Monitor Shared Workstations

Table of Contents

Monitor Shared Workstations

Use Endpoint Management and pacli commands to identify shared workstations and review user history on those devices.

Where Can I Use This?	What Do I Need?
Prisma Access (Managed by Strata Cloud Manager)	Check the prerequisites for the deployment you're using Minimum required Prisma Agent version: 26.4 Windows workstations

The Endpoint Manager automatically detects shared workstations. No agent or admin configuration is required. A device used by two or more unique users within 30 days is automatically classified as a shared workstation. Use these steps to validate that the Endpoint Management window has correctly identified shared devices in, audit who has been using each device, and troubleshoot cases where the wrong user identity may be active on an endpoint.

In this release, Endpoint Manager–pushed configurations reset when a user switches on a shared workstation, and locally set configurations persist to the next user.

In Strata Cloud Manager, select ConfigurationEndpoint Management.
In the Shared Workstation column of the Devices table, identify devices classified as shared workstations.

A blank value means the device is not a shared workstation or no other users have logged into the device in the past 30 days. A Yes badge means two or more unique users have logged into that device within the past 30 days.
To view user history for a shared workstation, click Yes in the Shared Workstation column for that device.

A window titled Users — hostname — Past 30 Days slides open. The window lists each user in the User column with a corresponding Last Login timestamp. The currently active user appears with a green Active badge. The window displays up to 500 unique users from the past 30 days. If more than 500 unique users log in within that period, the oldest are no longer shown.
(Optional) On the endpoint, run the pacli epm status command to verify that Endpoint Manager's authenticated identity matches the Windows OS user currently logged in.
```
"C:\Program Files\Palo Alto Networks\Prisma Access Agent\pacli" epm status
```
The output includes two fields: Username, which shows the identity the Endpoint Manager has authenticated, and Bound OS User, which shows the OS user currently logged in.
(Optional) On the endpoint, run the pacli getlogs command to collect diagnostic logs from all users who have logged into the device.
```
"C:\Program Files\Palo Alto Networks\Prisma Access Agent\pacli" getlogs
```
The command collects logs from all user profiles on the device, not only the currently active user.