be a really odd configuration. WMI client probing can help in this case, but your user-id configuration will ignore the user unless specifically set to allow it. 

Best solution, admin accounts should be AD users that are granted administrative rights on the machine. If you are going to use local-user accounts for administrative purposes you'll have to grant at least basic tcp/80 and tcp/443 access for any unknown-user in your environement and just be sure to log it to fit in with your security needs. 

[BethSouza]

Hello Bpry,

we do not want local users to have access to the internet. The local administrator was able to access the internet by chance and we were surprised when we checked the PA220 log.

I think the problem is when the PA220 looks in the Domain Controller Audit log for the validation of the user who is logged into the machine. Because the local machine administrator is not registered in the Domain Controller Audit log, it takes the last user record that logged on the machine.

Thank you!