When configuring a security policy, what is a best practice for User-ID?

Using multiple methods for User-ID mapping (e.g., WMI, Syslog, authentication policy) can provide redundancy and more comprehensive coverage, so limiting to only one method is not a best practice.

Allowing the User-ID agent in zones where it is not monitoring services is unnecessary and can potentially expose the agent to risks without providing any benefit.

User-ID can map users from various sources, not just Active Directory (e.g., LDAP, RADIUS, local databases), so limiting it solely to AD is not a best practice and may limit its utility.

User-ID agents often use WMI (Windows Management Instrumentation) to query Windows domain controllers for user login information. A best practice is to deny WMI traffic from the User-ID agent to any external zone, typically restricting it to only the internal zones where domain controllers reside to minimize the attack surface and prevent unauthorized WMI access from outside.