For installing the Windows-based User-ID agent, the best practice is to use a dedicated service account. This approach adheres to the principle of least privilege, where the account is granted only the minimum permissions necessary to perform its functions—specifically, the ability to read security event logs from domain controllers and/or probe client systems via WMI. Using highly privileged accounts like Domain or Enterprise Administrator is strongly discouraged as it introduces unnecessary security risks. The dedicated account's scope of access is limited, minimizing the potential impact if the account credentials were to be compromised.

B. System Account: This is a local account and lacks the required network permissions to read event logs from remote domain controllers, which is a primary function of the User-ID agent.

C. Domain Administrator: This account has excessive privileges. Using it for a service violates the principle of least privilege and creates a significant security vulnerability.

D. Enterprise Administrator: This is the most privileged account in an AD forest. Using it for the User-ID agent is a severe security risk and is not required.

1. Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Configure a Service Account for the User-ID Agent". The documentation states

"For the User-ID agent to access the security logs on your domain controllers... you must configure a service account with the proper permissions." It then details the specific

limited permissions required

reinforcing the need for a dedicated

non-admin account.

2. Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Install the Windows-Based User-ID Agent". In Step 4 of the installation procedure

it prompts for the username and password for the service

stating

"Enter the Username and Password for the service account that the User-ID agent will use to access servers." This implies a specific

pre-configured account.