Detections
Analytics

2.5 Ensure that the User-ID Agent has minimal permissions if User-ID is enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

If the integrated (on-device) User-ID Agent is utilized, the Active Directory account for the agent should only be a member of the Event Log Readers group, Distributed COM Users group, and Domain Users group. If the Windows User-ID agent is utilized, the Active Directory account for the agent should only be a member of the Event Log Readers group, Server Operators group, and Domain Users group.

Rationale:

As a principle of least privilege, user accounts should have only minimum necessary permissions. If an attacker compromises a User-ID service account with domain admin rights, the organization is at far greater risk than if the service account were only granted minimum rights.

Solution

Navigate to Active Directory Users and Computers.
Set the service account for the User-ID agent so that it is only a member of the Event Log Readers, Distributed COM Users, and Domain Users (for the integrated, on-device User-ID agent) or the Event Log Readers, Server Operators, and Domain Users groups (for the Windows User-ID agent.)





Impact:

Using accounts with full administrative privileges when those rights are not required is always a bad idea. This is particularly true for service accounts of this type, which in many organizations do not see strong passwords or frequent password changes. In addition, service passwords are stored in the Windows Registry, and are recoverable with the user of appropriate malicious tools. The principal of least privilege means that any compromised accounts of this type have less value to an attacker, and expose fewer assets based on their rights.

Default Value:

Not configured

References:

'Best Practices for Securing User-ID Deployments' - https://live.paloaltonetworks.com/docs/DOC-7912

'User-ID Best Practices' - https://live.paloaltonetworks.com/docs/DOC-6591

'PAN-OS Administrator's Guide 9.0 (English) - Configure User Mapping Using the Windows User-ID Agent' - https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-mapping-using-the-windows-user-id-agent.html

'PAN-OS Administrator's Guide 9.0 (English) - Configure User Mapping Using the PAN-OS Integrated User-ID Agent' - https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-mapping-using-the-pan-os-integrated-user-id-agent.html

See Also

https://workbench.cisecurity.org/files/2692

Item Details

References: CSCv6|5, CSCv6|5.1, CSCv6|9, CSCv7|9, CSCv7|16

Plugin: Palo_Alto

Control ID: 12d82e282f926ae0c4b3b311a0babb3f0bfec87d619035a8695853a6901e0e1a