diff --git a/salt/manager/tools/sbin/so-user b/salt/manager/tools/sbin/so-user
index 989b8d554..8234f7ae5 100755
--- a/salt/manager/tools/sbin/so-user
+++ b/salt/manager/tools/sbin/so-user
@@ -5,11 +5,13 @@
 # https://securityonion.net/license; you may not use this file except in compliance with the
 # Elastic License 2.0.
 
+if [[ -f /usr/sbin/so-common ]]; then
+  source /usr/sbin/so-common
+else
+  source $(dirname $0)/../../../common/tools/sbin/so-common
+fi
 
 
-#source $(dirname $0)/so-common
-source /usr/sbin/so-common
-
 DEFAULT_ROLE=analyst
 
 function usage() {