topic Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error in General Topics

Agentless User-ID Connection to Active Directory Servers give me timout connection error

hamza_ineos — Tue, 19 Sep 2017 12:40:42 GMT

Hello

plz help me in this problem, Agentless User-ID Connection to Active Directory Servers give me timout connection error, how i can fix this ?

i'm using server 2012

i already followed this link steps : https://live.paloaltonetworks.com/t5/Management-Articles/Agentless-User-ID-Connection-to-Active-Directory-Servers/ta-p/52041

but with no result

Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error

mahmoodm — Tue, 19 Sep 2017 14:06:19 GMT

Hi,

Whats the the AD domian name,please try domain\username

Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error

hamza_ineos — Tue, 19 Sep 2017 15:30:59 GMT

yes i did it already, my domain is pa.ma, but there is no result

Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error

BPry — Tue, 19 Sep 2017 16:39:53 GMT

@hamza_ineos,

Have you followed the information as documented HERE and actually given the user Distributed COM, Event Log Readers, Server Operators? You also need to give the selected account access to CIMV2 to allow Enable Account and Remote Enable? I'm fairly certain the default permissions for Administrator are not going to work here without following the above.

I highly recommend you do not use the domain admin account for this user and actually setup a seperate account specific to this function and properly follow the Best Practices guide HERE

Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error

hamza_ineos — Tue, 19 Sep 2017 17:16:56 GMT

yes i did with another account but there is n problem 😞

Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error

Rameshwar — Thu, 28 Sep 2017 17:25:44 GMT

did you got the solution as i am also getting same error

Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error

hamza_ineos — Fri, 29 Sep 2017 08:05:14 GMT

no not yet

Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error

Rameshwar — Sun, 01 Oct 2017 15:59:04 GMT

For another server i am getting error as not connected , when i add the user id to domain admin group it is getting connected without any error and when i remove it shows not connected

the server is 2012 , not sure if this will work on 2008 server ....you may try the same

Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error

hamza_ineos — Sun, 01 Oct 2017 19:30:49 GMT

Plz can you send me by pictures how you add this user-id ??

Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error

Rameshwar — Mon, 02 Oct 2017 15:59:11 GMT

this has to be done on server side i.e on AD for service account which you are using in PA for user id to ip mapping , you have to add that user to group which i required as mentioned on PA site i.e event log , security log , DCOM , server operator ... once you also add him to domain admin group it will show connected ....i my case when i did this on lab it is working but in customer it is still not working.... please advise anyone if they know the solution for this ..i even reseted the password of the service account

Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error

hamza_ineos — Tue, 03 Oct 2017 17:10:36 GMT

No it's not working brother

why not the paloalto support team dosn't help on this ??

Re: Agentless User-ID Connection to Active Directory Servers give me timout connection error

Rameshwar — Mon, 09 Oct 2017 09:16:42 GMT

@hamza_ineosi managed to resolve the issue , the issue which i was facing i.e . connection timeout on server monitoring

i found out that customer installed symantec antivirus on DC and once we removed it , rebooted the server then it started to connect . before this i did a pcap from bot the fw to check if there is any drop. if no drop that means fw is not in issue . hope this will help you to resolve your problem . you may ask the system admin to uninstall any antivirus installed on DC and turn off the FW of server . RPC port 135 is used in agent less config to get the logs from PA FW