Firewall does not recognize users randomly

• User does not appear in the ip-user-mapping at the time of issue.

  PA_Firewall> show user ip-user-mapping ip x.x.x.x 
  
  IP address:    x.x.x.x (vsys1)
  User:          unknown
  From:          Unknown
  Idle Timeout:  1s
  Max. TTL:      4s
  HIP Query:     Disabled
  
  

• Logs under "useridd.log" (less mp-log useridd.log) on Firewall shows that the domain for that user does not exist in group-mapping

  Warning: pan_user_group_user_prime_uid_lookup(pan_user_group_multi_attr.c:1292): For domain\username user, domain <domain_name> does not exist in group-mapping
  Warning: pan_user_group_user_prime_uid_lookup(pan_user_group_multi_attr.c:1292): For domain\username user, domain <domain_name> does not exist in group-mapping

• Palo Alto Firewalls
• Supported PAN-OS
• User based Security Rules configured
• Same Domain Controllers configured as User-ID Agent and Agentless:

The mappings of User-ID Agent can be overwritten by the Agentless configuration and visa versa.

Ensure the Domain controllers are used in the User-ID Agent or in the Agentless configuration, but not both.

Two different types of User ID-Agent:

• Windows User-ID Agent for User Mapping
• User Mapping Using the PAN-OS Integrated User-ID Agent