nerdexam
Palo_Alto_Networks

PCNSE · Question #824

An administrator plans to install the Windows User-ID agent on a domain member system. What is a best practice for choosing where to install the User-ID agent?

The correct answer is C. In close proximity to the servers it will be monitoring. A best practice for installing the Windows User-ID agent is to deploy it in close proximity to the servers it will be monitoring. The User-ID agent monitors Active Directory events, such as logins and logoffs, and maps them to IP addresses for User-ID mapping. Installing the…

Submitted by ahmad_uae· Apr 18, 2026Plan

Question

An administrator plans to install the Windows User-ID agent on a domain member system. What is a best practice for choosing where to install the User-ID agent?

Options

  • AOn the same RODC that is used for credential detection
  • BIn close proximity to the firewall it will be providing User-ID to
  • CIn close proximity to the servers it will be monitoring
  • DOn the DC holding the Schema Master FSMO role

How the community answered

(37 responses)
  • A
    3% (1)
  • B
    8% (3)
  • C
    86% (32)
  • D
    3% (1)

Explanation

A best practice for installing the Windows User-ID agent is to deploy it in close proximity to the servers it will be monitoring. The User-ID agent monitors Active Directory events, such as logins and logoffs, and maps them to IP addresses for User-ID mapping. Installing the agent on a system close to the servers (e.g., domain controllers) ensures it can efficiently and quickly process authentication events without delays that may occur over long distances or in high- latency environments.

Topics

#User-ID Agent#Deployment Best Practices#Agent Placement#Log Collection

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice