Wrong user from access log

Reply
Highlighted
L2 Linker

Wrong user from access log

Hello!

 

The local user Administrator is logged in on the desktop and he is not allowed to access the internet. But he can access.

When checking in Monitor on PA220, I noticed that another user appears in the Source User column and not the Administrator user.

Has anyone ever experienced this?

 

Software version 8.0.10 

 

Thank you!

 

Highlighted
L7 Applicator

the local admin account probably has nothing to do with AD so your your user ID is still seeing the account that last registered with your AD server.

Highlighted
L2 Linker

Ok... but, do you know how we can solve this issue?

 

Thank you!

Highlighted
L7 Applicator

ooh... good point...  not sure... I'm sure someone will jump in and advise.. 

 

to confirm..

 

are you using AD for user-ID. 

Highlighted
L2 Linker

Yes... I am using AD server.

 

So, let´s wait... 

 

Thanks

Highlighted
L7 Applicator

Have you tried this approach...

 

•Device > User Identification> User Mapping > Palo Alto Networks User-ID Agent Setup > Client Probing

You can configure the User-ID agent to perform WMI client probing for each client system that the user mapping process identifies. The User-ID agent will periodically probe each learned IP address to verify that the same user is still logged in. When the firewall encounters an IP address for which it has no user mapping, it sends the address to the User-ID agent for an immediate probe. To configure client probing settings, complete the following fields.

Highlighted
L7 Applicator
Highlighted
L2 Linker

This option is enabled...

Highlighted
Cyber Elite

@BethSouza,

You'll never get local admin accounts to actually show up as a user-id, unless you poll the machine in question which would be a really odd configuration. WMI client probing can help in this case, but your user-id configuration will ignore the user unless specifically set to allow it. 

Best solution, admin accounts should be AD users that are granted administrative rights on the machine. If you are going to use local-user accounts for administrative purposes you'll have to grant at least basic tcp/80 and tcp/443 access for any unknown-user in your environement and just be sure to log it to fit in with your security needs. 

Highlighted
L2 Linker

Hello Bpry,

 

we do not want local users to have access to the internet. The local administrator was able to access the internet by chance and we were surprised when we checked the PA220 log.

I think the problem is when the PA220 looks in the Domain Controller Audit log for the validation of the user who is logged into the machine. Because the local machine administrator is not registered in the Domain Controller Audit log, it takes the last user record that logged on the machine.

 

Thank you!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!