user id agent wmi broken after kb5023702 installed

Groche — Thu, 16 Mar 2023 12:06:05 GMT

Hi,

i installed the kb5023702 on my active directory, and it breaks the user-id mapping on palo alto with wmi.

I had to uninstall this kb to resolve this.

Do you have a solution for this bug ?
Thanks,
Regards

Re: user id agent wmi broken after kb5023702 installed

BPry — Thu, 16 Mar 2023 20:43:26 GMT

This is expected if you're still using WMI with the enforced security improvements that Microsoft has made with this update. Should have been triggering alerts for a year prior to them enforcing it this year, but easily missed if you weren't actively looking for it.

You'll want to configure the firewall to utilize WinRM-HTTP or preferably WinRM-HTTPS instead of WMI if you continue to utilize agentless. Fairly straightforward conversion to make.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-server-monitoring-using-winrm

topic Re: user id agent wmi broken after kb5023702 installed in General Topics

user id agent wmi broken after kb5023702 installed

Re: user id agent wmi broken after kb5023702 installed