About mikand

Today there are various options to achieve UserID using PaloAlto Networks devices:   - Install agent on AD-servers to tail the local security log to pick up which userid uses which ip. - Install agent on remote servers that will tail the security log of one (or more) AD-servers (variant of the above - will bring you more network traffic but at the same time you will avoid installing 3rd party software on your AD-servers). - Let the PA device do the above. - Variant of all 3 above is to tail other logtypes to pick up a relation between userid and sourceip (MS Exchange logs, various other textbased logs etc). - Using WMI (either from agent or from PA device) to verify directly towards the computer who is logged in. - Install TS-agent which will define which userid uses which portrange when using a terminal server.   Any other method that I might have missed?   What I wonder is if the following two use cases have been fixed and in which version (like any differences regarding UserID between PANOS 6.x and 7.x?):     Use case 1:   More than one user is logged in to the same client computer (example one user in front of the computer and one user (lets say supportpersonel) thats logged in remotely, or for that matter one user is logged in (and locked screen) but now a second user arrived and used "switch user" - that is second user login (and get his/her own screen) while the first user is still logged in) - how does PA UserID handle this today?   If I recall it correctly previously a single sourceip (except for when TS-agent is used on terminal servers) can only have a single userid connected to it.   This gives that the latest userid will always overwrite the previous userid (like if someone RDP into the client workstation that RDP user will be identified in UserID and the original user is now no longer identified by UserID).     Use case 2:   A single user is logged in to 2 or more computers at once. Lets say the client workstation and then login to some VDI on a terminal server. Will both ip-addresses be valid for the current userid or wil it be similar to as above that latest login is the valid one and previous ip-address associated with this userid is now overwritten?     Bonus question(s):   Are there any up2date whitepaper regarding UserId when it comes to best practices but also what it can (and cannot) do?   For example how do UserID today identify that a user now logged out of his/her computer(s)?   If use case 1 and 2 are still issues, are there any work in progress to fix this or recommended workarounds? ... View more