topic Re: Windows Server 2003 unable to check in to TMS in Cortex XDR Discussions

Windows Server 2003 unable to check in to TMS

grenzi — Tue, 09 Mar 2021 14:19:59 GMT

Hello everybody,

I'm trying to connect an old Windows Server 2003 (service pack 2, 32 bits) to the traps management service. I know that I have to use an old version of the agent (I've installed 5.0.10), but the agent fails to check into the TMS. The problem is related to a certificate that the agent fails to validate. I installed all the required hot fixes listed here: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClPRCA0

and then followed the steps described here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/set-up-endpoint-protection/enable-access-to-cortex-xdr.html

But I'm unable to find the third certificate in the list at Step 3 (GlobalSign (Google)).

Has anyone succeded in this kind of setup?

Thank you in advance.

Re: Windows Server 2003 unable to check in to TMS

JohnSmith7732 — Tue, 09 Mar 2021 18:00:12 GMT

I was able to make most of mine work with just two. i got them through help desk inquiry and imported with certificates add-in mmc and they worked fine. Not sure what they google one is for. What i did note though was on about 3 of 20 servers they connected and showed in management but they remained red on endpoint. Looking at traps log though they appeared to be working anyway.

Re: Windows Server 2003 unable to check in to TMS

jcandelaria — Tue, 09 Mar 2021 21:07:25 GMT

Hi Grenzi,

On your machine or other machine that is working, you can do mmc-->add or remove snap-ins and select Certificates then select computer account. Once loaded, you can go to Trusted Root Certification Authorities-->Certificates then try to find the GlobalSign cert with the correct thumbprint per step 3, then you can export it and import it to the server where its missing this certificate.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/set-up-endpoint-protection/enable-access-to-cortex-xdr.html

Re: Windows Server 2003 unable to check in to TMS

jcandelaria — Tue, 09 Mar 2021 21:09:56 GMT

@JohnSmith7732

Have you tried restarting the cortex xdr service? or is it still red even after the server reboot/restart?

Re: Windows Server 2003 unable to check in to TMS

grenzi — Wed, 10 Mar 2021 09:48:23 GMT

Thank you. I had to import all the CA certificate using the MMC as well. Now the agent seems to work, but with the strange behavior as described by @JohnSmith7732: on the host, the agent shows that is not connected, but in the Endpoint Administration page on Cortex XDR the client shows as connected.

Re: Windows Server 2003 unable to check in to TMS

grenzi — Wed, 10 Mar 2021 15:11:09 GMT

@JohnSmith7732 wrote:
I was able to make most of mine work with just two. i got them through help desk inquiry and imported with certificates add-in mmc and they worked fine. Not sure what they google one is for. What i did note though was on about 3 of 20 servers they connected and showed in management but they remained red on endpoint. Looking at traps log though they appeared to be working anyway.

Hi @JohnSmith7732 , the support confirmed that all three certificates are required (I exported them from another machine, as suggested by @jcandelaria ), as well as the patch KB2868626 for the operating system to support SHA256. Now my agents are connected successfully.

Re: Windows Server 2003 unable to check in to TMS

jcandelaria — Wed, 10 Mar 2021 16:34:07 GMT

@grenzi Have you tried restarting the xdr service? or is it the same even after you restarted the server itself?

Re: Windows Server 2003 unable to check in to TMS

grenzi — Wed, 10 Mar 2021 16:47:16 GMT

@jcandelaria wrote:
@grenzi Have you tried restarting the xdr service? or is it the same even after you restarted the server itself?

No need to restart the server or the service itself after installing the patch and the CA certificates.

Re: Windows Server 2003 unable to check in to TMS

JohnSmith7732 — Wed, 10 Mar 2021 17:09:46 GMT

I have to go back and visit the 3 again. Thanks for the suggestion

Re: Windows Server 2003 unable to check in to TMS

jcandelaria — Wed, 10 Mar 2021 20:59:18 GMT

@grenzi good to know that the agent is working and connected..