How to Ignore Users in User-ID
87946
Created On 09/25/18 20:40 PM - Last Modified 11/02/23 19:11 PM
Symptom
When using the User-ID Agent to identify users on the network, there is a way to ignore certain users. Generally, this is used for service accounts, but any desired username can be entered.
Environment
- PAN-OS 7.1 and above.
- Windows User-ID Agent.
- Integrated User-ID Agent.
Resolution
- Stop the User-ID service
- Modify/create a file ignore_user_list.txt in the directory where User-ID Agent is installed.
- This file will contain all the users to be ignored.
- The format of the file needs to be one username on each line.
Note: It is sometimes required to have two entries for each username, the normal username and the username with netbios name.- user1
- mydomain\user1
- Start the User-ID service.
How to Create Ignore_User_List with Special Characters in User-ID agent
Starting from PAN-OS 7.1 the ignore user list can also be configured for the Agentless User-ID through the WebUI
Additional Information
How to Add/Delete Users from Ignore User List using Agentless User-ID