Configure a Service Account for the Windows User-ID Agent

Create an AD service account for the User-ID agent.
You must create a service account in each domain the agent will monitor.
Log in to the domain controller.
Right-click the Windows icon (
),
Search
for
Active Directory Users and Computers
, and launch the application.
In the navigation pane, open the domain tree, right-click
Managed Service Accounts
and select
New
User
.
Enter the
First Name
,
Last Name
, and
User logon name
of the user and click
Next
.
Enter the
Password
and
Confirm Password
, then click
Next
and
Finish
.
Configure either local or group policy to allow the service account to log on as a service.
The permission to log on as a service is only needed locally on the Windows server that is the agent host.
To assign permissions locally:

select

Control Panel

Administrative Tools

Local Security Policy

.

Select

Local Policies

User Rights Assignment

Log on as a service

.

Add User or Group

to add the service account.

Enter the object names to select

(the service account name) in

domain\username

format and click

OK

.

To configure group policy if you are installing Windows User-ID agents on multiple servers, use the Group Policy Management Editor.

Select

Start

Group Policy Management

<your domain>

Default Domain Policy

Action

Edit

for the Windows server that is the agent host.

Select

Computer Configuration

Policies

Windows Settings

Security Settings

Local Policies

User Rights Assignment

.

Right-click

Log on as a service

, then select

Properties

.

Add User or Group

to add the service account username or builtin group, then click

OK

twice.

Administrators have this privilege by default.
If you want to use WMI to collect user data, assign DCOM privileges to the service account so that it can use WMI queries on monitored servers.
Select
Active Directory Users and Computers
<your domain>
Builtin
Distributed COM Users
.
Right-click
Properties
Members
Add
and enter the service account name.
If you plan to use WMI probing, enable the account to read the CIMV2 namespace and assign the required permissions on the client systems to be probed.
Do not enable client probing on high-security networks. Client probing can generate a large amount of network traffic and can pose a security threat when misconfigured. Instead collect user mapping information from more isolated and trusted sources, such as domain controllers and through integrations with Syslog or the XML API, which have the added benefit of allowing you to safely capture user mapping information from any device type or operating system, instead of just Windows clients.
Perform this task on each client system that the User-ID agent will probe for user mapping information:
Right-click the Windows icon (
),
Search
for
wmimgmt.msc
, and launch the WMI Management Console.
In the console tree, right-click
WMI Control
and select
Properties
.
Select the
Security
tab, then select
Root
CIMV2
, and click the
Security
button.
Add
the name of the service account you created,
Check Names
to verify your entry, and click
OK
.
You might have to change the
Locations
or click
Advanced
to query for account names. See the dialog help for details.
In the Permissions for
<Username>
section,
Allow
the
Enable Account
and
Remote Enable
permissions.
Click
OK
twice.
Use the Local Users and Groups MMC snap-in (lusrmgr.msc) to add the service account to the local Distributed Component Object Model (DCOM) Users and Remote Desktop Users groups on the system that will be probed.
If you want to use Server Monitoring to identify users, add the service account to the Event Log Reader builtin group to allow the service account to read the security log events.
On the domain controller or Exchange server that contains the logs you want the User-ID agent to read, or on the member server that receives events from Windows log forwarding, select
Start
Run
, enter
MMC
.
Select
File
Add/Remove Snap-in
Active Directory Users and Computers
Add
, then click
OK
to run the MMC and launch the Active Directory Users and Computers snap-in.
Navigate to the Builtin folder for the domain, right-click the
Event Log Readers
group, and select
Properties
Members
.
Add
the service account then click
Check Names
to validate that you have the proper object name.
Click
OK
twice to save the settings.
Confirm that the builtin Event Log Reader group lists the service account as a member (
Event Log Readers
Properties
Members
).
Assign account permissions to the installation folder to allow the service account to access the agent’s installation folder to read the configuration and write logs.
You only need to perform this step if the service account you configured for the User-ID agent is not either a domain administrator or a local administrator on the User-ID agent server host.
From the Windows Explorer, navigate to
C:\Program Files(x86)\Palo Alto Networks
, right-click the folder, and select
Properties
.
On the
Security
tab, click
Edit
.
Add
the User-ID agent service account and
Allow
permissions to
Modify
,
Read & execute
,
List folder contents
,
Read
, and
Write
, and then click
OK
to save the account settings.
If you do not want to configure individual permissions, you can
Allow
the
Full Control
permission instead.
To allow the agent to make configuration changes (for example, if you select a different logging level), give the service account permissions to the User-ID agent registry sub-tree.
Select

Start

Run

and enter

regedt32

and navigate to the Palo Alto Networks sub-tree in one of the following locations:

32-bit systems
—
HKEY_LOCAL_MACHINE\Software\Palo Alto Networks
64-bit systems
—
HKEY_LOCAL_MACHINE\Software\WOW6432Node\PaloAlto Networks

Right-click the

Palo Alto Networks

node and select

Permissions

.

Assign the User-ID service account

Full Control

and then click

OK

to save the setting.
Disable service account privileges that are not required.
By ensuring that the User-ID service account has the minimum set of account privileges, you can reduce the attack surface should the account be compromised.
To ensure that the User-ID account has the minimum privileges necessary, deny the following privileges on the account.
Deny interactive logon for the User-ID service account

—While the User-ID service account does need permission to read and parse Active Directory security event logs, it does not require the ability to logon to servers or domain systems interactively. You can restrict this privilege using Group Policies or by using a Managed Service account (refer to Microsoft TechNet for more information).

Select

Group Policy Management Editor

Default Domain Policy

Computer Configuration

Policies

Windows Settings

Security Settings

User Rights Assignment

.

For

Deny log on as a batch job

,

Deny log on locally

, and

Deny log on through Remote Desktop Services

, right-click

Properties

.

Select

Define these policy settings

Add User or Group

and add the service account name, then click

OK

.

Deny remote access for the User-ID service account

—This prevents an attacker from using the account to access your network from the outside the network.

Select

Start

Run

, enter

MMC

, and select

File

Add/Remove Snap-in

Active Directory Users and Computers

Users

.

Right-click the service account name, then select

Properties

.

Select

Dial-in

, then

Deny

the

Network Access Permission

.
As a next step, Configure User Mapping Using the Windows User-ID Agent.