topic Upgrade DCs to W2019 stop working Palo Alto agentless in General Topics

Upgrade DCs to W2019 stop working Palo Alto agentless

BigPalo — Thu, 13 Mar 2025 09:39:05 GMT

Hi,

We upgraded all ours DCs to W2019server and now the Palo Alto can not monitor the users. We use Agentless UserID.

So how can we fix it?

Re: Upgrade DCs to W2019 stop working Palo Alto agentless

TomYoung — Thu, 13 Mar 2025 11:14:17 GMT

You may be running into this issue -> https://live.paloaltonetworks.com/t5/general-topics/user-identification-and-winrm-on-http/m-p/481674.

There is no fix to my knowledge for WMI. For me, configuring WinRM-HTTP or HTTPS was too complicated, and migrating to the Windows User-ID agent was easy. https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-mapping-using-the-windows-user-id-agent/install-the-windows-based-user-id-agent

Thanks,

Tom

Re: Upgrade DCs to W2019 stop working Palo Alto agentless

BPry — Thu, 13 Mar 2025 21:49:09 GMT

@BigPalo,

WinRM-HTTPS isn't that difficult to setup, but it is dependent on some back-end configuration that you're environment may or may not already be setup to utilize depending on how you're managing your Windows fleet. Personally the change took minutes to get configured, but it was primarily because WinRM was already setup and properly configured.

There are benefits of using the agent instead of agentless, but in general I personally find it a bit overkill for simple environments. Which method is utilized in deployments personally tends to be more of a conversation about the working dynamic between the server operations group and the group managing the firewall. Agentless is a bit more set and forget if those groups are confrontational versus maintaining the agent.

Re: Upgrade DCs to W2019 stop working Palo Alto agentless

BigPalo — Mon, 17 Mar 2025 12:18:18 GMT

The PanOS version is 9.1.x. Its a device in EoS. So i dont know if that has anything to do with Windows 2019.

Why stop working upgrading to W2019 DCs? What is the change? Its documented?

Re: Upgrade DCs to W2019 stop working Palo Alto agentless

TomYoung — Mon, 17 Mar 2025 14:23:54 GMT

Hi @BigPalo ,

Here is the PAN-OS documentation. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkkfCAA

What probably happened is that your previous servers did not have the patch. MS announced that this security fix will be built into future releases. You can find more details by following the 1st URL trail I posted.

Thanks,

Tom

Re: Upgrade DCs to W2019 stop working Palo Alto agentless

BigPalo — Mon, 17 Mar 2025 15:25:21 GMT

Its possible to rollback the patch to work? Doing WinRM is quite annoying