topic Re: Windows User-ID Agent Access is denied in General Topics

Windows User-ID Agent Access is denied

jonathanb — Tue, 30 May 2023 23:16:28 GMT

I'm setting up User-ID.

i have a windows server 2012r2 domain controller, and a windows server 2019 domain member for the agent software.
I have configured a service account with user rights assignment to allow logon as a service on the agent host. i have configured permissions to the install directory and to the registry key for the software.
I have added the account to the Event Log Readers and Distributed COM Users groups.
I have created a firewall rule on the DC to allow all connections from the agent host server.

The debug logs indicate that OpenEventLog failed.

Re: Windows User-ID Agent Access is denied

S.Cantwell — Mon, 12 Jun 2023 19:31:39 GMT

Hello there

This has been well documented since Aug 2019 (or 2020) when MS decided to release a patch that no longer allows the agentless UserID agent to function, and MS servers respond back with Access Denied.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkkfCAA&lang=en_US%E2%80%A9

Please de provision the agentless version, and instead, utilize either than StandAlone UserID agent (can be downloaded from their support site) or consider toward cloud based authentication, using PANW CIE (Cloud Identity Engine)

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-new-features/identity-features/cloud-identity-engine

Re: Windows User-ID Agent Access is denied

jonathanb — Mon, 12 Jun 2023 20:15:33 GMT

Thanks. If it wasn't clear, the windows agent host is in use because i'm using the windows agent.

Re: Windows User-ID Agent Access is denied

S.Cantwell — Thu, 15 Jun 2023 12:55:33 GMT

Thank you. I guess I did miss that important detail.
As a test, can you try installation and implementation as a Domain Admin account (just for confirmation)

If this works fine, then you know that this is a permission issue on the AD side and not from the PANW UserID agent side.

Usually, this becomes the root cause of errors.

Please advise.