PANOS Integrated UserID with WINRM

nileshgurav — Fri, 24 Mar 2023 19:30:19 GMT

Hello,

I am trying to configure PANOS(10.1.8) Integrated UserID with Wndows AD 2016 (with Kerberos).

I am getting "Access Denied" status under User Mapping --Server Monitoring

I have validated that user is part of below security groups on AD

Distributed COM Users
Event Log Readers
Remote Management Users
Server Operators

I see below logs

Error: pan_user_id_winrm_query(pan_user_id_win.c:2751): failed to connect to winrm server XXXXXX in vsys 1
Error: pan_user_id_winrm_error(pan_user_id_win.c:2644): HTTP 500: s:Senderw:AccessDeniedAccess is denied. Access is denied.
Error: pan_user_id_winrm_query(pan_user_id_win.c:2795): Connection failed. response code = 500, error: (null) in vsys 1, server=XXXXXX

Reffered below KB Articles/ links but could not get through.

https://live.paloaltonetworks.com/t5/general-topics/best-way-of-doing-user-id-mapping-wmi-winrm-http-there-is-also/td-p/292854

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001VUICA2&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Any inputs will be appreciated.

Re: PANOS Integrated UserID with WINRM

BPry — Fri, 24 Mar 2023 20:19:40 GMT

@nileshgurav,

If the user account has been setup properly now you have to move on to looking at Windows Remote Management itself? Has it been setup on the host to actually run, does the firewall have permission to use it or is it restricted, is the listener actually setup properly?

Re: PANOS Integrated UserID with WINRM

nileshgurav — Tue, 23 May 2023 13:21:59 GMT

This was resolved by giving user account super admin privilage (domain admin ) on AD as last resort.Thank You.

topic Re: PANOS Integrated UserID with WINRM in General Topics

PANOS Integrated UserID with WINRM

Re: PANOS Integrated UserID with WINRM

Re: PANOS Integrated UserID with WINRM