Which User-ID mapping method should be used for an environment with clients that do not authenticate to Windows Active Directory?

Windows session monitoring relies on integration with Windows Active Directory domain controllers to retrieve user login events, which is not applicable if clients do not authenticate to AD.

Passive server monitoring using a Windows-based agent collects user login information from Windows servers, requiring clients to authenticate to those Windows servers, which is not the scenario described.

Captive Portal is designed to identify users by requiring them to authenticate directly to the firewall through a web browser, making it suitable for environments where traditional AD-based authentication is not present or cannot be leveraged for User-ID.

Passive server monitoring using a PAN-OS integrated User-ID agent functions similarly to the Windows-based agent by monitoring servers for login events, which is ineffective if clients don't use Windows AD for authentication.