Configuring the Integrated User-ID dedicated service account with minimal permissions for server monitoring

• Use a dedicated service account for User-ID services with the minimal permissions necessary to connect the server monitoring.
• As a principle of least privilege, user accounts should have only minimum necessary permissions. If an attacker compromises a User-ID service account with domain admin rights, the organization is at far greater risk than if the service account were only granted minimum rights.  

• PANOS 10.0 or above
• Windows Server 2019 Active Directory
• User ID Agent

On the domain controller:

1. Navigate to Active Directory Users and Computers
2. Create the dedicated service account under "managed service accounts", e.g: palo-svc
3. Open mmc.msc and set the service account for the User-ID integrated agent so that it is only a member of:
   • the Event Log Readers
   • Distributed COM Users
   • Domain Users
4. For the Windows User-ID agent:
   • Event Log Readers
   • Server Operators
   • Domain Users groups

For detailed information Refer to the documentation: Create a Dedicated Service Account for the User-ID Agent.