topic Re: User Mapping - AD access denied in General Topics

User Mapping - AD access denied

JoHyeonJae — Wed, 08 Feb 2023 02:23:34 GMT

Hello all,

You are using Microsoft Active Directory, but you receive the following error log:

Useridd.log
>

Error: pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_3 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
2023-02-08 06:54:00.114 +0900 Error: pan_user_id_win_get_error_status(pan_user_id_win.c:1288) : WMIC message from server AD_3: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
2023-02-08 06:54:01.111 +0900 Error: pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_2 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
2023-02-08 06:54:01.111 +0900 Error: pan_user_id_win_get_error_status(pan_user_id_win.c:1288): WMIC message from server AD_2: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
2023-02-08 06:54:02.114 +0900 2023-02-08 06:54:02.114 +0900 Error: pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_3 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
2023-02-08 06:54:02.114 +0900 Error: pan_user_id_win_get_error_status(pan_user_id_win.c:1288): WMIC message from server AD_3: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
Error: pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_1 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
2023-02-08 06:54:02.114 +0900 Error: pan_user_id_win_get_error_status(pan_user_id_win.c:1288): WMIC message from server AD_1: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
2023-02-08 06:54:03.114 +0900 Error: pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_2 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
2023-02-08 06:54:03.114 +0900 Error: pan_user_id_win_get_error_status(pan_user_id_win.c:1288): WMIC message from server AD_2: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
2023-02-08 06:54:04.115 +0900 Error: pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603): log query for AD_1 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
2023-02-08 06:54:04.115 +0900 Error: pan_user_id_win_get_error_status(pan_user_id_win.c:1288): WMIC message from server AD_1: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

These issues occur even if AD settings are checked and changed based on the link below.
>https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0

Has anyone experienced and solved these issues?

Re: User Mapping - AD access denied

TomYoung — Wed, 08 Feb 2023 02:37:16 GMT

Hi @JoHyeonJae ,

You need to look at the security event viewer on your AD server to see the specific reason the access is denied.

Thanks,

Tom

RE: User Mapping - AD access denied

JoHyeonJae — Thu, 09 Feb 2023 00:56:49 GMT

@TomYoung

I have looked through the security event viewer on the Server side.

But, there was no evidence to cause it. Is there anything else I can check?

And I found the following article while tracking the error log that occurred. Is it not related to the issue that occurred?

https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c

Re: User Mapping - AD access denied

TomYoung — Tue, 14 Feb 2023 00:30:16 GMT

Hi @JoHyeonJae ,

So you see the DCOM error on the server? It will be in the system event viewer. Thank you for that URL. It has been updated since I last looked. It looks like this issue -> https://live.paloaltonetworks.com/t5/general-topics/user-identification-and-winrm-on-http/m-p/481674. It sounds like if you apply the patch you will be good, but it may be disabled next month. I think PANW will need to provide a fix by then. Please let me know what you find.

Thanks,

Tom

Re: User Mapping - AD access denied

JoHyeonJae — Tue, 14 Feb 2023 04:39:41 GMT

@TomYoung

After I went through the log, the error log number generated by the customer PA is 1288,1603 and the error log number written in the URL is 1587,1272.

2023-02-08 06:54:00.114 +0900 Error: pan_user_id_win_get_error_status(pan_user_id_win.c:1288) : WMIC message from server AD_3: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied
2023-02-08 06:54:01.111 +0900 Error: pan_user_id_win_wmic_log_query(pan_user_id_win.c:1603😞 log query for AD_2 failed: NTSTATUS: NT_STATUS_ACCESS_DENIED - Access denied

Can the same issue occur in this case?

Additionally, the customer is using the KB5015808.