Palo Alto Firewall Agentless User-ID Configuration

Understand the two identity mappings

Server monitoring associates a client IP address with a username using login events. Group mapping separately retrieves directory membership so a security policy can match a team or role. A working LDAP group lookup does not prove that the firewall knows which user currently occupies an IP address. Check both before relying on group-based policy. Palo Alto Networks explains this distinction in its group-mapping guidance.

Prepare Active Directory and connectivity

• Identify the domain controllers that hold your users' login events. Confirm that audit policy produces the relevant security events, including 4624, 4768, 4769 and 4770.
• Create a dedicated monitoring account in each monitored domain. Give it Event Log Readers access for security logs and only the additional remote-management permissions required by the selected transport. Avoid using a Domain Admin account as a shortcut.
• For WinRM, check the documented Remote Management Users and CIMV2 permissions. Keep the account used to configure the server separate from the account used for monitoring.

Follow the dedicated service-account procedure for your collection method. Its minimum-permission approach matters because optional session monitoring and client probing can require broader privileges than event-log collection.

Configure monitoring and trusted networks

Select a supported WinRM transport. HTTPS uses TCP 5986 by default; HTTP uses TCP 5985. Kerberos requires working DNS, synchronized time and the monitored server's fully qualified domain name. HTTPS also requires a server certificate and the corresponding trust configuration on the firewall. Basic authentication belongs on the HTTPS option; WinRM over HTTP uses Kerberos, which protects the session with negotiated encryption. Follow the complete WinRM configuration procedure rather than enabling a listener without its authentication settings.

1. Under Network > Zones, enable User Identification on the trusted source zones containing the users whose traffic needs identity-based controls.
2. Under Device > User Identification > User Mapping, configure the monitor account and add the relevant Active Directory servers with the selected transport.
3. Limit collection to the intended internal networks using Include/Exclude Networks. For this event-log approach, leave optional session monitoring and client probing disabled.
4. Commit the configuration and confirm each monitored server reports Connected.

Review the vendor's User-ID enablement workflow before adding user or group conditions to an existing policy. Menu labels and permission requirements vary with the deployed PAN-OS and Windows versions.

Verify identity before enforcing policy

Sign in with a test user on an included client network, then inspect the monitoring state and learned mappings from the firewall's operational CLI:

show user server-monitor state all
show user server-monitor statistics
show user ip-user-mapping all

These read-only commands are documented in the User-ID CLI reference. Confirm the expected username and client address. Test a narrowly scoped policy and inspect Monitor > Logs > Traffic for the Source User and matched rule. A Connected server alone does not establish that the intended user matched the intended policy. See User-ID verification.

Troubleshoot one layer at a time