User-ID Integration with AD Failing (Access Denied / Kerberos Errors – Event ID 10036)

M.R107318 — Thu, 10 Jul 2025 18:37:27 GMT

Hi Team,

I'm working on integrating my Active Directory (Windows Server 2016) with a Palo Alto PA-450 firewall to enable User-ID functionality. While setting up the server monitoring configuration, I'm running into issues when using both WMI and WinRM-based authentication.

Issue Details:

When using WMI: The firewall shows Access Denied under Server Monitoring.
When using WinRM with Kerberos Http: The firewall shows Kerberos error.

In the AD event viewer, I’m seeing the following message:

The server-side authentication level policy does not allow the user <username> from address <firewall IP> to activate the DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in the client application.
Event ID: 10036

✅ Troubleshooting Done So Far:

Verified that the AD user account has local admin rights on the domain controller.
Confirmed WinRM is enabled and configured correctly on the AD server.
Ensured the correct encryption types (AES128, AES256) are enabled.
Verified the firewall can resolve the FQDN and ping the domain controller.
Checked time synchronization between firewall and AD.

Also verified as mentioned in the below procedure
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clk0CAC

Despite this, the firewall still fails to authenticate and collect user-to-IP mappings.

❓Request for Help:

Can someone please help clarify the following:

What specific DCOM or WinRM permission changes are needed on the domain controller to allow this integration?
How to ensure RPC_C_AUTHN_LEVEL_PKT_INTEGRITY is accepted by the AD server for connections coming from the Palo Alto firewall?
Any Group Policy or registry changes required on the domain controller to allow Kerberos to work with the firewall?

Any insight or guidance would be greatly appreciated!

topic User-ID Integration with AD Failing (Access Denied / Kerberos Errors – Event ID 10036) in Next-Generation Firewall Discussions

User-ID Integration with AD Failing (Access Denied / Kerberos Errors – Event ID 10036)

Issue Details:

✅ Troubleshooting Done So Far:

❓Request for Help: