How to Clear User Cache after Changing Active Directory Domain Name

This article explains the required steps that are needed to clear the cached IP mapping after active directory domain name changing 

• Palo Alto Firewalls
• Supported PAN-OS versions
• LDAP or Radius Authentication profile is configured with domain override
• User-ID Agent
• Domain name of the Active Directory is changed 

When changing the domain name in the LDAP or Radius server profile, it is necessary to clear the user cache in order for the firewall to start a new IP to User mapping list.

1. To clear the user cache and group cache, Run the following commands:

   > clear user-cache-mp all    > clear user-cache all > delete user-group-cache

2. To populate the group information again, Run the following command.

   > debug user-id refresh group-mapping all

   Note: If the command is not executed, the next group-mapping refresh should populate the group information. The default value of this "Update Interval" is 3600 seconds (60 min).