Windows DC 10036 Error

Kyle_Clifton — Wed, 20 Dec 2023 22:02:05 GMT

The server-side authentication level policy does not allow the user Domain\pafw SID (S-1-5-21-3296291719-1816596347-2220831235-9844) from address 192.168.*.* to activate DCOM server. Please raise the activation authentication level at least to RPC_C_AUTHN_LEVEL_PKT_INTEGRITY in client application.

This event triggers on the DC about everyone 2 seconds.

I have no experience in PA, I was wondering if someone could explain the Event to me, and maybe how I can stop having it trigger.

Re: Windows DC 10036 Error

BPry — Thu, 21 Dec 2023 21:48:10 GMT

@Kyle_Clifton,

You're likely still using WMI and have actually upgraded the ADDCs that you're polling for logs. You can modify things to use WinRM over HTTP/S and you'll be perfectly fine.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-server-monitoring-using-winrm

topic Re: Windows DC 10036 Error in General Topics

Windows DC 10036 Error

Re: Windows DC 10036 Error