Service Account used for UserID Agent

[MSod]

Hi Support Team, We need to ensure the service accounts used for the UserID agents installed on the domain controllers have the right active directory permissions and limit the permissions to what is required for them to function. I have the following question: 1. What are the required permissions and privileges for it to be functional? 2. What are the risks of misconfiguration or disabling this account?

[OtakarKlier]

Hello,

I would first direct you to read the best practices: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVPCA0

To answer your questions:

1. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/map-ip-addresses-to-users/create-...

2. if you disable the account and have policies that utilize User-ID as a requirement, then this will cause traffic to those policies to not be matched and the traffic would not be allowed.

Hope that helps.