topic Re: Agentless User-ID issue problem - AD Local Security Policy incompatibility in Next-Generation Firewall Discussions

Agentless User-ID issue problem - AD Local Security Policy incompatibility

mR00t_s5 — Tue, 12 Nov 2024 14:14:17 GMT

Hi, I was trying to set up an agentless User-ID configuration when I ran into this issue: my AD Local Security Policy has deny log on locally for Event Log Readers and Distributed COM users set up. For company security reasons, I cannot change this policy. What I want to know is if there's any other way I can set User-ID synchronization to avoid this problem. Thanks!

Re: Agentless User-ID issue problem - AD Local Security Policy incompatibility

arusharma — Wed, 13 Nov 2024 04:31:20 GMT

You need to have proper account and permission to set this up: https://live.paloaltonetworks.com/t5/general-topics/agentless-user-id-agent-permissions/td-p/427399

https://knowledgebase.paloaltonetworks.com/kcSArticleDetail?id=kA10g000000ClGG

Re: Agentless User-ID issue problem - AD Local Security Policy incompatibility

CosminM — Wed, 13 Nov 2024 06:49:59 GMT

Hello @mR00t_s5

If you are trying to connect to your AD using WMI, this may not work for some months ago because of Windows patch KB5014692.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clk0CAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkkfCAA

If that is the case, and are using Server Monitor, you need to configure WinRM-HTTP or WinRM-HTTPS.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-server-monitoring-using-winrm