Ensure that the User-ID Agent has minimal permissions if User-ID is enabled

中级别 1人工审核paloalto

说明

If the integrated (on-device) User-ID Agent is utilized, the Active Directory account for the agent should only be a member of the Event Log Readers group, Distributed COM Users group, and Domain Users group. If the Windows User-ID agent is utilized, the Active Directory account for the agent should only be a member of the Event Log Readers group, Server Operators group, and Domain Users group.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Navigate to Active Directory Users and Computers for the Active Directory under consideration. Verify that the service account for the User-ID agent is not a member of any groups other than Event Log Readers, Distributed COM Users, and Domain Users (for the integrated, on-device User-ID agent) or Event Log Readers, Server Operators, and Domain Users (for the Windows User-ID agent.)

修复方式

修复方法: 操作指南或基础设施补丁

Navigate to Active Directory Users and Computers. Set the service account for the User-ID agent so that it is only a member of the Event Log Readers, Distributed COM Users, and Domain Users (for the integrated, on-device User-ID agent) or the Event Log Readers, Server Operators, and Domain Users groups (for the Windows User-ID agent.)

属性

操作系统: 任意
标签: paloaltoauthentication
参考: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 2.5 Ensure that the User-ID Agent has minimal permissions if User-ID is enabled