Palo Alto Networks Certified Network Security Engineer (PCNSE)Manage and OperateHard
A network engineer is configuring User-ID for a new branch office. The branch office uses Active Directory for user authentication, and the engineer wants to use the most efficient method to collect user-to-IP address mappings without deploying a dedicated User-ID agent on every client machine. Which User-ID source should the engineer prioritize for this deployment?
- AServer Monitoring (WMI/WinRM)
- BTerminal Services Agent
- CSyslog Listener
- DGlobalProtect
Show answer & explanationAnswer & explanation
Correct answer: A. Server Monitoring (WMI/WinRM)
Server Monitoring (WMI/WinRM) directly queries Active Directory domain controllers for security event logs (specifically event ID 4768/4769 for authentication, and 4624 for logon) to gather user-to-IP mappings. This is highly efficient as it leverages existing domain controller infrastructure without requiring agents on every client.
Why the other options are wrong
- B. Terminal Services Agent is specifically for environments with multiple users sharing a single server (like RDS or Citrix), which is not implied as the primary scenario for 'every client machine' in a typical branch office.
- C. Syslog Listener can process logs from various sources, but directly querying domain controllers for security events is more targeted and often more comprehensive for Active Directory environments.
- D. GlobalProtect provides user-to-IP mapping for VPN users, but the question implies general branch office users on the LAN, not just VPN users.
User-ID Server Monitoring
User-ID Server Monitoring involves configuring the Palo Alto Networks firewall or a User-ID agent to query Active Directory domain controllers (using WMI/WinRM) for security event logs to gather user-to-IP address mappings.
- Leverages existing Active Directory infrastructure.
- Does not require client-side agents.
- Provides real-time user-to-IP mapping for policy enforcement.
Memory trick: User-ID maps users like a GPS, and Server Monitoring is the best road map for AD.